FBI Warns of Signal Phishing — Z-TEXT Has No Code to Steal
The FBI Just Warned Signal Users About Phishing. Z-TEXT Users Can't Be Phished the Same Way.
The FBI and CISA issued a joint warning this year: Russian state-linked hackers are running mass phishing campaigns against Signal and WhatsApp accounts. Their target — journalists, government officials, military personnel, political figures. Their method — pretending to be "Signal Support" and asking for a verification code.
Quick verdict: This attack works because Signal identity is built on a phone number and an SMS-delivered code. Z-TEXT has neither. No phone number means no code exists to phish in the first place.
What Actually Happened
According to CISA and FBI reporting, attackers linked to Russian intelligence services impersonated Signal Support to trick high-value targets into either handing over their verification PIN, or clicking a link and scanning a QR code that silently links the attacker's own device to the victim's account. Once inside, the attacker can read messages, see contact lists, and send messages while impersonating the victim.
Signal itself confirmed the scam pattern, stating clearly that Signal Support will never contact users through the app, SMS, or social media asking for a verification code. If someone asks for that code, it's an attack — full stop.
Why This Attack Exists At All
Signal's entire identity system runs through one single point of failure: your phone number, verified by a one-time SMS code. That code is powerful — whoever has it can often recover or relink your account. It's also exactly the kind of thing a convincing enough impersonation can talk a tired, distracted person into handing over.
Z-TEXT was built without that single point of failure. There's no phone number attached to a Z-TEXT identity, so there's no SMS verification code an attacker could ever ask for. Identity comes from a 24-word seed phrase, generated once, on your device, never transmitted anywhere — nothing a fake support account could request over chat.
| Attack Vector | Signal | Z-TEXT zk-SNARKs |
| Phone number required | Yes | No |
| SMS verification code | Yes — phishable | Does not exist |
| Identity recovery method | Phone number + code | 24-word seed phrase, offline |
| Message encryption | Signal Protocol (E2EE) | zk-SNARKs zero-knowledge proofs + AES-256-GCM |
This Isn't a Signal Flaw — It's the Nature of Phone-Based Identity
To be fair to Signal: their encryption protocol itself hasn't been broken here. The FBI was explicit that this attack does not exploit any cryptographic weakness. It's pure social engineering — attackers didn't crack Signal's math, they tricked a human into handing over a key that phone-based systems require to exist.
That's exactly why organizations like the Electronic Frontier Foundation have long pushed for identity systems that don't depend on centralized, phishable checkpoints like SMS. Every system built around "prove who you are via a code sent to your phone" carries this same risk, no matter how strong the underlying encryption is.
Common Questions
❓ Does this mean Signal is unsafe?
Signal's core encryption remains sound. This attack targets the account recovery process, not the messages themselves. But for high-risk users — journalists, activists, officials — that distinction won't feel like much comfort if their account gets hijacked.
❓ Can the same phishing trick work on Z-TEXT?
No. There's no verification code, no SMS, no phone-based recovery flow for an attacker to impersonate. Your 24-word seed phrase is the only credential — and it's never requested by any "support" account, because Z-TEXT support never asks for it.
❓ What if I lose my seed phrase?
Write it down, offline, somewhere safe. It's the price of not depending on a phone number — full ownership means full responsibility. There's no company database to reset a forgotten password from.
Final Verdict
The FBI's warning isn't really about Signal being weak — it's a reminder that phone-number-based identity is inherently phishable, no matter how good the encryption behind it is. Z-TEXT sidesteps the entire category of attack by never having a phone number to begin with. No phone. No email. No SIM. Zero metadata.
🔗 Also read: Signal vs Z-TEXT · WhatsApp vs Z-TEXT · Session vs Z-TEXT · Telegram vs Z-TEXT · Z-TEXT 3-in-1 · The Third Man
🐘 Try zketernity: seal a message permanently on the blockchain, starting at $1. ko-fi.com/zketernity
