How to Protect Your Telegram Account from Hijacking

The essentials in one minute

To log in to your account from a new device, an attacker needs the login code that arrives in Telegram or by SMS. Breaking into Telegram from the outside is hard, so scammers work on getting you to hand that code over.

Three steps cover most of the risk:

1. Turn on a cloud password (two-step verification).
2. Link a recovery email that only you can access.
3. Never share a login code with anyone — not a "friend", not "support", not a website.

Common takeover schemes

Fake voting. Someone you know writes: "Please vote for my niece in a contest." The link opens a site where you must "log in with Telegram" by entering your number and code. In reality you are authorizing the scammer's device. The same messages then go out from your account to your contacts.

"The code came to you by mistake." You receive a login code, followed by a message: "I accidentally typed your number, could you forward the code?" This is an attempt to log in to your account.

Telegram Premium or Stars gift. A message about a "gift" you must activate through a link or a bot by entering your number and code. A real Premium gift appears directly in the chat as a service message, and you do not need to log in anywhere to receive it.

Fake support. An account named something like "Telegram Support" says your profile breaks the rules and will be blocked unless you "verify ownership". Official notifications come only from the verified "Telegram" service account, which never asks you to send a code.

Malicious file. An .apk disguised as a photo or document that reads your SMS and intercepts codes. Do not install apps from chats.

How to turn on a cloud password

Menu names can vary slightly between app versions, but the path is usually:

1. Settings → Privacy and Security → Two-Step Verification.
2. Choose a password you do not use anywhere else. A password manager is the best place to keep it.
3. Make the hint meaningless to anyone but you.
4. Add a recovery email and confirm it with a code. Make sure that mailbox has two-factor authentication too.

From now on, logging in from a new device requires the password as well as the code.

It also helps to:

• set an app passcode if other people use your phone;
• hide your phone number in privacy settings and limit who can add you to groups;
• set a PIN on your SIM card and ask your carrier how to prevent unauthorized SIM replacement.

Checking active sessions

Under Settings → Devices you can see where your account is open: device model, app, IP address, country and last activity.

• End any session you do not recognize, or tap "Terminate all other sessions".
• Turn on automatic termination of sessions that have been inactive for a chosen period.
• Check this section from time to time and after anything suspicious.

Note that Telegram restricts a freshly logged-in device: it cannot terminate other sessions right away. This protects you from a hijacker, but it also means the fastest way to kick them out is from a device you have been logged in on for a while.

If your account has already been hijacked

You are still logged in on one of your devices:

1. Open Devices immediately and end the unknown sessions.
2. Turn on or change your cloud password and recovery email.
3. Check whether the attacker changed your username or linked email, or created channels or bots in your name.

You have been logged out everywhere:

1. Try logging in with your phone number. If the hijacker did not set a cloud password, the SMS code will let you in and you can end their session.
2. If they set their own cloud password, use "Forgot password?". When the recovery email is not available, Telegram offers a password reset with a waiting period — this protects genuine owners from a quick reset by an attacker.
3. Contact official support from within the app or on the Telegram support page.

In every case, warn your contacts through another messenger or by phone: someone may be asking for money in your name or sending the same "voting" links.