What Brazilian law allows and what constitutes a crime.
Accessing another person's conversations without their consent is a crime in Brazil: article 154-A of the Penal Code, punishable by 1 to 4 years in prison, in addition to violating the confidentiality of communications as per article 5, XII of the Constitution. Being a boyfriend, spouse, or parent of an adult makes no exception. And the most repeated promise in the sector is false: there is no application that can read messages from another cell phone remotely, just with the number. Those who advertise this charge a subscription without delivering, or install malware on the device of the person who inquired. Legitimate monitoring requires installation with the device in hand and covers two cases: a minor child who is aware of the monitoring, and a corporate cell phone with a signed usage policy.
It's worth dissecting each of these points, because the difference between what is allowed and what leads to jail time is usually smaller than people imagine — and the line isn't about intent, it's about who owns the device and who knows what they're talking about.
Why does nobody read other people's WhatsApp messages from a distance?
WhatsApp messages are end-to-end encrypted: they are scrambled on the sender's device and only become readable again on the recipient's device. Not even WhatsApp itself can read the content along the way.
This completely undermines the entire category of services that promise to deliver other people's conversations using their phone number. If the content is only readable within those two devices, the only way to access it is to be on one of them—which means physical access and installation, in other words, exactly the crime described above.
Those who pay for these promises usually end up in one of three situations: recurring subscription with no delivery, an app that installs malware on the buyer's device, or a verification code scam, in which the person hands over the six-digit code and loses their account.
The two cases in which monitoring is legitimate.
Filho menor de idade, com transparência
Parents and guardians have a duty to protect their children, and the law supports this. What makes monitoring legitimate is transparency: the child knows, the notification is visible on the device, and the goal is to protect, not to catch them in the act.
O Google Family Link This is the clearest example of this category. It's free, made by Google itself, and shows on the monitored phone that it's under supervision. It allows you to set screen time limits, approve app installations, filter content by age range, and see the user's location. What it deliberately does is... no What it does is deliver the content of the conversations — and this absence is a design choice, not a limitation.
It's important to remember that as the child grows, supervision needs to be relaxed. A teenager watched without conversation learns to use a second device, not to take better care of themselves.
Celular corporativo com política assinada
The company can monitor the device it provides, as long as the employee is aware of it, has signed the usage policy, and the monitoring is restricted to the work environment. This is done with a corporate device management solution, not with a spy app.
Monitoring without notice, or snooping through personal applications installed on a corporate device, is beyond legal protection and frequently results in labor lawsuits.
What you can do on your own device
- Recover deleted messages in your conversation, You can find it through the Android notification history (Settings > Notifications > Notification history) or through an official app store that does the same.
- Export a conversation In More > Export conversation, to save a record of the arrangement that you imported.
- Restore backup from Google Drive when the entire history is lost.
- Check the connected devices to your account and close anything you don't recognize.
How to know if something was installed on YOUR cell phone
- Browse Settings > Applications The entire system, including items with generic names such as "Service" or "System".
- Open Settings > AccessibilityThe strongest signal is that an active service you don't recognize is this permission, which allows the screen to be read.
- Check apps with device administrator permission, which resist common dismantling.
- Notice that Battery and data running out quickly. no change in use.
- On WhatsApp, review Connected devices and activate the two-step verification.
- Rotate Play Protect. If suspicion persists, back up your photos and restore your device to factory settings.
If you are afraid of who installed the device, consider that restoring the device may send a warning signal to that person. In such cases, seek guidance beforehand: the Women's Helpline at [phone number]. 180 It's free, confidential, and operates 24 hours a day.
Modified apps that promise extra features.
Alongside spyware programs, there's a next-door neighbor that deceives even more people: modified versions of the messenger, distributed as separate installation files and advertised with features that the official application doesn't have — hiding the read receipt, reading deleted messages from any conversation, changing the theme, viewing statuses without appearing.
The installer pays for it in four ways:
- Account banned. Using an unofficial client violates the terms of service, and suspension can be permanent. This is the most common outcome, and it comes without warning.
- End of confidentiality guarantee. End-to-end encryption protects the path between two devices. If the program installed on your device has been altered by third parties, it can read everything before scrambling—and you have no way to audit that.
- Embedded malware. Since the installation requires allowing unknown sources, the same gateway can be used for whatever comes along with it: adware, bank credential theft, background mining.
There is also a cruel detail: those who use this type of version and then have their account stolen find it much more difficult to recover it, because some of the official verification mechanisms do not work in the modified client.
The scam that steals your account while you're looking for a spy.
Many account theft victims ended up there looking for exactly what this text advises against. The scenario is always similar:
- The six-digit code. Someone writes pretending to be an acquaintance, a technical support representative, or a salesperson for a monitoring service and asks for the number that just arrived via message. That code is the key to your account. It should never be given to anyone, under any circumstances.
- False support. No platform calls, messages privately, or asks for data confirmation in this way. Any contact that presents itself as official customer service in a casual conversation is a scam by definition.
- Chip replacement. Using leaked documents, the criminal requests number portability or a replacement SIM card from the mobile operator. When your phone suddenly loses signal and doesn't return, this is a possibility to consider quickly.
- The connection with diversion. There is a scam that tricks the victim into entering a code that diverts calls, allowing the victim to receive the voice verification call instead of the victim.
After taking over the account, the criminal asks your contacts for money using your photo and writing style. The loss is rarely yours—it's suffered by those who trust you, which usually hurts more.
What to do if your account is stolen.
Recovery depends on acting within the first few hours, and order helps:
- Install the official app and register your number again. Upon completion of the verification, the intruder is automatically disconnected: only one device can keep the account active.
- If you are prompted for a PIN that you did not create,, It was the intruder who activated two-step verification. In this case, there is a waiting period of a few days before you can log in without a PIN. It's inconvenient, and it's precisely this wait that protects accounts in normal situations.
- Notify your contacts through another channel. Social media, phone calls, work groups. The sooner they know, the fewer people will fall for the money scam.
- Inform the operator. If the phone has lost signal, use this to block unauthorized number portability.
- File a police report. It is required by banks and helps those who transferred money to try to recover the amount.
- Review your primary email and bank accounts. Whoever took over your messaging account probably tried to use it to reset your password on other services.
What the Justice system can ask for, and what even it can't.
It's important to understand this limit, because it definitively puts an end to the fantasy sold by espionage services. With a court order, a messaging platform can be compelled to hand over what it possesses: registration data, account creation date, connection logs, access addresses, and information about linked devices.
What she doesn't provide is the content of the conversations—and not out of ill will. With end-to-end encryption, the text is never readable on the server. There is no copy stored to be requested. There have already been court orders in Brazil demanding this content, and the technical response has always been the same, with the service being blocked in the country due to the impasse.
Practical consequence: if even the courts can't obtain the conversation from the platform, nobody can get it for thirty reais on a website with a payment button. The only way to access the conversation is through one of the participants' devices—and accessing it without authorization is the device intrusion described at the beginning of this text. When a conversation truly needs to become evidence, the way to do it is through a notarized statement or an expert analysis of a legally seized device, not a screenshot obtained secretly.
Five minutes to protect your account.
This is the part that depends solely on you and resolves the vast majority of cases:
- Enable two-step verification and register a recovery email. Without email, forgetting your PIN becomes a long wait; with it, recovery is quick.
- Enter the PIN on the chip. It prevents your number from being used on another device if your cell phone is stolen.
- Enable biometric lock within the app., ...so that opening conversations requires a fingerprint or face even when the phone is unlocked and in someone's hand.
- Adjust your profile picture privacy settings. For your contacts. A public photo is the raw material for the scam that impersonates you.
- Be wary of anything urgent. Every scam is rushed. Even requests for money from known numbers are usually confirmed with a voice call beforehand.
Frequently asked questions about WhatsApp security.
Does the green dot and the connected device warning mean there's been an intrusion?
Not always. A browser session opened on a home or work computer will appear exactly like this. What matters is recognizing each item on the list: if you don't recognize it, close it, and then change the two-step PIN.
Can a message deleted by the other party be recovered?
In your own conversation, sometimes: the system's notification history saves the text that arrived before it was deleted, and there are official store apps that do the same. This applies to messages sent to you — it's not a way to read other people's conversations.
Is there a way to know if someone has read my messages on my device?
There is no record within the app. What helps is biometric locking and checking the list of connected devices. If someone had physical access to your unlocked phone, consider changing the passwords for any services that were open.
I received a threat and I want to report it. What should I keep?
Do not delete anything; take screenshots showing the number, date, and time, export the conversation using the app's own function, and take the material to the police report. Blocking and reporting within the app will take down the profile, but it does not replace an official report.
Conclusão
Monitoring another adult's messages is not a gray area: it's a crime punishable by 1 to 4 years in prison, and evidence obtained this way is usually discarded, leaving the person who installed the system responsible. On the other hand, what is legitimate—transparent parental control and a signed corporate policy—works well and doesn't depend on hiding anything from anyone.
If the search began due to distrust in a relationship, it's worth knowing that there's no technical solution: no app can restore trust. Conversation, couples therapy, and, when necessary, legal advice can resolve what surveillance only postpones.
