How to Recover a Hacked Telegram Account

If you still have access on any device, end every session you do not recognise, change or set your two-step verification password, and check your recovery email right away. If you are fully locked out, sign in again with your phone number and use the password recovery option, then contact Telegram through its official support channels. Act quickly, because the attacker may be using your account to scam your contacts.

This guide covers both situations step by step, plus how to limit the damage and keep it from happening again.

Signs your account has been taken over

You may notice one or more of these:

• Messages you did not send, often asking friends for money or codes.
• A notification about a login from a device or place you do not recognise.
• Unknown devices in your list of active sessions.
• Your two-step verification password or recovery email has changed.
• You have been logged out and cannot sign back in.
• Channels or groups you run have new admins or strange posts.

First, find out which situation you are in

Recovery depends on whether you can still open Telegram on at least one of your devices.

• Still logged in somewhere: you have a good chance of fixing this yourself, quickly.
• Locked out everywhere: you need to sign in again from scratch, and the steps depend on what the attacker changed.

If you are still logged in on a device

Work through these steps in order, as fast as you can. Menu names vary between app versions, so look in your settings for similar labels.

1. Open your list of active sessions. It is usually under Devices or Privacy and Security in Settings.
2. End every session you do not recognise. If you are unsure, end all other sessions. You can log in again on your own devices afterwards.
3. Check two-step verification. If it is off, turn it on now. If it is on, change the password.
4. Check the recovery email. Make sure it is your address. If the attacker changed it, change it back.
5. Secure that email account too. Change its password and turn on its own two-step verification.
6. Review your privacy settings. Check nothing has been changed, such as who can see your phone number.
7. Check channels and groups you run. Remove any admins you did not add and delete scam posts.

Telegram may limit what a newly signed-in device can do for a while, which can make it harder to end an older session from a new one. If a step is blocked, try it from a device that has been logged in for longer, or check Telegram's help pages for the current rules.

If you are locked out completely

1. Try to sign in with your phone number. Install Telegram on a device you control and request a login code.
2. Check where the code arrives. It may come by SMS or to another Telegram session. If the attacker is logged in elsewhere, the code may go there first; look for an option to receive it another way.
3. Enter the two-step verification password if asked. If the attacker changed it, use the forgot password option.
4. Use your recovery email. If the recovery email is still yours, the reset code goes there. If the attacker changed it, that option may not help.
5. Once in, follow the steps above. End other sessions, set a new password and recovery email, and check your channels.

If you cannot get back in

If the attacker changed both your password and recovery email, recovery is much harder.

• Contact Telegram through the official support options listed in the app or on Telegram's website. Explain what happened, include your phone number in the format it asks for, and describe when you lost access.
• Be patient. Support may take time to respond.
• Beware fake "support". Scammers watch for people asking for help and offer to recover accounts for a fee or for your code. Real Telegram support will not ask for your login code or password in a chat.

Telegram's recovery options change from time to time, so check its own help pages for what is currently possible.

Make sure you still control your phone number

Your Telegram account is tied to your phone number. If an attacker has taken over the number itself, for example through a SIM swap, they can keep receiving your codes.

• If your phone suddenly has no signal and you did not change anything, contact your mobile carrier straight away.
• Ask your carrier about extra protection, such as a PIN required for SIM changes.

Limit the damage to others

An attacker usually uses a hijacked account to target the people who trust you.

1. Warn your contacts through another method, such as a phone call or another app, that messages from your account may not be from you.
2. Tell them never to send codes or money to your account until you confirm you have it back.
3. Post a short notice in channels or groups you run once you regain control, explaining what happened.
4. Report the scam messages the attacker sent, if you can see them. Our guide on how to report on Telegram shows how.

If the attacker took over your channel and you cannot regain it, report the channel to Telegram. If it is listed on TGDirectory, you can also report the listing to our moderators.

How did it happen?

Knowing the cause helps you avoid a repeat. The most common routes are:

• Sharing a login code with someone posing as support, a friend or a group "verification" bot. See why you must never share a Telegram login code.
• Entering details on a fake login page sent through a link.
• No two-step verification, so a code was all the attacker needed.
• A reused password that leaked elsewhere.
• An old session left logged in on a shared or lost device.
• Malware on your phone or computer.

Stop it happening again

1. Keep two-step verification on, with a long, unique password. Our two-step verification guide walks through it.
2. Use a recovery email that is secure and that you check.
3. Review active sessions regularly and end old ones.
4. Never share login codes or passwords, with anyone, for any reason.
5. Learn the common tricks in our guide on how to spot Telegram scams.
6. Keep your phone and Telegram app updated.

Common mistakes

• Waiting to act. Every minute the attacker keeps access, they can message your contacts.
• Ending only one suspicious session. If unsure, end all other sessions.
• Forgetting the recovery email. An attacker who changed it can lock you out again.
• Paying a "recovery expert". These offers are almost always scams.
• Sharing your new code with "support" in a chat. That repeats the original mistake.
• Not warning contacts. They may lose money to messages sent in your name.

FAQ

Can I recover my Telegram account without my phone number?

Telegram accounts are tied to a phone number, so losing the number makes recovery very difficult. Try to regain the number through your carrier first.

Will I lose my chats if my account was hacked?

Cloud chats stay with the account, so if you regain access they are usually still there, unless the attacker deleted them. Secret chats live only on the device where they were started.

How do I know which session is mine?

Sessions usually show a device type, app and approximate location. If you cannot tell, end all other sessions and log in again on your own devices.

Does changing my password log out the attacker?

Not by itself. End their session from your active sessions list as well.

Can Telegram tell me who hacked my account?

Do not expect that. Focus on regaining access and securing the account, and report the incident to local authorities if money was lost.

Summary

Move fast. If you are still logged in, end unknown sessions, set or change your two-step verification password and fix your recovery email. If you are locked out, sign in again with your number, use the recovery email, and contact Telegram's official support if that fails. Warn your contacts, ignore anyone selling "recovery", and keep two-step verification on from now on.