On this page
The essentials
- Preserve a trusted session and terminate intruders.
- Secure the number, email, and password against re-entry.
- Warn recipients of fraudulent messages.
Separate a warning from confirmed access
An unexpected code alone does not prove someone signed in. Stronger signs include an unfamiliar device session, messages you did not send, or security changes you did not make. Check these on a trusted device. Do not follow a link in a message claiming you were hacked; the warning itself may be bait.
If you have just shared a code or approved someone else’s QR login, do not wait for visible damage. Treat access as potentially compromised and inspect sessions immediately. Record what happened so you can later identify other access that needs securing.
Keep your session and terminate intruders
Open Devices or Active Sessions in Telegram settings. Compare each entry with your phones, browsers, and computers. Connection location can be approximate, so consider the app, device, timing, and actions you recognize together. Terminate clearly unfamiliar sessions. If old entries are hard to distinguish, use the available option to end other sessions while preserving the current trusted one.
Do not sign yourself out first. A newly created session may temporarily be unable to terminate older ones. If the app reports this restriction, try a long-standing trusted session and follow its waiting instructions. Reinstallation does not accelerate that protective delay.
Close the route back in
Terminating a session stops that session, not the cause of the compromise. Review the additional Telegram password, recovery email, and control of the linked number. If a password was exposed, change it through the built-in process. If you do not recognize configured protection, do not blindly approve account deletion; examine recovery options first.
If mobile service disappeared or you suspect a SIM replacement, contact the carrier separately. If email was compromised, secure it from a trusted device. Avoid entering a new password on a possibly infected computer, which could expose the replacement credential immediately.
Review passkeys too if configured. Remove unfamiliar or compromised keys after confirming that you retain your own working access. Removing a key prevents its further use; an already active unauthorized session must be terminated separately.
Warn people who may have been contacted
Review recent outgoing messages and work chats. If someone used your name to request money, codes, or voting help, warn the specific recipients clearly: the message was not yours and they should not follow it. Until control is restored, use another channel they already recognize. Avoid an indiscriminate alarm before understanding the scope.
Anyone who already paid should contact their payment provider promptly. Preserve relevant incident details without spreading other people’s private information. Revoking a session does not automatically recover money or erase copies an intruder already made.
A warning only needs facts: when the unauthorized requests appeared and what recipients should avoid doing. Do not forward the dangerous link to everyone and accidentally spread the lure further.
Worked example: a voting QR was a login
Imagine a contact asks you to vote, and the website tells you to scan a QR through Telegram. An unfamiliar browser appears after approval. Stop interacting with the site and terminate that session from your phone. Then check for new outgoing messages and security changes. Only afterward investigate the link with your contact.
Their account may also have been compromised, so do not automatically accuse them. Verify through another channel. The order matters: revoke access, prevent re-entry, limit damage, then investigate the lure. Arguing with the attacker first wastes time.
If you have already been signed out
Check your other devices before concluding every session is lost. If none survives, recover the number through your carrier and sign in with an official client. An additional password set without your involvement may require a separate recovery process. Follow the actual app instructions rather than promises of a universal bypass.
For a Telegram support request, prepare event timing, a description of unauthorized activity, and available account details. Use telegram.org/support. Do not pay intermediaries to “remove the hacker” or send session files; a session file may itself provide access rather than merely diagnostic information.
Verify that the incident has stopped
Reopen the device list after securing the account. Verify that the unknown session has not returned, that the email and number are yours, and that recipients of dangerous messages were warned. If access returns, investigate a remaining cause: a compromised computer, email, phone number, or newly approved login. Changing a profile picture will not fix it.
Use a unique additional password, a protected mailbox, and careful approval of new devices going forward. Recovery means control over entry routes and an understanding of exposure. A clean session list cannot establish that nobody previously read your conversations.
