Telegram Account Security: A Practical Checklist

How do Telegram accounts usually get taken?

Understanding the routes in makes the settings below easier to prioritise. Telegram accounts are tied to a phone number, and a login normally needs only a code sent to that number or to the app. So the common routes are:

• Code phishing. Someone persuades you to send them the login code, often posing as Telegram, a friend, or a contest.
• Fake login pages. A link leads to a page that looks like Telegram Web and passes whatever you type straight to an attacker.
• Number takeover. A SIM swap or port-out moves your number to someone else, who then receives your codes.
• Unattended sessions. An old computer or shared device is still signed in.
• Malicious files or apps. Malware on a device can read anything the device can.

How do I turn on Telegram two-step verification?

1. 1

   Step 1: Open the setting

   Go to Settings › Privacy and Security › Two-Step Verification.

2. 2

   Step 2: Choose a strong, unique password

   Use one you don’t use anywhere else. A password manager is the easiest way to keep it.

3. 3

   Step 3: Add a recovery email

   Telegram uses it to help you reset a forgotten password. Its FAQ stresses that this email account must also be protected by a strong password and two-step verification.

4. 4

   Step 4: Confirm the email

   Enter the code Telegram sends. Until you confirm, the recovery email isn’t active.

With two-step verification on, a stolen login code is no longer enough. The attacker also needs the password. Telegram’s own stolen-phone advice starts with exactly this step.

Should I use a Telegram passkey?

Telegram supports passkeys, which let you sign in with your device’s PIN, fingerprint or face scan instead of an SMS code. Its FAQ describes them as more secure than SMS codes. You manage them under Settings › Privacy and Security › Passkeys, and a password manager can back them up. You can still request an SMS code, so a passkey doesn’t remove the need to keep your phone number current.

How do I check who is logged in to my Telegram?

Open Settings › Devices. Every logged-in app is listed with its device, location and last activity. End anything you don’t recognise or no longer use. Make this a habit every few months, and every time you sell, return or lend a device.

The same screen lets you set how long an unused session stays signed in before it’s logged out automatically. A shorter period limits the damage from a device you forgot about.

How do I protect the phone number behind my account?

• Ask your carrier about a port-out PIN, SIM lock or account PIN, so your number can’t be moved without you.
• Put a SIM PIN on the physical SIM card.
• If you’re about to change numbers, change it in Telegram first, while you still have the old one.
• Keep the number active. Telegram warns that receiving codes in the app is no substitute for an up-to-date number you control.

What does a Telegram passcode lock do?

A passcode (Settings › Privacy and Security › Passcode Lock) locks the app on that device. It protects against someone picking up your unlocked phone or using your computer. It doesn’t protect the account from logins elsewhere, which is what two-step verification is for.

How do I spot Telegram phishing?

• Telegram login codes arrive in the official “Telegram” chat with a blue check, or by SMS. Any message asking you to forward or type that code somewhere else is a scam.
• Telegram support never asks for your code or password. Its FAQ lists @SmsTelegram on X as its official login-help account and says it has no other support accounts on social media.
• Be suspicious of urgent messages from friends asking you to vote, claim a prize or “verify” your account through a link. Their account may already have been taken.
• Only log in through the official apps or the address you type yourself. Never log in through a link sent in a chat.
• Treat bots like strangers. Telegram’s FAQ says not to give them passwords, codes or bank details.

Which privacy settings matter for security?

The 10-minute Telegram security checklist

1. Two-step verification on, with a strong unique password.
2. Recovery email set, confirmed and protected with its own 2FA.
3. Active sessions reviewed. Everything unfamiliar ended.
4. Phone number current, with a carrier PIN or port-out lock.
5. Passcode lock on any shared or work device.
6. Logged-in websites reviewed.
7. You know where your export and network record are kept, if you keep them.

The backup readiness check walks you through these and suggests what to do next, without asking for any account details.