Short answer
From a device that is still logged in, open Settings → Devices and terminate every session you don’t recognise, then turn on Two-Step Verification with a recovery email so a login code alone is no longer enough. If you have no logged-in device left, Telegram’s FAQ says to contact your mobile operator to block the old SIM and issue a new one with your number, then log in and end the attacker’s session. If the attacker set a two-step password you don’t know and there is no recovery email, a reset takes 7 days.
How Telegram accounts get taken over
- You were tricked into sharing a login code — often by a “friend”, a fake Telegram message or a “Premium gift”.
- A phishing page or web version captured your session.
- Your SIM was swapped, so the login code went to someone else.
- A desktop or web session was left open on a shared device.
If you still have a logged-in device
- Go to Settings → Devices (Active Sessions) and terminate every session you don’t recognise.
- Turn on Two-Step Verification under Privacy and Security, with a strong password and a recovery email.
- Protect the recovery email with its own strong password and 2FA.
- Check your username, profile and any channels or groups you own for changes.
Very new sessions can sometimes be terminated only from a device that has been logged in for a while — use your oldest device.
If you are locked out
- Ask your mobile operator to block the old SIM and issue a new one with your number, then log in and end the attacker’s session.
- If a two-step password you don’t know was set and you have no recovery email, Telegram lets you request a reset that completes after 7 days.
- Deleting the account is the last resort: if you sign up again you start as a new user, without your chats, contacts or groups.
Limit the damage
- Warn your contacts from another app — hijacked accounts ask for money or for login codes.
- Screenshot scam messages sent in your name.
- If you own channels or groups, check the admin list as soon as you are back in.
- Report fraud to the police if anyone lost money; see where to report, by country.
When you need help
Telegram’s official help is mostly self-service. When the SIM, the recovery email and the account are tangled together, our hacked account recovery service works through the order of steps with you — without ever asking for your codes or passwords.
Frequently asked questions
Will Telegram send me a login code by SMS?
Often the code arrives inside Telegram on your other devices. Never share it — Telegram doesn’t ask for it in a chat.
Can I get back chats the hacker deleted?
Cloud chats deleted for everyone are generally gone. Secret chats exist only on the devices that took part.
Someone set a 2FA password on my account. What now?
Use the recovery email if one exists; otherwise request a reset from a logged-in session, which completes after 7 days unless cancelled.
Should I delete my Telegram and start again?
Only as a last resort. A new account loses your history, contacts and groups.
Sources: Telegram FAQ, Telegram — active sessions and two-step verification