Why Popular Messaging Apps Offer Less Anonymity Than You Think

A city map diagram showing how four boundary points define a highlighted quadrilateral area containing a target person icon and a nearby inferred location pin enclosed within a dashed red circle. — Working with researchers at the Korea Advanced Institute of Science and Technology, Yonghwi Kwon demonstrated how an adversary can run automated queries across systematic GPS coordinates on geosocial apps to establish boundary points and narrow down a target's physical location within an average margin of 324 meters. Graphic courtesy of Yonghwi Kwon

Hiding behind an anonymous handle or a blank profile picture on a messaging app might feel safe, but new University of Maryland research shows that what someone posts on one chat service can easily blow their cover on another.

By chaining together routine features across popular platforms like Telegram, WhatsApp, Tinder and KakaoTalk (South Korea’s dominant messaging app, used by 94% of the population) researchers from UMD and Korea Advanced Institute of Science and Technology (KAIST) demonstrated how an adversary can connect isolated pieces of metadata to uncover real identities and pinpoint physical locations without ever breaking encryption or reading a private message.

The study’s findings carried immediate real-world impact. Following disclosure by the research team, affected platforms updated their services to tighten rate limits and block the specific automated methods detailed in the paper.

Before those changes were implemented, executing such an attack required remarkably little effort,consider this scenario: a college student posts on Telegram under an anonymous handle with a blank profile picture, confident their identity is hidden. Like millions of others, they also use a main messaging app for family chats and Tinder to meet people locally. They assume these accounts operate in total isolation. But because all three rely on the same phone number, an attacker scraping basic app features can grab that number from Telegram, look up the student’s legal name on the mainstream app, and run their profile picture through a location search on Tinder to uncover who they are and where they spend their afternoons.

This cross-platform threat is detailed in “Connecting the Dots: An Investigative Study on Linking Private User Data Across Messaging Apps,” presented at the 2026 Network and Distributed System Security (NDSS) Symposium. The study was co-authored by Yonghwi Kwon, assistant professor of electrical and computer engineering with an appointment in the University of Maryland Institute for Advanced Computer Studies (UMIACS) alongside KAIST researchers Soyoung Lee, a fifth-year doctoral student in information security; Sooel Son, associate professor of computing; and Junkyu Kang, a first-year doctoral student.

Evaluating KakaoTalk, Telegram, WhatsApp, Signal and Tinder, came from Kwon’s team’s goal to examine how multi-app habits create broader systemic risks. The team realized that as people juggle multiple services on one phone, security protections built into one platform can be undermined by permissive defaults on another.

“While privacy risks are often well mitigated within a single platform, as more people use multiple messaging apps, these platforms’ slices of privacy can be exploited to build a complete privacy profile of a target,” said Kwon, a member of the Maryland Cybersecurity Center.

In South Korea, where 56% of Telegram users rely on pseudonyms while 74%of KakaoTalk users display their legal names, an attacker running automated address book queries can instantly bridge those two worlds. Although the study’s empirical tests relied heavily on KakaoTalk’s dominance and South Korea’s compact 8-digit mobile numbering system, Kwon noted that the underlying mechanics carry broad implications.

“Having a single dominant service provider in a region significantly amplifies this problem,” Kwon said, noting that while market fragmentation in the U.S. offers a natural buffer against mass database scraping, cross-app data linking remains a threat anywhere users reuse shared identifiers like phone numbers or photos across multiple accounts.

Unlike high-profile data breaches or broken cryptographic protocols, this threat relies on piecing together features that individually seem non-security-sensitive; hence, platforms often overlook them. While breaking end-to-end encryption is a well-monitored primary attack vector, the team demonstrated that harvesting unmonitored metadata can be just as dangerous.

“In contrast, our attack is about gathering seemingly unimportant pieces of information to build a security-critical profile,” Kwon said. “We find that these somewhat neglected, trivial pieces of information — which are left unsecured or under-protected by individual platforms — can ultimately lead to much more critical consequences.”

To demonstrate those consequences, the researchers executed a location inference attack that located users within an average margin of 324 meters — roughly one-fifth of a mile. That result was not a universal GPS tracking capability, but rather a targeted exploit with specific prerequisites: the attacker extracts a victim’s profile photo, confirms they have an active profile on a geosocial app like Tinder, and runs automated queries across systematic GPS coordinates over roughly 18 minutes to narrow down their location bounding box.

While real-time tracking is an obvious physical threat, Kwon noted that cross-platform data gathering poses an immediate danger for social engineering. Phishing lures become significantly more convincing when an attacker can weave in real names, current locations, and recent profile updates harvested across connected accounts.

Kwon noted that while those initial platform patches prevent the exact attack chains detailed in the paper from working on the same scale today, balancing security with usability remains an ongoing challenge. Stripping away photos or names from contact lists makes apps harder to use, and can lead to errors like accidentally adding the wrong person.

Practical protection requires action from both individual users and platform creators. Everyday users can safeguard their privacy by auditing their accounts, deleting unused profiles, avoiding identical photos on anonymous and real-name apps, and registering sensitive accounts with secondary phone numbers. At the same time, long-term security depends on developers enforcing strict query limits on contact lookups, monitoring for suspicious automated contact additions, keeping personal identifiers hidden from public searches by default, and introducing location fuzzing to protect user privacy.

—Story by Melissa Brachfeld, UMIACS communications group

Published November 13, 2026