Fake “Signal Support” Messages That Steal Backup Keys

The message claims that your account is “compromised” and provides step-by-step instructions for generating a 64-character backup recovery key and copying it into the chat. If you hand it over, an attacker who also gains access to your account can decrypt and restore your entire Signal history on their device—all conversations and their contents, including voice messages, photos, videos, and files (except messages set to disappear after 24 hours and view-once media, which are not saved in backups). Act immediately. Assume that your message history has been compromised and take the following steps immediately: 1. Although Signal’s backup feature can be useful for restoring historical chats and data if a device is lost or stolen, it also creates a significant risk that, in the event of a targeted attack on your Signal account, someone could gain unauthorized access to your backups. My recommendation is not to enable Signal backups at all and to follow the other guidance. Never disclose your recovery key, Signal PIN, or SMS registration code to anyone—not in the app, by email, or over the phone. Do not press “Accept” to enable anything. Turn on Registration Lock (Settings → Account → Registration Lock).