Overview
- A classified Zollkriminalamt directive published in early September 2026 confirms the ZKA turned account‑cloning into a routine tool on 1 August 2025 after tests begun in late 2023.
- Investigators set up mirrored web or desktop sessions for WhatsApp, Signal and Telegram by adding an authorized device to a target account and obtaining confirmation codes via intercepted SMS, QR scans or direct access to phones.
- Provider tools often copy past chat history, contact lists and account data to the new session and can allow messages to be sent from the target account, so the method captures old as well as new communication.
- The Bundesgerichtshof ruled on 20 January 2026 that secret up‑shutting to a messenger account is a Quellen‑TKÜ requiring tighter technical limits, and legal experts say courts may exclude evidence gathered with ordinary provider clients; ZKA documents show the agency relied on an older 2020 judicial view as late as 20 February 2026.
- Authorities (ZKA, BKA) have refused to disclose how often they used the technique, leaving open questions for parliament, and the method’s similarity to phishing raises new risks for everyday users who should check and remove unknown linked devices.