Telegram New Account Takeover via Forwarded Code Scam
Scammers contact Telegram users on behalf of a fake 'friend' or 'support team', convincing them to forward a Telegram login verification code that immediately transfers account control to the attacker.
Part of: New Account Takeover
Last reviewed: 8 June 2026
Telegram accounts are secured by a phone-number-based SMS verification code sent at login. Whoever has that six-digit code, combined with the target phone number, can register and control the account on a new device. This makes the verification code the single most valuable thing a scammer needs from a Telegram user.
The attack typically arrives through a message from a contact whose Telegram account has already been compromised. The attacker, operating through the victim's friend's account, explains that they 'accidentally' sent a code to the victim's number and asks them to forward it. The victim, trusting their friend, obliges.
Within seconds the attacker has registered the victim's Telegram account on their own device. The cycle then repeats — the attacker messages the newly hijacked account's contacts asking for their codes.
How this scam works on the Telegram brand
Telegram's real login flow is straightforward: when you or someone using your phone number tries to log in to Telegram, an SMS is sent to that number. This code should never be shared with anyone — Telegram explicitly states this during the process.
The scam message reads something like: 'Hey, I accidentally put your number instead of mine when requesting a code — could you forward me the SMS that just arrived? It's a 6-digit code from Telegram.' The message comes from a trusted contact name and profile photo, making the request feel benign.
Once the victim forwards the code, the attacker logs into the Telegram account on their device. Two-step verification with a password would block this takeover, but many users have not enabled it. The attacker then exports the contact list and begins targeting them with the same code-forwarding request.
Common red flags
- A contact on Telegram asks you to forward a Telegram verification code you just received, claiming it was sent to you by mistake.
- The message creating urgency: 'Please send it quickly, I'm trying to log in right now.'
- You receive an unexpected Telegram SMS code that you did not request — someone may be attempting to register your number.
- A 'Telegram support' account contacts you asking for your verification code — Telegram's real support never does this.
- The request comes via a contact you have not spoken to recently, whose account may have been previously hijacked.
- After forwarding the code, you find yourself logged out of Telegram.
How to protect yourself
- Never share or forward a Telegram verification SMS code with anyone, regardless of who asks.
- Enable Telegram two-step verification immediately at Settings > Privacy and Security > Two-Step Verification — this password is required even with the SMS code.
- If you receive an unexpected SMS code, do not forward it — your number is being targeted for a takeover attempt.
- If your account was taken over, contact Telegram support at telegram.org/support to begin recovery.
- Alert your contacts if your account was hijacked so they do not fall for the same forwarding request.
- Review active Telegram sessions at Settings > Privacy and Security > Active Sessions and terminate any you do not recognise.
How to report it
- Report the scam to Telegram's support at telegram.org/support.
- Report the attack to your national cybercrime authority: Action Fraud actionfraud.police.uk (UK) or the FTC at ReportFraud.ftc.gov (US).
- Alert the person whose account was used to contact you so they can also recover their account.
- Forward details of the scam to Telegram's spam report at @SpamBot within the app.
Frequently asked questions
Is it ever okay to forward a Telegram code if I trust the person asking?
No — there is no legitimate reason anyone, even a close friend, needs a code sent to your own phone number. Trusting the person is exactly what the scam relies on, since the request usually comes from an account that already belongs to someone you know.
How do I set up Telegram two-step verification if I haven't already?
Go to Settings > Privacy and Security > Two-Step Verification in the Telegram app and create a password. Add a recovery email in the same menu so you can regain access if you ever forget the password yourself.
What should I say to a contact who asks me to forward a code?
Simply decline and tell them you won't forward verification codes, then let them know through a different channel if possible that their account may be compromised. This protects you and may alert them to check their own account security.
If someone has my Telegram verification code and my phone number, can they fully take over my account?
Yes, unless you have enabled two-step verification. With a phone number and its current verification code, an attacker can register your Telegram account on their device. Two-step verification adds a password requirement that they cannot bypass with the SMS code alone.
Why would my actual friend's account be sending me this message?
The message comes from your friend's account because their account was already taken over using the same code-forwarding trick. The attacker is now using your friend's trusted identity to extend the attack to your network.
Can I recover a Telegram account taken over this way?
Yes. You can reclaim the account by using the phone number to request a new login code — this logs out all other sessions including the attacker's. Contact Telegram support at telegram.org/support if you encounter difficulties.