What Code-Phishing Claims vs. How Telegram Actually Works
⚑ 'I sent a code to your number by mistake — can you forward it back?'
That code is YOUR login code, triggered the moment before they messaged. Forwarding it signs them into your account. Telegram sends codes only to you, and no real person ever needs yours.
⚑ 'This is the official Telegram Login bot — reply with the code to verify.'
Telegram's service messages arrive from the verified 'Telegram' account (ID 777000), never from a bot, and never ask you to type or forward a code. Any bot requesting a code is the attack.
⚑ 'Vote for my daughter in this contest — just confirm with the code you'll get.'
The 'vote' link opens a cloned login page or fires a code request. The contest is bait; the real target is the login code that signs them in as you.
⚑ 'Sign in here to claim your Telegram Premium or gift.'
The link is a look-alike of t.me or web.telegram.org on a different domain. It captures your phone number and code as you 'sign in,' then hijacks the session.
⚑ 'We can hack or recover any Telegram account — just pay the fee.'
No one can bypass Telegram's login or Two-Step Verification from outside. Such services either phish YOU, take the money, or ask you to code-phish a victim. Real recovery happens only through Telegram's own channels, for your own number.
✓ Telegram delivers your login code to your existing signed-in app FIRST, then by SMS, then by voice call — always to you, never to a middleman.
✓ Service messages come from the verified 'Telegram' account (777000); it alerts you to new logins but never asks for a code.
✓ You sign in only inside the official apps or on web.telegram.org / t.me — never on a link a stranger sent you.
✓ Your cloud password (Two-Step Verification) is set only by you at Settings > Privacy and Security > Two-Step Verification, and is never requested in a chat.
✓ Locked out of your OWN number? You recover through Telegram itself — the in-app code, your recovery email, or [email protected] — not a paid third party.
We do
- ✓ Explain the exact code-phishing tricks so you can recognize and refuse them
- ✓ Guide you to Telegram's own login-code, recovery-email, and reset paths for YOUR number
- ✓ Show how to review and end logins at Settings > Devices / Active Sessions
- ✓ Point you to @SpamBot for limits and [email protected] for account appeals
- ✓ Help you harden your account with Two-Step Verification and a recovery email
We never
- ✗ Ask for, receive, intercept, or forward anyone's login code — including yours
- ✗ Bypass, 'remove,' or reset a Two-Step Verification cloud password
- ✗ Access, read, or monitor any account or chats that are not your own
- ✗ Sell 'hack any account' services or intercept SMS / OTP codes
- ✗ Guarantee recovery of a deleted or self-destructed account, or promise a timeline
Everything here serves one person: the owner of the account, protecting or recovering their OWN Telegram through Telegram's official channels. A login code is never shared, forwarded, read aloud, or entered on any site or for any person — we will never ask for it, and neither does any legitimate person, bot, or website.
FAQ
Can you get me the login code for someone else's Telegram, or help me recover an account that isn't mine?
No, and no legitimate service can. Obtaining, intercepting, or asking for someone's login code IS the account-takeover method this page exists to stop. We only ever help the owner of an account protect or recover their OWN Telegram, through Telegram's official channels for their own phone number. A login code is never shared, forwarded, or entered for anyone — we will never ask for it, and neither does any real person, bot, or website.
A friend messaged saying they accidentally sent a code to my number and need me to forward it. Is that safe?
No — that is the classic 'send me the code' scam, and it's almost always sent from a friend's already-hijacked account. The code that just arrived is YOUR login code, triggered by an attacker trying to sign in as you. Forwarding it hands them your account. Don't send it. Reach your friend another way to warn them their account is compromised, and check your own Active Sessions at Settings > Devices.
How do I know a login code is really from Telegram and not a scam?
Codes always come from the official 'Telegram' service account (ID 777000) or by SMS / call from Telegram. But the source doesn't change the rule: whoever sent it, you never type it into a link, read it aloud, or forward it. Telegram never asks you to give a code back — it only expects you to enter it into the login screen of the official app you are signing into yourself.
I clicked a t.me look-alike page and entered my number and code. What now?
Act fast. Open Telegram > Settings > Devices / Active Sessions and terminate any session you don't recognize. If you use Two-Step Verification, the attacker still needs your cloud password — change it at Settings > Privacy and Security > Two-Step Verification. If you're locked out of your own number, use your recovery email or write to
[email protected], then follow our account-recovery guide.
What's the difference between the login code and the cloud password?
The login code is a one-time code Telegram sends every time a device signs in — to your existing app first, then SMS, then call. The cloud password (Two-Step Verification) is an optional, permanent password you set yourself: a second lock. Even if a scammer phishes your login code, they still can't get in without your cloud password. Setting one is the single strongest defense against this scam.
A bot says it's 'Telegram Login' and needs me to confirm with my code. Is it legit?
No. Telegram does not run a bot that asks for your login code, and its real service messages never request one. Any bot, channel, or contact asking you to enter or forward a code is running a phishing attack. Block and report it, and never send the code.
The One Rule That Ends Every Version of This Scam
Code-phishing wears a hundred disguises — the panicked friend, the fake login bot, the cloned t.me page, the vote-for-my-kid link — but one defense beats all of them: a login code is never shared, forwarded, read aloud, or entered on any site or for any person. We will never ask for it, and neither does any legitimate person, bot, or website. If someone wants your code, that someone is the attack. And if it's your own account you need to protect or recover, do it through Telegram's official channels — starting with a cloud password.
Set up Two-Step Verification