An alert about messaging accounts
In a notice published on 20 March 2026 and updated on 18 June, CERT-FR describes attacks targeting Signal accounts in particular. A fake group invitation encourages the victim to scan a QR code that actually links a device controlled by the attacker.
CERT-FR says these campaigns misuse legitimate app features without exploiting a Signal vulnerability. It also mentions methods applicable to other messaging apps, such as WhatsApp. This French finding does not provide a count of victims in Belgium.
A QR code can be used to link a device
A QR code does not necessarily contain a link to a web page. In a messaging app, it can also take part in an account operation. Signal documents device linking from the main phone’s settings, by scanning the QR code displayed on the device being added.
The useful question is: which device are you about to authorise? Linking should match a process you started for a device you control. A promise of group access or a sender’s displayed name does not answer that question.
Before scanning or confirming
Fictional example: someone claims to represent an association and sends you a QR code for a volunteer group. As you continue, the app offers to link a new device. That request does not match the stated invitation: stop the process and check with your usual contact.
- Confirm an unexpected invitation through another known channel, without using contact details supplied in the suspicious message.
- Read the action shown by the app; cancel any device link you did not request.
- Do not share your verification code, PIN or password with the person contacting you.
- To add your own computer, start with your messaging app’s official instructions and the QR code displayed on that computer.
Have you approved an unexpected device link?
Open your messaging app’s settings on your phone and inspect linked devices. For Signal, the official documentation explains how to view this list and unlink a device on your operating system. Do not follow a recovery procedure sent by the suspicious account.
Removing an unknown device limits its future access; it does not recover data already viewed or copied. Still having access to your own account does not rule out third-party access either.
Notify your contacts through another channel if messages may have been sent in your name. For an account used at work, also contact your IT team. If you have lost access, follow the official support guidance for the service concerned.
In Belgium, keep using anti-phishing precautions
Misusing device linking is not the only risk. A QR code can also lead to a fake page asking for your login details. Safeonweb describes this form of QR phishing as “quishing”.
On 21 October 2026, Safeonweb also warned about fake voting competitions on WhatsApp. In that case, the request uses a website and a verification code to link a device, with no QR code mentioned. The scenario differs from the fake Signal invitation, but shows why requests for a code or device link need scrutiny, even when the message comes from a known contact.
Safeonweb — WhatsApp alert of 21 October 2026
If an unexpected page asks you to sign in or provide sensitive data, close it and find the service through its app or an address you already know. To report a suspicious message in Belgium, consult Safeonweb’s instructions. Reporting does not replace action to protect an account that has already been affected.
What the Qurl reader can check
The Qurl reader can extract the content of a QR image without automatically opening its destination. For a web link, it also displays the domain. This helps you read what the image contains, but does not prove the sender’s identity or the destination’s safety.
Qurl does not inspect your Signal or WhatsApp account, check linked devices or certify an invitation. If content looks unfamiliar, do not paste it into a messaging app to try to make it work. Return to the service’s official instructions.
Read the content of a QR image · Consult our security guidance