Scroll through TikTok or Facebook for a few minutes and you will see them: ads promising an app that can read anyone’s WhatsApp chats, track their live location, and recover their deleted photos — all you need is their phone number. Parents worried about their children search for these tools. Partners who suspect cheating search for them too. The promise sounds powerful, and it is aimed exactly at people who are worried.
Here is the plain truth, before any detail: no app or website can read someone’s WhatsApp from just a phone number. It is not a matter of price or of finding the “real” one among the fakes. The way WhatsApp is built makes it technically impossible. What these products actually do is take your money, and in many cases they spy on you — the person who installed them. This guide explains why the promise cannot work, how the scam really makes money, how WhatsApp accounts genuinely get compromised, and what parents and partners can legitimately do instead.
The Keys Live Only on the Two Phones
WhatsApp uses end-to-end encryption for personal messages and calls. In simple words, every chat is locked with a special key, and that key exists only on the two phones taking part in the chat — the sender’s phone and the receiver’s phone. The message is locked before it leaves the sender’s phone and can only be unlocked on the receiver’s phone.
This is not a marketing claim from a blog. WhatsApp’s own Privacy page says that your personal messages, photos and calls stay between you and the people you choose, “meaning not even WhatsApp can see them,” and that only you and the recipient have the special key needed to unlock and read them. WhatsApp’s Security page says the same thing from the other side: no one can search for your phone number or read your personal messages. WhatsApp repeated the point in a January 2026 statement: the message encryption keys are not accessible to WhatsApp or Meta, and only the intended recipient has the keys to decrypt messages.
Now think about what a “spy app” website is asking you to believe. You type a number into a web page. That website is not one of the two phones in the chat. It does not have the key, and there is no way for it to get the key from a phone number. A phone number is just an address — it is not a password, and it unlocks nothing. So when a site says “enter any number, see all chats,” it is promising something that the design of WhatsApp does not allow to exist. (Claims in a 2026 lawsuit alleging WhatsApp itself can read messages are denied by WhatsApp and unproven — and even those claims never suggested a random website could do it by number.)
What the Ads Promise vs What You Actually Get
If the promise is impossible, why do the ads look so convincing? Because the ads are the product. On 22 October 2026, the security company Bitdefender published an investigation into exactly this wave of apps. It found apps sitting in official app stores, promoted heavily through TikTok ads, claiming users could track someone’s location, access private messages, uncover hidden accounts and recover deleted photos using only a phone number. One app, Lens AI, was promoted in more than 3,000 ads in a single month.
Bitdefender’s key finding: the app store listings did not even make the same claims as the TikTok ads, and the apps did not provide the promised features. One app it examined in detail was little more than a basic photo-stamping camera wrapped in advertising and billing software. On the WhatsApp claim specifically, Bitdefender’s verdict was blunt: the ads say the app can give full access to someone’s WhatsApp, and that is a lie.
| What the ad promises | What actually happens |
|---|---|
| Read anyone’s WhatsApp chats by entering their number | Impossible — the chat keys exist only on the two phones in the conversation |
| Track live location and recover deleted photos | The feature does not exist in the app; the listing does not even repeat the ad’s claims |
| Free trial, see results first | A small card payment is taken, then recurring subscription charges follow |
| 100% undetectable spying | The app cannot spy at all — but mod versions can spy on the person who installed them |
| Pay once, unlock full access | “Unlocking” changes nothing; users report paying and receiving nothing |
The Real Business Is Subscriptions, Not Spying
Bitdefender found that the real business model of these apps is not spying — it is subscriptions. The goal is to persuade you to sign up, even briefly. A trial presented as free is accompanied by a small payment, and revenue comes from those upfront payments plus recurring subscriptions that people forget to cancel. In user reviews quoted in the investigation, one person’s “free” 7-day trial charged $5.40, and another user was charged, ran “out of credits” after 20 minutes, and received nothing at all.
Websites running the same scam work in a similar way: they may keep you busy with one more survey, one more “verification” step or one more small payment, always one step away from results that never appear — because there are no results to show. The moment a service asks for card details before showing you anything, you are not buying a spy tool. You are the customer being harvested.
The Danger Runs the Other Way: Mods Spy on the Installer
The darker version of this scam does not come from app stores. It comes as an APK file shared through Telegram channels or download sites — often a “mod” version of WhatsApp promising extra features like seeing deleted messages or hiding your online status. Kaspersky researchers found a spy module, which they named CanesSpy, hidden inside such WhatsApp mods. Once installed, it sent the phone’s IMEI, phone number, country and network codes, contacts and account details to an attacker’s server, re-sent contacts and account data every five minutes, and could record the microphone and pull files from the phone’s storage on command.
Read that again: the person who installed the “spy” tool is the person being spied on. Kaspersky blocked more than 340,000 attacks from this WhatsApp spy mod across more than a hundred countries — and to be clear about the date, that figure is from October 2023, not a new 2026 wave. The lesson has not changed since: Kaspersky’s advice is to use official messaging apps only, from official stores.
The risk does not stop with mods. TechCrunch has kept a running tally of stalkerware companies whose own customer data was hacked or leaked online: at least 27 companies since 2017, several of them hacked more than once. In one case, a hacktivist scraped the payment information of more than 500,000 customers of a stalkerware service and its sister apps. So a person who pays for a spy service hands their card details and identity to operators with famously poor security — and if that data leaks, the whole world can see who was trying to spy on whom. Regulators have also shut vendors down; the US Federal Trade Commission banned one maker, SpyFone, from the surveillance industry entirely.
How WhatsApp Accounts Really Get Compromised
If number-based spying is impossible, how do real accounts get taken over? Never through a magic app — always through the account owner’s own actions, or brief physical access to their phone. There are three routes to know.
1. The registration code trick. When you register WhatsApp, you receive a 6-digit code by SMS. Anyone who gets that code can register your number on their phone. The classic pretext, described by Bitdefender quoting WhatsApp’s own warning, is a message from a contact — often a friend whose account was already hijacked — saying “I sent you a code by mistake, please forward it.” WhatsApp’s rule is absolute: never share your verification code with anyone, even friends or family. Note that even a successful hijack does not expose your old chats, because past conversations stay stored on your phone — but the hijacker can impersonate you and scam your contacts.
2. GhostPairing and the voting trick. In December 2025, researchers at Gen Digital (the company behind Norton and Avast) uncovered a campaign nicknamed GhostPairing. A message from a known contact — “Hey, I just found your photo!” — leads to a fake Facebook-style page that quietly starts WhatsApp’s genuine “link with phone number” process. If you enter the pairing code the page shows you, you have just linked the attacker’s browser to your account as a trusted device. No password is stolen and no SIM is swapped; you authorised the link yourself. A close cousin, documented by Kaspersky in September 2025 and reported resurging in October 2026, uses a fake voting page — “vote for Sophie” — that asks you to “authorise” with your WhatsApp number and type in a code, with the same result: the attacker’s session goes live and they can read and send messages as you.
3. Physical-access stalkerware. Real stalkerware does exist, but it works in the opposite way to the ads: someone must physically install it on the victim’s phone, usually during a few minutes alone with the unlocked device. Kaspersky reports that in 2024–2025 more than 34,000 people were affected by stalkerware worldwide. Warning signs include fast battery drain, unexplained data use, apps you do not recognise, and “install from unknown sources” switched on.
One critical safety note from Kaspersky: if you suspect a partner has installed stalkerware on your phone, do not remove it immediately. Removing it can alert the person watching and escalate the situation at home. First, get help using a different, safe device — contact a trusted person or a support organisation, and make a plan before you touch the app.
The Red Flags: Spot the Scam in Ten Seconds
- The service asks for payment or card details before showing any results.
- It promises “100% undetectable” spying, live location, or all chats and photos from just a number.
- The “free trial” asks for a small payment.
- The app is an APK from a random website or Telegram channel instead of the Play Store or App Store.
- Anyone — a website, a Telegram “agent”, “support”, even a friend — asks you to share a 6-digit code, enter a pairing code, or scan a QR code that you did not start yourself.
- The message creates urgency with a story: a photo of you, a vote, a delivery, a degree verification.
The One Real Check: Your Linked Devices List
There is exactly one genuine “who is reading my WhatsApp” check, and it is built into WhatsApp itself. Your account can be linked to up to four extra devices — computers, tablets or a second phone — and every one of them is listed in one place:
- Android: tap the three-dot menu (⋮) → Linked devices.
- iPhone: tap Settings → Linked devices.
Go through the list. If you see a browser or device you do not recognise, tap it and choose Log out. WhatsApp itself recommends reviewing this list regularly. If you never linked anything, the list should be empty — and if it is not, someone had your unlocked phone for a few seconds, or tricked you into entering a pairing code.
Lock Down Your Own Account
Three built-in protections close the real routes described above:
- Two-step verification (Settings → Account → Two-step verification): an extra secret required when your number is registered on a new phone. It has long been a 6-digit PIN; since August 2026 WhatsApp is upgrading it to a full password with letters, numbers and symbols. The upgrade is rolling out gradually, so you may still see the PIN screen — either version is far better than none.
- Passkey (Settings → Account → Passkeys): lets you verify yourself with your fingerprint, face or screen lock instead of an SMS code, removing the code that phishers try to steal. WhatsApp says more than a billion people now use a passkey, and an account can hold more than one.
- Security notifications (Settings → Account → Security notifications): alerts you when a contact’s security code changes — for example when they get a new phone. The alert is a prompt to verify with the person, not proof of hacking.
For people at higher risk, such as journalists and public figures, WhatsApp also offers Strict Account Settings (Settings → Privacy → Advanced, launched January 2026), which switches on several of these protections at once and blocks attachments from unknown contacts.
For Parents: Real Controls, Honest Limits
Parents searching for spy apps usually have a real concern — a child’s safety. WhatsApp’s answer is a set of genuine parental controls, but you should know their honest limit up front: they never let a parent read the child’s messages or listen to calls. The chats stay end-to-end encrypted, even from parents.
What the real controls do offer: parent-managed accounts for pre-teens, launched in March 2026, where a parent sets up the account with both phones side by side, decides who can contact the child and which groups they can join, reviews message requests from unknown contacts, and protects the privacy settings with a parent PIN; these accounts have no Channels, Status or Meta AI. Parental controls for teens aged 13–17, announced on 30 September 2026, let a linked parent set profile and group privacy, receive a notification when the teen joins or leaves a group, and control Channels, Status and Meta AI access.
These controls are rolling out gradually, and their availability in Pakistan has not been confirmed — if you do not see them yet, update WhatsApp and check again. What you can do today, on any phone, is sit with your child, set a strong screen lock together, turn on two-step verification on their account, and agree on the contacts and group rules. That protects your child from the people who actually target them — strangers and scammers — which no spy app was ever going to do.
The Pakistan Angle: Code Scams, the Law, and Where to Report
In Pakistan, the documented WhatsApp danger is not spy-app purchases — it is code phishing aimed at ordinary users. The Digital Rights Foundation’s alert, reported by Dawn, describes victims receiving calls from people posing as delivery riders, or pretending to be from the Higher Education Commission (HEC), who pressure the victim to share a code that has arrived on their phone. Sharing it hands over the victim’s WhatsApp account. The Foundation’s advice is simple: a genuine courier code only ever comes from the courier company’s official number, and you should never share any other code with anyone, no matter how much they insist. Scam calls can be reported to the PTA complaint cell at 0800-55055. With roughly 52 million WhatsApp users in Pakistan, this trick is run at enormous scale.
There is also a legal side that partners, in particular, should understand. Secretly accessing someone else’s phone or accounts is a criminal offence in Pakistan under the Prevention of Electronic Crimes Act (PECA) 2016. Under Section 3 of the Act, unauthorised access to an information system or data carries imprisonment of up to three months, or a fine of up to Rs 50,000, or both. Section 4, covering unauthorised copying or transmission of data, carries up to six months, or a fine of up to Rs 100,000, or both. (You may see much larger figures quoted on lawyer blogs and social media — the figures here are the ones in the Act’s own text.) Buying a “spy service” therefore does not just waste money; attempting to use one on someone can put the buyer on the wrong side of the law.
For reporting, note that the route has changed. Cybercrime complaints in Pakistan are now handled by the National Cyber Crime Investigation Agency (NCCIA), which replaced the FIA’s cybercrime wing. You can file a formal complaint on its portal, complaint.nccia.gov.pk, or call its helpline, 1799 — a portal complaint gives you a trackable reference number. If 1799 does not connect, use the portal, or report scam calls and numbers to the PTA at 0800-55055. Older guides still pointing you to the FIA and 1991 are out of date.
If You Already Fell for It: Recovery Steps
- Uninstall the fake or mod app from your phone, and install WhatsApp only from the Play Store or App Store.
- Run a Play Protect scan: Play Store → your profile icon → Play Protect → Scan. If it flags an app, tap the notification and uninstall.
- Open Linked devices (steps above) and log out every session you do not recognise.
- Turn on or strengthen two-step verification and create a passkey, so a stolen code alone is no longer enough.
- Warn your contacts if your account sent strange messages — hijacked accounts are used to run the same code trick on friends and family.
- Report: flag the app in the Play Store, report scam numbers to the PTA (0800-55055), and file cybercrime complaints with the NCCIA at complaint.nccia.gov.pk or 1799. A factory reset is a last resort only, for a phone so compromised that uninstalling does not clean it — and if you suspect a partner installed stalkerware, remember the safety note above: get help from a safe device first.
WhatsApp’s design makes its privacy promise in its own words, so it is worth reading them directly: the WhatsApp Privacy page explains that your personal messages, photos and calls stay between you and the people you choose, that not even WhatsApp can see them, and that only you and the recipient hold the key that unlocks them — which is exactly why no website selling “spying by phone number” can ever deliver what it promises.
Also read: WhatsApp Passkey Setup Guide and WhatsApp Chat Lock Guide: Hide Your Private Chats
FAQs
Can any app or website really read someone’s WhatsApp if I just enter their number?
No. The keys that unlock a chat exist only on the two phones taking part in it. WhatsApp itself cannot read the messages, and a website that is not one of those two phones has nothing to unlock them with. A phone number alone gives no access to anyone’s chats, photos or location.
A site took my payment and keeps showing surveys and “verification” steps — will the chats ever appear?
No. Investigations of these services show the business is subscription and payment extraction, not spying: trials that quietly charge your card, features locked behind “unlocking” that changes nothing, and users who paid and received nothing. Cancel the subscription with your bank or card provider, uninstall the app, and report it — the results were never going to arrive.
I installed a “WhatsApp spy” or mod APK — who is actually being spied on?
Most likely, you. Kaspersky found a spy module hidden in WhatsApp mods that sent the installer’s IMEI, phone number, contacts and files to attackers and could record the microphone. Uninstall the mod, install the official app, run a Play Protect scan, check your Linked devices list, and turn on two-step verification.
As a parent, what can I legitimately do to keep my child safe on WhatsApp?
Use WhatsApp’s own parental controls: parent-managed accounts for pre-teens (from March 2026) and parental controls for teens aged 13–17 (announced September 2026) let you manage contacts, groups and privacy settings and get notified about group changes. They are rolling out gradually, may not have reached Pakistan yet, and — by design — they never let you read your child’s messages. A strong screen lock, two-step verification and agreed rules cover the rest.
Pingback: WhatsApp Web and Linked Devices Security Checklist