Cyber Knowledge Base Technology

Messaging Apps Compared 2025: SMS, iMessage, RCS, Signal, & More

June 03, 2025

In an era shaped by digital communication, the way we message—both personally and professionally—has grown more diverse, complex, and security-sensitive than ever before. From traditional SMS and MMS to encrypted platforms like iMessage, WhatsApp, and Signal, each technology presents unique capabilities, risks, and regional usage patterns. This guide breaks down key differences, compares security levels, and explores global adoption trends—while also addressing legal and compliance issues such as 🔖CALEA¹ and other noteworthy regulatory developments..

Interestingly, while US CALEA compliance mandates lawful access to communications under court order, companies like Apple have maintained a strong stance on end-to-end encryption—refusing to create backdoors or weaken device-level security, even when requested by U.S. or foreign law enforcement.

— Matthew D. Ferrante, CDO, CISO, Citanex

Polling Question

 Loading ...

💬SMS (Short Message Service)

🔒Citanex (CX) Security Score Rating: 10/100

Short Message Service (SMS) is a telecommunications protocol that enables the exchange of short text messages (up to 160 characters) between mobile devices over cellular networks. It does not require internet access, uses carrier infrastructure, and lacks encryption—making it universally compatible but not secure.

Type: Text-only

Limit: 160 characters per message

Delivery: Via cellular network (no internet required)

Encryption: None (messages are sent in plain text)

Compatibility: Universal; works on all mobile phones

Use Case: Basic text messages without attachments

⚠️ Why the Low Score?

• No Encryption: SMS messages are sent in plain text and can be intercepted during transmission.
• Susceptible to 🔖Spoofing²: Sender IDs can be easily faked.

• Stored in Plain Text: Messages may be stored unencrypted on carrier systems and devices.
• Vulnerable to 🔖SIM Swapping³: Attackers can hijack numbers and receive SMS messages, including 2FA codes.

Summary: SMS offers basic functionality but is highly insecure by modern standards. It should not be used for sensitive or confidential communication.

🔍 Are SMS Messages Recovered?

Yes. Citanex can recover SMS messages—including deleted texts—from most devices. Through Standard Digital Recovery, Mobile Forensics, Expert Legal Support Technologies, and Digital Emergency Care, we extract and analyze message content, timestamps, and metadata—even in complex, high-stakes, or tampered-data scenarios.

👨‍💼💡Expert Insights

Critical data is often overlooked, altered, or lost when handled by laypersons, IT staff, lawyers, or accountants. Estimates suggest that human error accounts for a significant portion of data loss incidents, with figures ranging from 20% to 95%. This underscores the importance of robust data management and recovery protocols.

Expert digital recovery and authentication should be entrusted to experienced digital forensic professionals to ensure accuracy, integrity, and/or legal admissibility—and to prevent costly legal or operational consequences. There are several notable cases that illustrate the risks of mishandling digital evidence, including but not limited to 🔖spoliation⁴, with more examples to follow in another article and Citanex case studies.

💬MMS (Multimedia Messaging Service)

🔒CX Security Score for MMS: 12/100

Multimedia Messaging Service (MMS) is a mobile messaging protocol that allows users to send multimedia content—such as images, audio, video, and longer text—over cellular networks. Like SMS, MMS uses carrier infrastructure and does not require internet access. It supports larger file sizes than SMS but shares similar limitations in security and privacy.

No End-to-End Encryption: Messages and attachments are sent unencrypted.

Media Vulnerabilities: Images and videos can be exploited to deliver malware or execute remote code.

Carrier Storage Risks: Files are often stored on carrier servers temporarily, increasing exposure.

Metadata Leakage: Includes information such as sender number, timestamp, and sometimes location data.

⚠️ Why the Low Score?

• No End-to-End Encryption: Messages and attachments are sent unencrypted.
• Media Vulnerabilities: Images and videos can be exploited to deliver malware or execute remote code.
• Carrier Storage Risks: Files are often stored on carrier servers temporarily, increasing exposure.
• Metadata Leakage: Includes information such as sender number, timestamp, and sometimes location data.

Summary: MMS is slightly more capable than SMS in terms of content but remains insecure. It should not be trusted for transmitting sensitive media or data.

🔍 Are MMS Messages Recoverable?

Yes. Citanex can recover MMS messages, including deleted images, videos, and attachments. Using Standard Digital Recovery, Mobile Forensics, Expert Legal Support Technologies, and Digital Emergency Care, we can extract media content and metadata—even if the message thread has been altered or erased.

💬iMessage

🔒CX Security Score for iMessage: 85/100

iMessage is Apple’s proprietary messaging service that allows users to send text, images, videos, documents, voice memos, and more over the internet. It is available exclusively on Apple devices (iPhone, iPad, Mac, Apple Watch) and automatically encrypts communications between Apple users using end-to-end encryption (E2EE).

Type: Text, images, video, documents, reactions, read receipts, and more

Delivery: Internet (Wi-Fi or cellular data)

Encryption: 🔖End-to-end (E2EE)⁵

Compatibility: Apple devices only (iPhone, iPad, Mac)

Use Case: Secure, feature-rich communication between Apple users

✅Why the High Score?

• End-to-End Encryption (E2EE): Only sender and recipient can read messages—Apple cannot decrypt them.
• Automatic Encryption: E2EE is enabled by default for all iMessage users.
• 🔖Device-Level Security⁶: Messages are encrypted in transit and at rest, backed by 🔖Apple’s Secure Enclave⁷.
• Fraud Protections: Includes features like link warnings, spam filtering, and 2FA integration.

⚠️ Limitations

• Apple Ecosystem Only: Messages fall back to SMS/MMS when sent to non-Apple devices—losing encryption.
• Metadata Storage: Apple likely retains 🔖metadata⁸ (e.g., timestamps, message routing info).

• Device Backups: If iCloud backups are enabled without E2EE, messages can be exposed if iCloud is compromised.

Summary: iMessage is one of the more secure mainstream messaging services—but its privacy guarantees are strongest only when used exclusively between Apple devices with secure configurations.

🔍 Are iMessages Recoverable?

Yes—with conditions. Through Apple-Specific Forensics and/or via Digital Emergency Care we extract message data—even in scenarios involving deleted content, encryption, or forensic preservation needs. Reference is made to sample Citanex iMessages, SMS, and MMS communication recoveries:

💬RCS (Rich Communication Services)

🔒CX Security Score for RCS: 60/100 (when using Google Messages with E2EE)

🔒CX Security Score for RCS: 30/100 (without end-to-end encryption)

Rich Communication Services (RCS) is a modern messaging protocol designed to replace SMS and MMS, offering features like high-resolution media sharing, typing indicators, read receipts, and Wi-Fi/data-based delivery. It is primarily used on Android devices and depends on carrier, device, and app support (e.g., Google Messages).

Type: Next-gen SMS with media support, typing indicators, read receipts

Delivery: Internet (via cellular data or Wi-Fi)

Encryption: Partial or E2EE (Google Messages offers E2EE for 1:1 chats)

Compatibility: Supported on many Android devices (fragmented rollout)

Use Case: Enhanced messaging experience on Android devices

✅ Strengths (with Google Messages + E2EE)

• End-to-End Encryption for 1:1 Chats: Available only in Google Messages when both users have it enabled.
• Internet-Based Delivery: Avoids SMS/MMS limitations and costs.
• Modern Messaging Features: Typing indicators, high-res media, better group chat support.

⚠️ Weaknesses and Risks

• Inconsistent Encryption: E2EE not universally supported (e.g., group chats, non-Google apps, carrier apps).
• Carrier Dependency: Some carriers still intercept and/or log message data.
• Fragmentation: Different behaviors and security levels depending on the device, carrier, and app.
• Metadata Exposure: Even with E2EE, metadata like timestamps and recipient info are typically still accessible.

Summary: RCS is a significant upgrade over SMS/MMS, but its security depends heavily on implementation. When used via Google Messages with E2EE enabled, it offers reasonable protection. Otherwise, it’s only marginally better than traditional texting.

🔍 Are RCS Messages Recoverable?

Yes. In most cases, Citanex can recover all or some RCS message data depending on the app (e.g., Google Messages), device type, and encryption status. Our Digital Recovery, Expert Digital Forensics, and/or via Digital Emergency Care teams work to extract locally stored or cached RCS content—even in cases involving data corruption or message deletion.

📊 Messaging Technology Comparison

💡 Key Insights

• iMessage offers the best combination of security, features, and user experience—but only within the Apple ecosystem.
• RCS modernizes texting for Android users but suffers from inconsistent adoption and encryption gaps.
• SMS and MMS are outdated and insecure but remain widely used for alerts, two-factor authentication, and universal compatibility.

💬Other Encrypted Messaging Apps (e.g., Signal, WhatsApp, Telegram)

Type: Full-featured communication platforms

Delivery: Internet

Encryption: Most offer E2EE (Signal by default, WhatsApp for all chats, Telegram only for Secret Chats)

Compatibility: Cross-platform (iOS, Android, desktop)

Use Case: Private and secure messaging, voice/video calling, file sharing

🏆💬 Signal

🔐CX Security Rating: 95/100

✅Why the High Score?

Highest Score Ratings

• End-to-end encryption (E2EE) by default for all communications (text, voice, video).
• Uses the Signal Protocol—widely regarded as the gold standard in secure messaging.
• No metadata logging (except for minimal data like last connection timestamp).
• Open-source and independently audited.
• Lacks cloud backups unless done manually, reducing external exposure risk.

Minor deductions

• Full recovery is limited (by design), which can hinder continuity if not backed up.
• Requires access to phone number (a privacy consideration, not a technical flaw).

🔍 Are Signal Messages Recoverable?

Yes—under certain conditions. Signal uses advanced encryption and secure deletion, but Citanex has been very successful in recovering Signal messages when technically and legally permissible. We also support authorized access and interception in compliance with court orders or lawful investigative protocols.

💬 WhatsApp

🔐CX Security Rating: 60/100

Strengths

• Uses Signal Protocol for E2EE in all 1:1 and group messages.
• E2EE also available for backups (optional).
• Two-step verification available.
• Ubiquitous and widely adopted.

Deductions

• Owned by Meta (Facebook)—raises concerns about metadata collection, even though message content is encrypted.
• Extensive metadata collection: contact lists, device info, usage patterns, and more.
• Integration with Meta’s broader ecosystem may weaken overall privacy.
• History of vulnerabilities and targeted spyware attacks (e.g., 🔖Pegasus⁹).

Can Citanex detect Pegasus spyware or similar?

Answer: Yes; we have extensive experience and success in identifying threats and malicious code embedded in systems and data. If you suspect Pegasus or similar technology, contact Citanex Incident Response Emergency Care.

Summary: While technically strong in encryption, WhatsApp’s trustworthiness is significantly undermined by its parent company’s data practices.

🔍 Are WhatsApp Messages Recoverable?

Yes. Citanex can recover WhatsApp messages—including deleted texts, media, and call records—from both Android and iOS devices. Our use of Encrypted Data Recovery, Mobile Forensics, and Legal Support Technologies allows for comprehensive data extraction—even in complex or cross-platform environments.

Citanex Sample Successful Extractions:

💬 Telegram

🔐 CX Security Rating: 55/100

Strengths

• Offers 🔖Secret Chats¹⁰ with E2EE (client-to-client).
• Self-destruct timers and screenshot detection in Secret Chats.
• Distributed server architecture for speed and resilience.

Deductions

• Cloud chats are not end-to-end encrypted (Telegram has access).
• Secret Chats are not enabled by default, and unavailable on multi-device setups.
• Encryption protocol (MTProto) is proprietary and less reviewed than Signal Protocol.
• Stores metadata and cloud messages by default.

⚠️ Privacy & Compliance Update

In 2023, Telegram CEO Pavel Durov was briefly detained during a high-profile investigation related to encrypted communications and regulatory compliance. While not charged, the incident increased scrutiny of Telegram’s privacy practices.

Update
Following the detention, Telegram introduced policy updates to improve transparency and signaled greater cooperation with Western regulators, including refining its data request protocols and content moderation guidelines—though end-to-end encryption in Secret Chats remains intact.

🔍 Are Telegram Messages Recoverable?

Yes—under certain conditions. While Telegram uses cloud-based storage and optional end-to-end encryption for Secret Chats, Citanex has been very successful in recovering Telegram messages—including deleted content—when legally and technically permissible. We also support authorized access and interception in compliance with investigative or court-ordered protocols.

💬 Messaging App Security Comparison (2025)

🌍 Global Preferences and Lesser-Known Messaging Apps

Messaging behavior varies widely by country and region due to infrastructure, regulations, censorship, and cultural norms:

United States & Canada

• iMessage dominates among Apple users.
• SMS/MMS remains common for business use and alerts.
• WhatsApp is less widely adopted compared to global norms.

Europe

• WhatsApp is widely used across the continent.
• Telegram is popular in Central and Eastern Europe.
• Signal has a privacy-focused following, especially in Germany.

Latin America

• WhatsApp is the communication backbone for personal and business use.
• SMS is still used in rural and underserved areas.

Middle East

• WhatsApp and Telegram are prevalent, though some countries promote national apps like Botim or ToTok due to state restrictions.

Africa

• WhatsApp leads due to low data use and wide availability.
• Facebook Messenger and SMS are also used in areas with limited connectivity.

India

• WhatsApp is ubiquitous.
• Telegram and Signal serve niche audiences and public channels.
• SMS is used for official messages and one-time passwords (OTPs).

China

• WeChat is the dominant all-in-one app (messaging, payments, social).
• Foreign apps like WhatsApp and Signal are often blocked.

Japan

• LINE is the standard, integrating messaging, payments, and games.

South Korea

• KakaoTalk is the universal app for messaging, media, and e-commerce.

• Messaging tools vary in capability, cost, and compliance.
• End-to-end encryption is a must-have for privacy-conscious users.
• SMS/MMS still play a role in universal access, though they lack modern security.
• Understanding regional preferences and regulatory climates helps guide platform selection—especially for businesses, NGOs, and travelers.

Other Regionally Popular or Specialized Platforms

🛡️ Security and Surveillance Considerations

Some apps are chosen for their encryption strength or lack of state surveillance, while others raise privacy red flags:

• Secure by design: Signal, iMessage, Threema
• Mixed models: WhatsApp (Meta-owned, but E2EE), Telegram (only Secret Chats are encrypted)
• State-monitored or restricted: WeChat (China), ToTok (UAE), VK Messenger (Russia)

🛑 What CALEA Does Not Cover Well

• End-to-end encrypted apps (e.g., Signal, WhatsApp, iMessage)
• Cloud-based messaging platforms
• Foreign-owned platforms not under U.S. jurisdiction
• Device-level encryption (e.g., Apple’s Secure Enclave)

CALEA has not been fully modernized to reflect today’s encrypted, app-based, and global communications landscape. Instead, new laws and policy efforts are being layered on, often controversially, to fill the gap.

⚖️ Modern Legal Efforts to Access Encrypted Digital Messages

EARN IT Act (U.S., proposed multiple times)

• Would pressure tech companies to weaken encryption or face liability.
• Heavily criticized by privacy advocates.

FISA Amendments (like Section 702)

• Expands surveillance of foreign communications through service providers, often without individual warrants.

Clarifying Lawful Overseas Use of Data (CLOUD) Act (2018)

• Allows U.S. law enforcement to access data stored overseas by U.S. tech companies (with agreements in place).

International Cooperation Agreements (e.g., with UK under CLOUD Act)

• Aim to streamline lawful data sharing across borders—but don’t weaken encryption.

💡Key Takeaways

Messaging tools vary in capability, cost, and compliance.

End-to-end encryption is a must-have for privacy-conscious users.

SMS/MMS still play a role in universal access, though they lack modern security.

Understanding regional preferences and regulatory climates helps guide platform selection—especially for businesses, NGOs, and travelers.

🔖Footnotes

1. CALEA (Communications Assistance for Law Enforcement Act) is a U.S. federal law enacted in 1994 that requires telecommunications carriers and certain service providers to build their systems in a way that allows law enforcement agencies to conduct lawfully authorized surveillance.
   
   Key Aspects
   – Applies to traditional phone companies, VoIP providers, and broadband networks.
   – Enables interception of communications (calls, messages, metadata) with a court order.
   – Does not require companies to weaken encryption, but they must assist in lawful access where technically feasible.
   
   Has CALEA been modernized with additional US laws?
   Yes, but only partially. CALEA has not been comprehensively modernized to fully address the scope of modern encrypted communications, cloud services, or global platforms like iMessage, WhatsApp, or Signal.
   
   Purpose: CALEA aims to preserve the ability of law enforcement to access communications data in the digital age, while balancing privacy and technical limitations.
   ↩︎
2. Spoofing is a deceptive tactic where an attacker falsifies information to appear as a trusted source. This can involve faking email addresses, phone numbers, websites, or IP addresses to trick victims into revealing sensitive data, clicking malicious links, or trusting fraudulent communications.
   ↩︎
3. SIM swapping is a type of identity theft where an attacker tricks or bribes a mobile carrier into transferring a victim’s phone number to a SIM card they control. This allows the attacker to intercept calls, texts, and two-factor authentication (2FA) codes—often to gain access to bank accounts, email, or cryptocurrency wallets.
   ↩︎
4. Digital Spoliation refers to the destruction, alteration, or failure to preserve electronic evidence relevant to legal proceedings. This can occur through intentional acts or inadvertent negligence.
   ↩︎
5. End-to-end encryption (E2EE) is a security method that ensures only the sender and intended recipient of a message can read its contents. The data is encrypted on the sender’s device and can only be decrypted on the recipient’s device—preventing third parties, including service providers, hackers, or government entities, from accessing the message in transit or storage. Key point: Even the platform delivering the message (like Signal, WhatsApp, or iMessage) cannot access the content when E2EE is properly implemented.
   ↩︎
6. Device-level security refers to the protection of data, applications, and system functions directly on a physical device—such as a smartphone, tablet, or computer—using built-in hardware and software controls. This includes features like:
   – Biometric authentication (e.g., Face ID, fingerprint)
   – Device encryption (e.g., full-disk or file-based encryption)
   – Secure enclaves or Trusted Execution Environments (TEEs) for storing sensitive data like encryption keys
   – Remote wipe, lock, and tracking capabilities
   
   Purpose: Device-level security ensures that even if a device is lost, stolen, or compromised, unauthorized users cannot access sensitive information stored on it.
   ↩︎
7. Apple’s Secure Enclave is a dedicated security chip that stores sensitive data—like Face ID, Touch ID, and encryption keys—separately from the main processor, protecting it even if the device is compromised.
   ↩︎
8. Metadata is data about data—it provides information that describes the characteristics, context, or origin of a file or message. In messaging, metadata can include details like the sender and recipient, timestamps, device type, location, and message size—even if the message content is encrypted.
   ↩︎
9. Pegasus is a highly advanced spyware developed by the Israeli company NSO Group. It can secretly infect smartphones—iOS and Android—without user interaction, enabling attackers to access messages, calls, cameras, microphones, and location data. Pegasus has been used in targeted surveillance of journalists, activists, and government officials worldwide.
   ↩︎
10. Secret Chats in Telegram are a special type of one-on-one conversation that uses end-to-end encryption (E2EE), meaning only the sender and recipient can read the messages—not even Telegram can access them.
    
    🔐 Key Features of Telegram Secret Chats:
    
    – End-to-End Encryption: Messages are encrypted directly between devices.
    – Device-Specific: Secret Chats are tied to a specific device and don’t sync across multiple devices.
    – Self-Destruct Timers: You can set messages to auto-delete after a set time once read.
    – No Forwarding: Messages in Secret Chats can’t be forwarded.
    – Screenshot Alerts: Telegram notifies users if a screenshot is taken.
    ↩︎