The short answer
From a device that is still logged in, open Settings, then Devices, and terminate every session you do not recognise. Turn on Two-Step Verification under Privacy and Security so a login code alone is no longer enough. Then warn your contacts, and tell the owner of any group where the account is an admin.
Key facts
- Sessions are ended under Settings > Devices. Telegram's FAQ also lists the path Privacy and Security > Active Sessions.
- With two-step verification on, a new login needs both the login code and your password.
- Telegram's FAQ says the phone number is the only way it identifies a user: whoever has the number has the account.
- Login codes arrive in the chat named Telegram and should never be shared with anyone.
- Telegram's developer documentation says a session cannot log out other sessions until 24 hours after it logged in.
- A group's Recent Actions log covers the last 48 hours, including deleted messages and the original text of edited ones.
What should I do in the first ten minutes?
Use a device that is still logged in. That device is your advantage. Telegram's developer documentation says a session cannot log out other sessions until 24 hours after it logged in. So a new intruder cannot remove your phone straight away, and a login you start fresh today cannot remove theirs either.
- End their session. Open Settings > Devices and terminate every session you do not recognise. Telegram's FAQ also lists the path Privacy and Security > Active Sessions.
- Set a password. Open Settings > Privacy and Security > Two-Step Verification. From then on, a login needs the code and the password. Add a recovery email, and protect that mailbox too.
- Check your passkeys. Under Privacy and Security > Passkeys, Telegram lists each passkey with the date it was created and last used. Look for any you did not create.
- Read what was sent as you. Look at recent chats, and at groups and channels you do not remember joining.
- Warn people. Tell your contacts the messages were not yours. A stolen account is often used to ask friends for money or to send them the same trap.
- Tell group owners. If you are an admin anywhere, say so now.
If Telegram's service account tells you a password reset was requested and you did not ask for it, cancel it from that message.
What if I am locked out?
Telegram's FAQ is direct about this: the phone number is the only way it identifies a user, and whoever has the number has the account. It says it cannot help unless you have access to the number or to Telegram on one of your devices.
So recovery depends on what you still hold.
| What you still have | What you can do |
|---|---|
| A logged-in device | Everything in the list above |
| The phone number, but no logged-in device | Log in again with a new login code |
| The number, but someone set a password you do not know | Use the recovery email if one was set. Telegram's documentation describes deleting the account as the remaining option |
| Neither the number nor a device | Ask your phone provider to restore the number, then log in |
Deleting an account permanently removes its messages and contacts. Groups it created are left without an owner, though their admins keep their rights.
Be careful with anyone who offers to recover the account for you. Recovery services that write to you first are another scam.
How do Telegram accounts get taken over?
| How | What happened |
|---|---|
| A shared login code | Someone asked for the code Telegram sent you, as "verification" or "support". Login codes arrive in the chat named Telegram and should never be shared |
| A QR login | You scanned a login QR code from your Devices settings. That links the device showing the code. See QR code scams |
| A fake verification bot or page | It asked for your phone number, then the code, then your password |
| The phone number | Someone gained control of the number and requested a code. A password stops this |
| A fake admin | "Support" walked you through one of the above |
None of these breaks Telegram. Each one asks you to hand over the key.
What does a group owner do when an admin's account is compromised?
Treat the account as hostile until its owner proves otherwise by another route, such as a call.
- Remove its admin rights. Open Administrators and remove it as an admin. Do this first.
- Check who it promoted. An admin with Add New Admins can promote other accounts with its own rights. Remove any admin or bot you did not add.
- Open Recent Actions. It covers the last 48 hours, including deleted messages and the original text of edited ones. Look for pins, bans, new links and changes to the group's name or photo.
- Undo it. Delete what was posted, unpin, unban real members, and revoke invite links. A revoked link stops working immediately.
- Warn members. Pin one short notice: the account was compromised, do not open its links, do not answer its private messages.
- Restore rights slowly. When the person has the account back with a password set, give back only the rights they use.
The owner's own account matters most. Transferring a group to a new owner asks for the owner's two-step verification password, and Telegram's documentation lists an error when that password or the session is less than 24 hours old. An owner with a password set is much harder to rob of the group.
A moderation bot cannot secure an admin's account. Targa compares names and photos against your admins and catches copies of them. A real admin account in the wrong hands is not a copy. That defence is the password, a short admin list and least rights for each admin.
How do I prevent it?
- Two-step verification on every account that is an admin anywhere, with a recovery email.
- A passkey, if your device supports one. Telegram describes passkeys as more secure than SMS codes.
- Never share a login code, with a person, a bot or a website.
- Never scan a login QR code you did not start yourself.
- Keep your phone number current. Telegram warns that losing access to the connected number risks losing the account.
- Look at Devices once a month and end what you do not use.
- Fewer admins, fewer rights. How to protect a group from scammers covers the rest.
Common questions
How do I know if my Telegram account was hacked?
Look in Settings, under Devices, for a session you do not recognise. Other signs are a login alert you did not expect, messages you did not send, contacts asking about a request for money, and groups or channels you never joined.
Can I get my Telegram account back if I am locked out?
It depends on the phone number. Telegram's FAQ says the number is the only way it identifies a user. If you still control the number, you can request a login code and log in again. If you have lost the number, ask your phone provider to restore it first.
Does two-step verification stop a Telegram takeover?
It stops the most common one. With a password set, a stolen login code is not enough to log in. It does not help if you are tricked into typing the password as well, or into approving a login QR code from your own device.
What should a group owner do when an admin account is hacked?
Remove the account's admin rights at once, before asking questions. Then open Recent Actions, undo what it did, check the admin list for accounts it added, revoke invite links, and pin a short notice telling members not to trust messages from that account.
Should I delete my Telegram account after a hack?
Not as a first step. Deleting permanently removes your messages and contacts, and groups you created are left without an owner. End the unknown sessions and set a password first. Deletion is a last resort when you cannot secure the account any other way.
See what a scammer sees in your group
The free group check reads a group's public signals and shows where it is exposed. No account needed.