Security
WhatsApp Silent Tracking Explained: What Two Ticks Reveal
Research shows delivery receipts can reveal when your phone is active using only your number. What it can and can't expose, and what you can do about it.
Researchers have shown that someone who knows your phone number can learn surprising things about your phone's activity on WhatsApp or Signal, without you seeing anything. They can't read your messages. But the timing of the delivery receipts behind those two ticks can suggest when your phone is in use, and over time, what your routine looks like.
Key Takeaways
- The research is called Careless Whisper, from the University of Vienna and SBA Research.
- It works from timing, so your message content stays encrypted.
- The other person doesn't have to be in your contacts, and you may see nothing on screen.
- Turning off read receipts doesn't stop it, and we found no reported full fix.
What did the researchers find?
The Careless Whisper paper looks at delivery receipts, the signal your phone sends back when a message reaches it. That's what gives the sender the second tick.
The researchers found that this reply can be triggered silently, for example with message types like reactions that don't normally produce a notification. By measuring how long replies take, an observer can make informed guesses about the phone at the other end.
We're explaining the risk here, not the method, so this article doesn't include any steps or tools.
What can it reveal?
According to the paper and Seytonic's summary of the research, repeated timing measurements can suggest:
- Whether the screen is on or off, and sometimes whether the app is open
- Whether the phone is online or offline, which over time can hint at sleep or travel patterns
- How many devices are linked to the account, and which of them are online
- The phone's operating system, and possibly its type
- Whether it's on WiFi or mobile data
If your work laptop and home computer are both linked, seeing which one is online could hint at where you are. That's an estimate from patterns. It's not GPS tracking.
What can't it reveal?
It doesn't expose your messages. Your chats, photos and calls aren't opened by this technique. It doesn't install malware on your phone or give anyone control of it.
Any location information is only a guess based on patterns, and the person watching would need to know your number and keep measuring over time.
Who should be concerned?
Most people aren't likely targets of something this specific. It matters more to people with a reason to worry about being watched, such as anyone dealing with a stalker or abusive ex-partner, journalists, activists and people in sensitive jobs.
It also matters because of how little it needs: a phone number, which many of us share widely on business cards, shop listings and social media.
Has WhatsApp fixed it?
We couldn't confirm a fix. Reports from December 2025 said neither WhatsApp nor Signal had fixed the underlying issue, and we found no official statement or newer report of a complete fix as of November 2026. Signal is reported to limit how quickly these signals can be sent, which makes close monitoring harder.
Apps change often, so this may have changed since those reports.
What can you do?
There's no complete fix on your side, because you can't turn delivery receipts off. These steps reduce your exposure:
- Try "Block unknown account messages". In WhatsApp, third-party guides list it under Settings > Privacy > Advanced. It blocks unusually high volumes of messages from unknown accounts. We can't confirm how much it helps against this specific research, so treat it as a partial step.
- Remove linked devices you don't use. Check Linked Devices in WhatsApp, because each one can reveal more.
- Be careful where you publish your number. Consider a separate business number for public listings.
- Keep your apps updated, so you get any protections as soon as they arrive.
- Get help if you feel you're being watched. If you're worried about stalking or harassment, contact the police or a trusted support service. In India, you can report cybercrime through cybercrime.gov.in.
Turning off read receipts won't stop this, because read receipts and delivery receipts are different.
What this means if you build an app
The lesson goes beyond WhatsApp. A feature can be fully encrypted and still leak information through its behaviour, like how quickly it responds. If your app has messaging, notifications or online status, ask your developer these questions:
- Who can trigger a response from a user's device?
- Do strangers get the same responses as known contacts?
- Are there limits on how many requests one account can send?
Our guide to secure APIs for mobile apps covers more of this. Want your app or website checked? Talk to Leyora on WhatsApp.