A Telegram account works differently from most: there is no password by default, and you sign in with a code sent by SMS or from another session. That is convenient and it is also the main weakness — whoever controls your phone number reaches your messages.
La contraseña en la nube va primero
In the security settings there is “Two-step verification”, also called the cloud password. Once it is on, a single SMS code is no longer enough to sign in — a password only you know is required as well.
This closes the main takeover route: restoring a SIM card with documents or through a shop employee. The code reaches the attacker, but without the cloud password they stay at the door.
The password is entered rarely, so make it long — sixteen characters from a manager. And set a recovery email: without it, a forgotten password is nearly impossible to reset.
Sesiones activas
The settings list every device where your account is open. Check it monthly: a stranger’s session is the only visible trace of a takeover, and it can sit there for months until you look.
Set automatic termination of inactive sessions after a week or a month. That clears forgotten logins from old phones and other people’s computers.
Los métodos que de verdad funcionan
“Vote for my child in a contest”. A friend sends a voting link, the page asks you to sign in through Telegram and enter a code. You enter the code on a fake page, the attacker enters it into the real Telegram — and takes your account. Then the same link goes to all your contacts.
“I am in trouble, I need money urgently.” Sent from the already stolen account, in your name, to your friends.
Fake support. A “Telegram security service” asks for a code to “confirm your account”. Real support never asks for codes.
All of them share one thing: you enter the login code yourself. The rule is almost boringly simple — never tell anyone the Telegram code and never enter it anywhere but the app itself. Even if a close friend asks: most likely it is no longer them.
Cinco minutos de ajustes
Two-step verification with a long password and a recovery email.
Who sees the phone number — set it to nobody. Otherwise numbers get harvested from groups.
Who can add you to groups — my contacts. Otherwise you land in spam channels without asking.
Session auto-termination after a month of inactivity.
A note on the username: it is public and it is how people find you. When choosing one, keep the year of birth and your real surname out of it.
Si ya te han robado la cuenta
1. Sign in again with a code to your number, if it is still yours. This often works: the attacker has not managed to enable the cloud password yet.
2. End all sessions except the current one — as the very first action.
3. Enable two-step verification. If it is already on and not by you, resetting goes through support.
4. Warn your contacts. Money may already have been requested in your name.
5. Check the linked email and treat it as a leak if its password was reused anywhere.