> ## Content Index > Fetch the complete content index at: https://z-text.org/llms.txt > Use this file to discover other available public pages before exploring further. # Postcard From 2035 #6: They Just Asked for the Code - URL: https://z-text.org/postcard-from-2035-sms-code-hijack/ - Published: 2026-11-04T08:25:45.000Z - Updated: 2026-11-04T08:25:45.000Z - Description: A postcard from 2035: they didn't break your encryption, they just asked for your code. Without 2FA, a 6-digit SMS code can hijack Telegram, WhatsApp or Signal. Z-TEXT has no phone number, so there's no code to steal. - Author: Eric Pierrot - Founder, Z-TEXT LLC — building privacy tools without phone numbers, email, or metadata. - Tags: Postcard from 2035, Privacy, zk-SNARKs, Account Security ![Z-TEXT privacy bird](https://storage.ghost.io/c/fd/15/fd15bb3d-d8d8-469e-8b80-b94dae7aa4cd/content/images/2026/05/my-bird.png) They didn't break your encryption. They just asked for your code. Postcard #6 just arrived from 2035\. A joke on the front, a real fact on the back. This one is about the six digits that guard most messenger accounts. Z-TEXT is a privacy messenger built on the BitcoinZ blockchain. No phone number, no email, no SIM. So Z-TEXT never sends a login code by text message. And a code that's never sent can't be stolen. In short Telegram, WhatsApp and Signal log you in on a new phone with a 5- or 6-digit verification code sent by SMS or call. Without an extra password, that one code is enough to hijack the account. In 2025, the FBI logged 971 SIM swap complaints and $17.4 million in losses. Two-step verification stops most of these attacks, but it's optional and off by default. Z-TEXT has no phone number and no SMS code: a Z-TEXT identity is a 24-word seed created on your own device. ## ❓ 1\. What does postcard #6 say? "Dear 2026, they didn't break your encryption. They just asked for your code. Six digits. One text. Your whole account." The punchline on the card: **"Ours never sent one."** Signed, a survivor from 2035. Postcard #2 was about your phone number. Postcard #6 is about what that number receives: the code. The year 2035 is invented. The fact on the back is real. Mini-resume Postcard From 2035 #6 shows a messenger account lost to a six-digit verification code, and a Z-TEXT user from 2035 whose messenger never sent one. Z-TEXT has no phone number, so Z-TEXT has no SMS login code to intercept. ## ❓ 2\. How does a verification code hijack work? A verification code is a short number, usually 5 or 6 digits, that a messenger sends to prove you own a phone number. Telegram, WhatsApp and Signal send it by SMS, by automated phone call, or inside the app. (Source: [Net Trends, 1 Nov 2026](https://www.netz-trends.de/uk/messenger-account-takeover-verification-code-protection/?ref=z-text.org)) The attacker types *your* number on *their* phone. The app sends *you* the code. Then the attacker grabs it. Net Trends lists four routes: **Deception.** A "friend" or fake "support" asks you to forward the code, or type it into a fake vote page. **Voicemail.** The code is read out by an automated call at night. It lands on voicemail, and voicemail with a default PIN is easy to open. **The phone network.** Flaws in SS7, the system carriers use to talk to each other, can reroute SMS. So can a fraudulent replacement SIM card, which is a SIM swap. **Ghost pairing.** On WhatsApp, a pairing code can add the attacker as a "linked device." WhatsApp keeps working on your phone, so you don't notice. Once inside, the attacker reads your chats and messages your contacts as you, often asking them for money. Mini-resume A verification code hijack happens when an attacker requests a login code for the victim's phone number and then captures it. Common routes are deception, voicemail with a weak PIN, SS7 network flaws or a SIM swap, and WhatsApp "ghost pairing." The attacker can then read chats and impersonate the victim. ## ❓ 3\. How big is the problem? A SIM swap is when a criminal convinces a mobile carrier to move your phone number to a SIM card they control. From then on, your texts and codes go to them. (Source: [Wikipedia](https://en.wikipedia.org/wiki/SIM%5Fswap%5Fattack?ref=z-text.org)) 971 SIM swap complaints to the FBI in 2025 $17.4M reported US losses in 2025 +38% rise in UK unauthorised SIM swaps in 2025 (Cifas) (Source: [DeepStrike, citing the FBI IC3 2025 report and Cifas](https://deepstrike.io/blog/sim-swap-scam-statistics-2025?ref=z-text.org)) And these are only the people who reported it. Most code hijacks never reach the FBI at all. Mini-resume A SIM swap moves a victim's phone number to a criminal's SIM card. The FBI's Internet Crime Complaint Center recorded 971 SIM swap complaints and $17.4 million in US losses in 2025\. In the UK, fraud body Cifas reported a further 38% rise in unauthorised SIM swaps in 2025. ## ❓ 4\. Doesn't two-step verification fix this? Mostly, yes. If you use these apps, turn it on today. Two-step verification means a second secret, a PIN or password you choose, on top of the code. With it, a stolen code alone is useless. **WhatsApp:** two-step verification is an optional feature. Its PIN is separate from the 6-digit registration code you get by SMS or call. (Source: [WhatsApp Help](https://whatsapp.com/faq/general/26000021?l=en&ref=z-text.org)) **Signal:** a Signal PIN can act as a Registration Lock. Forget the PIN with the lock on, and you can be locked out for up to 7 days. (Source: [Signal Support](https://support.signal.org/hc/en-us/articles/360007059792?ref=z-text.org)) **Telegram:** two-step verification adds a password you choose, under Settings, Privacy and Security. (Source: [Net Trends](https://www.netz-trends.de/uk/messenger-account-takeover-verification-code-protection/?ref=z-text.org)) But here's the catch. All three are optional. The default front door is still a six-digit text message. In our view, that's the wrong default for an app that calls itself private. Mini-resume Two-step verification adds a PIN or password on top of the SMS code, and it blocks most code hijacks. WhatsApp calls it two-step verification, Signal calls it Registration Lock, and Telegram calls it two-step verification. All three are optional, so accounts without them still rely on the SMS code alone. ## ❓ 5\. What about Signal's new sign-up without a phone number? Fair question, and real news. In September 2026, Signal opened phone-number-free registration in its Android 8.28 beta. It costs a one-time $2.99\. You get an Account ID and an Account Key instead of a number. (Source: [Privacy Guides](https://www.privacyguides.org/news/2026/09/16/signal-enables-phone-number-less-registration-in-beta/?ref=z-text.org)) That's a genuine step forward, and we're glad to see it. But it's beta and Android-only for now. Payment goes through Google Play Services. Existing accounts can't remove their number. And the standard sign-up still uses a phone number. Z-TEXT started there. A Z-TEXT account never had a phone number to begin with. Mini-resume In September 2026, Signal launched optional phone-number-free registration in its Android 8.28 beta, for a one-time $2.99, using an Account ID and Account Key. Existing Signal accounts cannot remove their number, and standard Signal registration still uses a phone number. Z-TEXT has never used phone numbers. ## ❓ 6\. Why can't a code hijack happen on Z-TEXT? Because there's no code. A Z-TEXT identity is a 24-word seed. A seed is a list of ordinary words that stands in for a private key. Z-TEXT creates the 24 words on your device the first time you open the app. No phone number, no email, no SMS, no carrier in the loop. (Source: [Z-TEXT docs](https://z-text.com/docs/backup-recovery?ref=z-text.org)) So there's nothing for a carrier to reroute. There's no voicemail to raid, and no SIM to swap. A SIM swap can take your number, and your Z-TEXT account never had one. Z-TEXT messages travel as shielded transactions on the BitcoinZ blockchain, running since September 2017\. Shielded means zk-SNARKs zero-knowledge proofs hide the sender, the receiver and the amount. The message itself is encrypted with AES-256-GCM. (Source: [BitcoinZ](https://getbtcz.com/?ref=z-text.org)) One bonus. The Z-TEXT password manager also holds your 2FA codes for other sites. Scan a site's QR code, and Z-TEXT shows the 6-digit code. Your other accounts' codes stop travelling by SMS too. Mini-resume Z-TEXT has no phone number and sends no SMS login code, so SIM swaps, voicemail tricks and SS7 rerouting have no Z-TEXT code to capture. A Z-TEXT identity is a 24-word seed created on the user's device. Z-TEXT messages are shielded transactions on the BitcoinZ blockchain, protected by zk-SNARKs zero-knowledge proofs and AES-256-GCM. The Z-TEXT password manager can also generate 6-digit 2FA codes for other sites. ## ❓ 7\. What are the honest limits? **Your 24 words are the new target.** Z-TEXT removes the code, not the scammer. Anyone who tricks you out of your seed can read your messages and spend your funds. No one from Z-TEXT will ever ask for it. **Lose the 24 words, lose the account.** There's no reset link. Not even we can recover it. **No independent audit yet.** The Z-TEXT app hasn't been independently audited. A public bug bounty is open. Yes, we're listing our weak spots in a post that sells our app. That's the deal: math you can check, not promises you have to trust. Mini-resume Z-TEXT removes the SMS code, but the 24-word seed becomes the key to protect: anyone holding it can read the user's messages and spend the funds. A lost seed cannot be recovered by anyone, including Z-TEXT. The Z-TEXT app is not yet independently audited; a public bug bounty is open. 📮 The Postcard From 2035 series A joke on the front, a real fact on the back. Catch up on [postcard #5: It Came Back With 24 Words](https://z-text.org/postcard-from-2035-24-word-recovery/). Z-TEXT runs on Android, macOS, Windows and Linux at [z-text.com](https://z-text.com/?ref=z-text.org). iOS is coming to the App Store. BitcoinZ lives at [getbtcz.com](https://getbtcz.com/?ref=z-text.org). ### Sources 1\. [Net Trends, messenger account takeover (1 Nov 2026)](https://www.netz-trends.de/uk/messenger-account-takeover-verification-code-protection/?ref=z-text.org) 2\. [DeepStrike, SIM swap statistics (FBI IC3 2025, Cifas)](https://deepstrike.io/blog/sim-swap-scam-statistics-2025?ref=z-text.org) 3\. [Wikipedia, SIM swap attack](https://en.wikipedia.org/wiki/SIM%5Fswap%5Fattack?ref=z-text.org) 4\. [WhatsApp Help, About two-step verification](https://whatsapp.com/faq/general/26000021?l=en&ref=z-text.org) 5\. [Signal Support, Signal PIN and Registration Lock](https://support.signal.org/hc/en-us/articles/360007059792?ref=z-text.org) 6\. [Privacy Guides, Signal phone-number-free registration beta (16 Sept 2026)](https://www.privacyguides.org/news/2026/09/16/signal-enables-phone-number-less-registration-in-beta/?ref=z-text.org) 7\. [Z-TEXT docs, Backup & Recovery](https://z-text.com/docs/backup-recovery?ref=z-text.org) · [BitcoinZ](https://getbtcz.com/?ref=z-text.org) Keywords: SMS verification code hijack · SIM swap messenger · account takeover WhatsApp Telegram Signal · no phone number messaging app · private messaging app · secure messaging app · blockchain messenger · zero-knowledge proof messenger · Signal alternative · Telegram alternative 🔗 **Also read:** [Signal vs Z-TEXT](https://z-text.org/signal-vs-z-text-gold-standard-vs-next-generation/) · [WhatsApp vs Z-TEXT](https://z-text.org/whatsapp-vs-z-text-you-are-the-product-vs-you-are-the-user/) · [Session vs Z-TEXT](https://z-text.org/session-vs-z-text-two-no-phone-messengers-compared/) · [Telegram vs Z-TEXT](https://z-text.org/telegram-vs-z-text/) · [Z-TEXT 4-in-1](https://z-text.org/one-blockchain-messenger-four-apps-replaced/) · [The Third Man](https://z-text.org/the-third-man-had-tunnels-z-text-has-blockchain-2/) 🔗 Share this postcard [X](#) · [Telegram](#) · [WhatsApp](#) · [Facebook](#) · [LinkedIn](#) · [Copy link](#) [👉 No Phone. No Email. No SIM. Zero Metadata. Just Z-TEXT.](https://z-text.com/packages?ref=z-text.org) ![Z-TEXT privacy bird](https://storage.ghost.io/c/fd/15/fd15bb3d-d8d8-469e-8b80-b94dae7aa4cd/content/images/2026/05/my-bird.png)