Could someone be reading your WhatsApp messages? Check your linked devices

Think about the laptop you used at your last job, the hotel business-centre computer you used to send a boarding pass, or the old MacBook you sold last year. Any of them could still have your WhatsApp open, receiving every new message the moment your phone does.

This isn't a hack in the usual sense. It's how one of WhatsApp's most useful features is designed to work, and most people never check it.

The feature that keeps working after you've forgotten about it

WhatsApp's 'linked devices' feature lets your account run on more than your phone. WhatsApp's own help pages say you can have up to four linked devices alongside your primary phone. These can be computers, tablets, or even a second phone.

Since 2021, those devices no longer depend on your phone. They keep working even when your primary phone is offline. That's convenient, and it's also why old sessions last so long.

A linked device is removed in only three situations: You log out, it goes unused for about a month, or your phone goes quiet. WhatsApp disconnects linked devices after 30 days of inactivity, and they're also logged out if the phone itself goes unused for more than 14 days. If you use WhatsApp on your phone every day, which most people do, a forgotten session that's still active can stay connected indefinitely.

Check your WhatsApp Linked Devices now

WhatsApp itself recommends regularly reviewing your linked devices.

On iPhone

1. Open WhatsApp and tap Settings.

2. Tap Linked Devices.

On Android

1. Open WhatsApp and tap the three dots in the top-right corner.

2. Tap Linked devices.

You'll see the devices currently linked to your account. If you don't recognise one, WhatsApp says you can tap the device and choose Log out to remove it.

What can a linked device access?

WhatsApp says each linked device connects independently while maintaining end-to-end encryption for personal messages, media and calls.

However, the important point is that a linked device is an authorised endpoint for your account. If you deliberately link WhatsApp to your laptop, that laptop needs access to your WhatsApp conversations for the feature to work.

So if an unfamiliar device appears in your Linked Devices list, the issue isn't necessarily that someone has broken WhatsApp's encryption. It may be that an unwanted device has been linked to your account.

How could someone else's device get there?

A device you forgot about. This is the simplest explanation. You may have linked WhatsApp to a work computer, shared laptop or another device and never logged out.

Someone with access to your phone. WhatsApp's device-linking process requires the primary phone to authorise a new device. WhatsApp's own instructions show that users can link devices by scanning a QR code or using a phone-number-based linking process.

Linking a new device takes only a few seconds on an unlocked phone, so anyone who briefly has your phone and passcode could do it without you noticing.

A scam. Security researchers have also documented scams that abuse this legitimate linking process.

The WhatsApp scam that tricks you into linking a stranger's device

Researchers at Gen Digital have documented a campaign called GhostPairing, which tricks victims into completing WhatsApp's own device-linking process.

The scam can begin with a message containing a link that appears to lead to a photo or other content. The victim is then taken to a fake page and prompted through a process that ultimately gets them to enter a pairing code in WhatsApp. In reality, that action authorises the attacker's device.

The key warning: you don't necessarily need to have your WhatsApp password stolen for this type of attack to work. The victim can be manipulated into authorising the new device themselves.

Don't wait for a warning

WhatsApp recommends enabling push notifications and regularly checking your linked devices. If you don't recognise a linked device, WhatsApp says you can review it and remove it.

The safest habit is therefore simple: open Linked Devices yourself and check the list periodically.

Found something you don't recognise?

Log it out. If an unfamiliar device appears in your list, remove it immediately.

If you think you've been scammed, check everything. Remove unfamiliar linked devices and tell your contacts if your account may have been used to send messages in your name.

Keep evidence if money is involved. Take screenshots of the Linked Devices list and suspicious messages before deleting anything or reporting the incident.

If you think someone close to you linked the device, consider your safety first. Removing a device could alert the person that you've discovered the connection. If the situation involves controlling or abusive behaviour, consider getting specialist support before taking action.

How to protect your WhatsApp account

• Check Linked Devices regularly. WhatsApp itself recommends doing this.

• Never enter a WhatsApp pairing or verification code because a stranger's message tells you to.

• Don't approve a device link you didn't initiate.

• Use biometric security on your phone where available.

• Log out of shared or work computers when you're finished using them.

• Keep WhatsApp updated on your devices.

• Turn on two-step verification for an additional layer of account security.

WhatsApp's linked-devices feature is useful because it lets you move between your phone and other devices without constantly reconnecting. The risk comes when you forget what you've connected, or when a scam tricks you into approving a device you don't recognise.

A quick check of Linked Devices can tell you what's attached to your account and let you remove anything that shouldn't be there.