Telegram New Account Takeover via Forwarded Code Scam
Scammers contact Telegram users on behalf of a fake 'friend' or 'support team', convincing them to forward a Telegram login verification code that immediately transfers account control to the attacker.
Part of: New Account Takeover
Last reviewed: 8 June 2026
Telegram accounts are secured by a phone-number-based SMS verification code sent at login. Whoever has that six-digit code, combined with the target phone number, can register and control the account on a new device. This makes the verification code the single most valuable thing a scammer needs from a Telegram user.
The attack typically arrives through a message from a contact whose Telegram account has already been compromised. The attacker, operating through the victim's friend's account, explains that they 'accidentally' sent a code to the victim's number and asks them to forward it. The victim, trusting their friend, obliges.
Within seconds the attacker has registered the victim's Telegram account on their own device. The cycle then repeats — the attacker messages the newly hijacked account's contacts asking for their codes.
How this scam works on the Telegram brand
Telegram's real login flow is straightforward: when you or someone using your phone number tries to log in to Telegram, an SMS is sent to that number. This code should never be shared with anyone — Telegram explicitly states this during the process.
The scam message reads something like: 'Hey, I accidentally put your number instead of mine when requesting a code — could you forward me the SMS that just arrived? It's a 6-digit code from Telegram.' The message comes from a trusted contact name and profile photo, making the request feel benign.
Once the victim forwards the code, the attacker logs into the Telegram account on their device. Two-step verification with a password would block this takeover, but many users have not enabled it. The attacker then exports the contact list and begins targeting them with the same code-forwarding request.
Common red flags
- A contact on Telegram asks you to forward a Telegram verification code you just received, claiming it was sent to you by mistake.
- The message creating urgency: 'Please send it quickly, I'm trying to log in right now.'
- You receive an unexpected Telegram SMS code that you did not request — someone may be attempting to register your number.
- A 'Telegram support' account contacts you asking for your verification code — Telegram's real support never does this.
- The request comes via a contact you have not spoken to recently, whose account may have been previously hijacked.
- After forwarding the code, you find yourself logged out of Telegram.
How to protect yourself
- Never share or forward a Telegram verification SMS code with anyone, regardless of who asks.
- Enable Telegram two-step verification immediately at Settings > Privacy and Security > Two-Step Verification — this password is required even with the SMS code.
- If you receive an unexpected SMS code, do not forward it — your number is being targeted for a takeover attempt.
- If your account was taken over, contact Telegram support at telegram.org/support to begin recovery.
- Alert your contacts if your account was hijacked so they do not fall for the same forwarding request.
- Review active Telegram sessions at Settings > Privacy and Security > Active Sessions and terminate any you do not recognise.
How to report it
- Report the scam to Telegram's support at telegram.org/support.
- Report the attack to your national cybercrime authority: Action Fraud actionfraud.police.uk (UK) or the FTC at ReportFraud.ftc.gov (US).
- Alert the person whose account was used to contact you so they can also recover their account.
- Forward details of the scam to Telegram's spam report at @SpamBot within the app.
Frequently asked questions
If someone has my Telegram verification code and my phone number, can they fully take over my account?
Yes, unless you have enabled two-step verification. With a phone number and its current verification code, an attacker can register your Telegram account on their device. Two-step verification adds a password requirement that they cannot bypass with the SMS code alone.
Why would my actual friend's account be sending me this message?
The message comes from your friend's account because their account was already taken over using the same code-forwarding trick. The attacker is now using your friend's trusted identity to extend the attack to your network.
Can I recover a Telegram account taken over this way?
Yes. You can reclaim the account by using the phone number to request a new login code — this logs out all other sessions including the attacker's. Contact Telegram support at telegram.org/support if you encounter difficulties.