German customs officials have been using a secret method to monitor messaging accounts, according to a leaked document. The technique, known as account cloning, in Germany, reportedly allows investigators to access some messenger user accounts without putting spyware on the target’s phone.
The German Customs Criminal Office (ZKA) began testing the method in 2023. The leaked directive says the agency decided to keep using it from August 2025.
Account cloning works by creating another access point to an existing messenger account. Investigators do not need to break the encryption protecting the messages. They may instead gain access through the account’s login or linked-device features.
In some cases, investigators can reportedly get physical access to a phone and connect the account to a service such as WhatsApp Web. Other services may use verification codes that can potentially be intercepted. Telegram has previously been linked to this type of access.
The information investigators can see depends on the app. Telegram cloud chats, for example, may be available after an account is accessed. Secret chats are different because they are tied to individual devices and use end-to-end encryption. The directive tells officials to limit knowledge of the technique to staff who need it for their work.
The legal position surrounding the method has become complicated. A 2020 ruling from Germany’s Federal Court of Justice treated account access as ordinary telecommunications surveillance. However, a ruling in January 2026 took a stricter view of covert access to a Telegram account.
The case involved police obtaining messages that existed before the surveillance order was issued. The court ruled that this historical information could not be used because investigators had not obtained the required online-search authorization. It also said technical measures should prevent access to older messages.
Despite this ruling, the customs directive relied on the earlier 2020 decision. Customs officials declined to explain how the method is used. A spokesperson said the information was classified.
The BKA also refused to provide operational details. It said its work follows the law and court decisions and is subject to oversight. Meanwhile, German security agencies have warned about account attacks against politicians, military officials, diplomats and journalists. They advised users to remove unfamiliar devices from their messenger accounts.
The government has also refused to reveal how often federal police, the BKA or customs used account cloning in 2025. Officials said releasing the figures could expose investigative capabilities and help criminals avoid detection.
