Telegram account takeovers usually start with someone getting your login code by phishing or SIM swap. If you still have one active session, use it immediately to terminate the attacker’s access.
Does this affect you?
Use this for Telegram on iPhone, Android, desktop, or web when messages were sent without you, devices appear that you do not know, or you were signed out and cannot get back in with your phone number.
If you can still sign in
Kick out other sessions first.
- Open Telegram Settings > Devices.
- Review the list of signed-in devices.
- Tap Terminate All Other Sessions to sign out every device except the one you are using.
- Go to Settings > Privacy and Security > Two-Step Verification and set a password.
- Add a recovery email for the two-step password.
- Review privacy settings, recovery email, bots, groups, and channels for changes you did not make.
- Delete or explain suspicious messages or posts the attacker sent.
If you were signed out entirely
Register the number again and use Telegram’s official code options.
- Open Telegram and enter the phone number attached to the account.
- Wait for the login code by SMS or Telegram message if you are still signed in somewhere else.
- If SMS does not arrive, use the call option when Telegram offers it.
- If Two-Step Verification is enabled and you forgot the password, tap Forgot password.
- Use the recovery email if one was set.
- If there is no recovery email and you cannot remember the password, wait through Telegram’s reset period, which can be about a week.
- After access returns, terminate other sessions and set a fresh two-step password.
More control
SMS alone is not enough
A SIM swap or tricked-forward login code can bypass phone-number-only login. Two-Step Verification adds a password that a stolen SMS code does not provide.
Never share login codes
Telegram login codes should only be typed into Telegram. A friend, admin, support contact, or bot asking you to forward the code is running a takeover attempt.
Check devices regularly
Settings > Devices is the fastest way to spot quiet unauthorized access before obvious spam appears.
Watch for SIM-swap signs
If your phone suddenly shows No Service for no clear reason, contact your carrier immediately. A ported phone number can endanger Telegram, email, and banking logins.
Sources
- Telegram FAQ – Login and Security (2025)
- Telegram FAQ – Two-Step Verification (2025)
- Telegram Support – What to do if your account was hacked (2025)