WhatsApp and Signal leak your daily routine to anyone with your number

Your messages in WhatsApp and Signal are encrypted and nobody outside the chat reads them. That part works. What still leaks is the small grey tick that says a message arrived: it comes back at a measurable speed, and that speed says whether your screen is on, whether you are on Wi-Fi or mobile data, how many devices you have and when you go to sleep. Anyone who knows your phone number can collect it, and you get no notification at all.

How a tick becomes a tracker

Researchers at the University of Vienna and SBA Research published the mechanism in a paper called Careless Whisper. The idea is short enough to explain in four lines.

1. The attacker sends your number a message that the app processes but never displays, such as a reaction pointing at a message ID that does not exist.
2. Your phone decrypts it, decides there is nothing to show, and dutifully sends back a delivery receipt anyway.
3. The attacker measures how long that receipt took to come back.
4. Repeat every fraction of a second and the timings draw a graph of your day.

Nothing appears on your screen. No notification, no new chat, no unread badge. The paper compares it to a stealth SMS, the technique police use to locate a handset without the owner noticing.

What the timings give away

A phone with the screen on answers faster than one lying face down on a table. A phone on Wi-Fi answers differently from the same phone on mobile data. A desktop client that just came online answers on its own. From that the researchers reconstructed screen-on time to the second, working routines, commuting, and the number of devices logged into the account together with which operating system each one runs.

The same channel works as a weapon rather than a sensor. Because the probing messages can carry arbitrary payload, the team measured what happens when you send big ones continuously.

On Signal the picture is milder. Short bursts go through, but sending several messages a second runs into limits, and the team could not meaningfully drain a test phone's battery. The tracking side channel still works there; the resource exhaustion does not.

Threema behaved differently

The researchers tested three messengers. Threema handles receipts restrictively enough that silent probing does not work: the only way a stranger can trigger anything is to send a normal text message and start a visible conversation, which is the opposite of stealthy. That matters because it shows this is a design decision, not a law of physics. WhatsApp and Signal answer strangers by default; Threema does not.

What the vendors did about it

1. 5 September 2024The researchers report the findings to the security contacts at both Meta and the Signal Foundation.
2. 24 September 2024Meta confirms receipt and says the report went to the development team. No substantive answer follows.
3. 8 August 2025Nearly a year later, Meta again tells the researchers the report has been forwarded to engineering.
4. SignalNo reply at all, according to the paper.

The paper lists fixes that would close it: stop sending receipts to numbers that are not in a conversation, let privacy-minded users switch instant receipts off, add a little random delay to receipt timings, and validate referenced message IDs instead of acknowledging nonsense. None of those has shipped as a protocol change. In December 2025 someone published a working proof of concept on GitHub that turns the technique into a dashboard, which is where most people first heard about it. The underlying behaviour has not changed since.

The number is the weak point

Every version of this attack starts the same way: the attacker types in a phone number. That is also the finding of a second study from the same Vienna group, presented at NDSS 2026, which showed that WhatsApp's contact discovery could be queried at more than 100 million numbers per hour and confirmed 3.5 billion live accounts across 245 countries. Meta has since mitigated that one. The lesson survives the fix: on both platforms your phone number is the address, the login and the search key at once.

What you can actually do today

Usernames are the part worth acting on. They do not patch the side channel, but they take away the thing the attack needs. If nobody outside your contacts can reach you by number, nobody outside your contacts can ping you for timings either.