If any device is still logged in, end unknown sessions in Settings then Devices and open 2-Step Verification to see which recovery email is listed. Request a 7-day password reset from there, or use a recovery code if the email is still yours. If logged out everywhere, secure your SIM and use Telegram's login help form. Never share login codes.
Summary
Telegram login uses your phone number; the recovery email sits inside 2-Step Verification and helps if you forget that password.
If you are still logged in on any device, end unknown sessions under Settings then Devices and check whether the recovery email still matches an inbox you control.
If the attacker set their own recovery email, your options are a 7-day password reset from a logged-in device, a code to your own email if it is still listed, or Telegram's login help form.
If you are logged out everywhere, secure your SIM with your carrier first, then use the login help form at telegram.org/support with your number and problem.
Never share a login code, 2-Step Verification password or inbox access with anyone offering recovery.
Telegram makes the final decision, and an account with an attacker password plus their recovery email may not come back.
You opened Telegram's settings and the recovery email under 2-Step Verification is an address you have never used. Or you tried to log in on a new phone and, after the SMS code, Telegram asked for a password you never set, then offered to email a reset link to an inbox that is not yours.
That usually means someone logged in with your code, turned on 2-Step Verification, and pointed the recovery email at their own mailbox so you cannot reset the password later. Your phone number is still the account, but the extra lock is theirs.
This guide focuses on that email change: how to spot it, what to try while any device is still logged in, and what is left when the recovery email truly belongs to the attacker.
On any device still logged in, open Settings, Privacy and Security, then 2-Step Verification and read the recovery email. If it is wrong, end every unknown session under Devices first, then start a 7-day password reset from that logged-in device before the attacker notices. If the email is still yours, request a recovery code to that inbox from the login screen after your SMS code. If you are logged out everywhere, secure your SIM with your carrier, then use Telegram's login help form. Never share codes or inbox passwords with anyone.
#What Should You Do If the Telegram Recovery Email Was Changed?
On any device where you are still logged in, go to Settings, then Devices, and end every session you do not recognise. Open Privacy and Security, then 2-Step Verification, and note the recovery email address shown. If you control that inbox, you can still receive reset codes. If it is the attacker's, request a 7-day password reset from this device, as Telegram's two-factor documentation describes, and watch for a cancel notice on any session they still hold. If you are logged out everywhere, get your SIM back from your carrier and use Telegram's login help form. Never share a login code. In Malaysia, if money was lost, call 997 and your bank first.
Your options depend on two things: whether any of your devices is still logged in, and whether the attacker has set a password. Find your row, then go to the section that matches.
Common signs of a Telegram takeover and the first step for each, at the time of writing. Screen labels vary by app version and platform.
What you see
What it usually means
What to do first
You are still logged in, and Devices shows a session you do not know
Someone logged in with a code and is using the account alongside you
End that session now, then set up 2-Step Verification
You are logged out, and the login screen asks for a password you never set
The attacker turned on 2-Step Verification to lock you out
See the section on an attacker's password below
The login code never reaches you by SMS
The code may be going to another logged in device, or your SIM may have been moved
Check your SIM works for calls and texts; if not, call your carrier
You can read chats but cannot send, and the app says the account is frozen or limited
The account was reported, possibly for spam the attacker sent
Secure the account first, then appeal in the app or through @SpamBot
Your number now opens an empty, new account
The old account may have been deleted
Telegram says deletion cannot be reversed; warn contacts and start again
#Still Logged In Somewhere? Remove the Intruder in Five Steps
This is the best position to be in. Telegram accounts are tied to active sessions, and ending a session logs that device out. Do these in order, on the device you trust most:
Open Settings, then "Devices". Look at each session's device name, location and last active time. End every one you do not recognise. If you are unsure, end all sessions except the one in your hand.
Open Settings, Privacy and Security, then 2-Step Verification. If it is off, turn it on and set a password you have never used anywhere else. Telegram's FAQ says you will then need both the code and the password to log in.
Add a recovery email you control and protect that inbox with its own strong password and two-step login, as Telegram's FAQ advises. If 2-Step Verification is already on and you did not set it, see the next section.
Open Privacy and Security, then Passkeys. Telegram says this list shows when each passkey was created and last used. A passkey you did not create lets someone log in without an SMS code, so remove it if the app gives you the option.
Check the phone number on your profile. If it has changed, change it back under Settings, then your phone number, then "Change Number", as the FAQ describes.
#The Attacker Set a 2-Step Verification Password. Now What?
An attacker may switch on 2-Step Verification the moment they get in, using their own password and email. Your way back depends on what you still have. Telegram's developer documentation on two-factor authentication lists three recovery routes for a forgotten password.
You are still logged in on a device: you can ask for a password reset from that session. Telegram starts a 7-day timer before the reset goes through, and the documentation says a button from the Telegram service account can cancel it during that time. If the attacker is still logged in, they may see that button too, so end their sessions first.
The recovery email is yours: Telegram can send a recovery code to that email, even from the login screen once you have entered the login code.
You are logged out and the recovery email is theirs: the documented option is deleting the account, which needs the login code. You keep the phone number but lose your chats, contacts and groups.
That last route hurts, but it does end the attacker's access. Telegram's FAQ says deletion is irreversible and you will appear to contacts as a new user, so try the login form first.
#Telegram Kena Hack, Tak Boleh Login: When You Are Logged Out Everywhere
Being logged out on every device is harder, because Telegram identifies you by your phone number and little else. The FAQ puts it plainly: whoever has the number has the account, and Telegram cannot help unless you have the number or a logged in device.
Make sure your SIM works. If calls and texts have stopped, your number may have been moved to another SIM. Call your carrier, ask them to block the old SIM and issue a replacement with your number, as Telegram's FAQ advises for a stolen phone.
Try to log in again with the number in full international format, starting +60. The code may arrive by SMS, or in the "Telegram" chat on another device if you still have one logged in.
If you hit an unknown password, use the routes in the section above.
If login keeps failing, use Telegram's support form and describe the problem in a few plain sentences: your number, what you see, and when it started.
Telegram's FAQ also names @SmsTelegram on X as its official account for login problems, and says it has no other support accounts on social media. Treat every other "Telegram support" profile as fake.
Most Telegram takeovers do not involve clever code. The attacker gets you to hand over the login code, then logs in on their own device. Telegram's FAQ says codes for your own account arrive in the verified service notifications chat named "Telegram", with a blue check, and should never be shared with anyone.
The developer documentation on user authorisation adds a useful detail: Telegram's servers automatically cancel a login code if you forward it or send it in a chat. That is one likely reason scammers ask you to type the code into a web page or read it out on a call instead. Scripts that commonly reach Malaysian users, in English, BM or Chinese, look like these:
A friend's account (already hacked) says: "Sorry, I sent a code to your number by mistake, can you tell me what it says?" or "Tersalah hantar kod, boleh bagi balik?"
A "vote for my child in a contest" link that opens a page asking for your Telegram number and then the code.
An offer of free Telegram Premium, a giveaway or a paid "task" job, all needing you to confirm your account on an outside site.
A message claiming to be Telegram support, saying your account will be deleted unless you verify it.
Telegram's Terms of Service say that messages from the Telegram team about a Premium account come through verified service accounts inside the app. A Premium offer through a link from a stranger is not one of them.
If the attacker spammed strangers from your account, it may now be limited. Telegram's Spam FAQ says a limited account can still message people who saved your number and reply to anyone who writes first, and that you can contact @SpamBot if you believe the limit is wrong. Our guide to Telegram numbers that are banned covers the stricter cases.
While the attacker had your account, they probably messaged your contacts and groups. Once you are back in, or from another channel if you are not:
Post one short message in your main groups and family chats: your account was taken over, do not send codes or money, and ignore requests from it sent after a certain time.
Check your sent messages and delete any scam messages you can find. Telegram's FAQ says you can delete messages for both sides in one-to-one chats.
If a separate fake account is pretending to be you, Telegram's FAQ says to contact @NoToScam.
If the attacker removed you as admin from a channel you run rather than taking over your personal account, our guide to a hacked Telegram channel with the admin removed covers that separately.
#If Money Was Lost or a Code Was Shared in Malaysia
A takeover often comes with fraud: friends send money to the attacker, or your own banking codes are caught along the way. The Malaysian government's page on the NSRC 997 hotline says to call 997 within 24 hours of discovering a scam, contact your bank, and make a police report at the nearest station.
For the hacking itself, CyberSecurity Malaysia's Cyber999 service is the national point of contact for computer security incidents. MyCERT's reporting channel page lists an online form, email to cyber999@cybersecurity.my and the 1-300-88-2999 line during office hours.
Logging out of your last working device to "start fresh". That device may be your only way to end the attacker's sessions or reset their password.
Deleting the account in a panic before trying the recovery email, the login form and your carrier.
Asking a "recovery expert" in a Telegram group to help. Anyone who asks for your code, password or recovery email is trying to take the account, not return it.
Paying a "hacker for hire" to break back in. It is a common scam, and breaking into an account is not a legal recovery route.
Once you are back in, a short setup keeps the next attempt out. Telegram's FAQ recommends 2-Step Verification and an app passcode, both under Settings, Privacy and Security.
2-Step Verification on, with a unique password stored in a password manager.
A recovery email with its own strong password and two-step login.
A passkey on the phone you use most, which Telegram says can replace the SMS code.
A monthly look at Devices to end sessions you no longer use.
Your phone number kept current. Telegram warns that losing the connected number can mean losing the account.
Most people can work through the steps above alone. SocialSafe by AwareXone, the recovery service line of AwareXone, can review the situation when the account runs a business channel, when a SIM swap is mixed up in the takeover, or before you choose account deletion. We tell you plainly which official route is still open, if any, and never ask for your login code, password or inbox access. The platform makes the final decision. The recovery hub explains how a review works, and our Trust Center lists what we will not do.
How do I log out a hacker from my Telegram account?
Open Settings, then Devices, and end every session you do not recognise, or all other sessions. Then turn on 2-Step Verification so the attacker cannot log back in with a code alone.
Can I recover my Telegram account without my phone number?
Only if you are still logged in on another device. Telegram's FAQ says the phone number is the only way it identifies you, so if you have neither the number nor a logged in device, it cannot help. Get the number back from your carrier first.
Why is Telegram asking for a password I never set?
The attacker probably turned on 2-Step Verification with their own password and may have changed the recovery email. If you still have a logged in device, request a password reset there, which takes 7 days. Otherwise only your own recovery email can send a code.
Can I change the Telegram recovery email back myself?
Only while logged in with the correct 2-Step Verification password, or after a successful password reset. If the attacker still controls the password and their email, you need the 7-day reset from a logged-in device or Telegram's login help form.
Is it safe to share my Telegram code with a friend who sent it by mistake?
No. Telegram login codes should never be shared with anyone, and a friend asking for one is usually a hacked account. Their message is the start of the same takeover that happened to them.
Does Telegram have a support number I can call in Malaysia?
Telegram's FAQ lists in-app support (Settings, then Ask a Question), a login help form, and @SmsTelegram on X. It says it has no other support accounts on social media, so any other "Telegram agent" is fake.
Should I report a hacked Telegram account to the police in Malaysia?
Yes if money was lost or someone used your account to cheat others. Call 997 and your bank first, then make a police report. You can also report the incident to CyberSecurity Malaysia's Cyber999.
