Garmin Messenger app users face security risks related to privacy due to the app's excessive reliance on the SMS verification system as the sole means of accessing the account, which could lead to the leakage of sensitive conversations to previous users.
The problem began to emerge after a report published by a user on the Reddit platform, where they discovered that upon installing the app on a new phone and entering their current phone number, they were able to recover the entire previous chat history simply by entering the verification code sent via SMS, without the need to enter the traditional Garmin account password. This behavior opens a serious security vulnerability related to the "number recycling" mechanism used by telecommunications companies.
Why is this a real danger?
Telecommunications companies routinely rely on reassigning abandoned phone numbers to new subscribers. Given the current working mechanism of the Garmin Messenger app, anyone who obtains a phone number that was previously owned by someone else may be able to recover the previous owner's conversations simply by verifying the number via SMS.
The danger of this flaw is doubled due to the nature of the app's use; adventurers and athletes rely on it to share geolocation data, travel plans, and movement details in remote areas. Unauthorized access to this data is not only a privacy violation but could also pose a direct threat to the physical safety of users by tracking their locations or knowing their future destinations.
Garmin's response and the current situation
According to reports, Garmin support service stated that this behavior "works as designed," but the company agreed to review the findings sent to it. Additionally, the famous sports technology reviewer Ray Maker (known as DC Rainmaker) contacted the company, and confirmed that Garmin has referred the matter to the relevant team, although no imminent fix has been confirmed or an official admission of a security vulnerability has been made so far.
What should you do to protect your data?
The report explained that simply uninstalling the app from the phone does not sever the link between your phone number and the account. To avoid the risks of data leakage when changing or abandoning your phone number, the following steps must be followed within the app:
- Open the Garmin Messenger app.
- Go to Settings (Accounts).
- Select Manage Garmin Messenger Account (Manage Garmin Messenger Account).
- Execute the Delete Garmin Messenger Account command (Delete Garmin Messenger Account).
Garmin confirms that this step will remove the link between the number and the account without canceling your inReach subscription.