Have you been receiving a lot of spam on Signal recently? Don’t worry, it’s not just you. Online spammers are among some of the most persistent troublemakers on the internet, and they’ve set their sights on a new target.
Where Did Signal Spam Come from?
Signal uses your real mobile number in order to identify you. If you want to contact another user on Signal, you can try looking them up by their phone number. On Signal, there is no separate identifier, like a username or handle, that you would associate with a platform like Twitter or Snapchat.
This means that Signal is open to the same abuses that you are probably already exposed to via SMS messages sent to your mobile number. If your phone number has been targeted by regular text-message spammers in the past, it’s likely already known to spammers who buy, sell, and distribute databases of legitimate numbers for spam purposes. (That Facebook data breach is just one way that your phone number may have been exposed.)
Many of these users ended up on Signal due to how the instant messenger takes a privacy-focused approach to communication. With a huge influx of users, Signal became a much more viable target for spammers and scammers alike.
This was made so much easier due to the way that Signal identifies its users: with plain old phone numbers.
What You Need to Know About Signal Spam
When you receive a spam message on Signal, it will appear to be a regular notification, as if it came from a known contact or friend. But these unsolicited messages are message requests, not standard messages.
This is a good thing because it requires that you consciously engage with the number in order to interact with the message. Most spammers and scammers want you to click on a link. These links may contain malware, point to tech-support scams, use fake websites in an attempt to phish your password, or worse.
Fortunately, you cannot click on a link in a Signal message request until you have accepted the message request. This is an important safeguard since it means that most users aren’t at risk, as most users simply won’t engage with the message.
Spam will appear in your Signal conversation list as a message request. Tap on the request and you’ll be able to Block, Delete, or Accept the request. Accepting the request will share your name and display photo and will make it possible for you to click on any links included in the message.
The safest thing to do is to bar the number entirely using the Block button. Most spammers will frequently change numbers, but by blocking these numbers as they come, you can ensure that you don’t get any more requests from the same source. You can also swipe left in the conversation list to delete the conversation without viewing it.
You shouldn’t worry about blocking legitimate correspondence via Signal. Companies like Amazon and Facebook will not send you important information via a third-party messaging app. If you receive a message saying that you’ve been randomly selected to win something, ignore it. If you’ve been told that a social media account needs verification, check for yourself by using the official app or website.
One Option: Delete Your Signal Account
The easiest way to avoid spam on this service is to delete your Signal account. If you’re reliant on the service, then this solution is far from ideal. But if you’re a casual user who signed up out of curiosity, it’s an easy fix.
You can delete your Signal account by tapping on your user icon in the app, followed by Account, and then Delete Account. For as long as you have the same mobile number, you will be able to sign up again and use the service.
The only other option is the same route you would take to combat nuisance callers and SMS spammers: changing your mobile number. If you choose this route, you should be careful who you give your number to so that you can avoid ending up on a spammer’s database again in the future.
Unfortunately, it seems like only a matter of time before most numbers are compromised in this manner. Security breaches often expose mobile numbers, even if you’re careful about not giving your information to marketing companies.
In all likelihood, the spam is bound to return eventually, whether it’s via Signal, SMS, or even voice calls. Changing your number might be more hassle than it’s worth unless you’re receiving an unbearable amount of unsolicited messages.
Avoiding SMS Spam on Signal
On Android—but not on iPhone—Signal can also function as your default SMS app. If this is the case for you, some of the spam you’re seeing in Signal on Android may be normal SMS spam that would otherwise be delivered to a separate SMS app. Consider disabling SMS integration in Signal for Android to stop this.
Signal Spam Is a Difficult Problem to Solve
Aside from not using Signal or frequently changing your mobile number, you won’t find a clear solution for how to deal with Signal spam. Signal is likely already attempting to tackle the issue, but the platform’s unique approach to security and privacy makes that difficult.
All Signal communication is end-to-end encrypted, which means that only the recipient of a Signal message can read it. While the message is in transit, it cannot be read by Signal or your internet service provider. If the data were to be intercepted, it wouldn’t be of any use to anyone without the decryption key.
Since Signal cannot scan your messages for links, identifying spam could be tricky. Many Signal users on Reddit have requested that the service implement a feature that would block all communication from numbers that aren’t in your contact list, in addition to a “Report Spam” feature that would help identify problem numbers.
Whether Signal can get on top of the spam problem remains to be seen, but for now, just remember to block suspicious incoming message requests, never click on links in emails, and guard your mobile number wherever possible.
All Rights Reserved for Tim Brookes