Code-Phishing Field Guide

The Telegram 'Send Me the Code' Scam: A Code-Phishing Field Guide

‘Send me the code’ is a common way Telegram accounts get taken over: a one-time login code, handed over by the real owner under pressure. Here is every disguise the trick wears, the exact tells, and the one rule that defeats all of them: your login code stays with you, always.

See the code-phishing tells Lock down my own account

Owner-Only

Every step is for recovering or protecting your OWN account, never someone else's.

Official Channels

We only point you to Telegram's own apps, t.me, @SpamBot, and [email protected].

No Code Handling

We never see, request, or store a login code — by rule, not by promise.

Awareness, Not Bypass

Scam tactics are described only to stop them, never to reproduce them.

Cross-check any instruction here against Telegram's official Help pages and your in-app Settings before you act.

What Code-Phishing Claims vs. How Telegram Actually Works

⚑ 'I sent a code to your number by mistake — can you forward it back?'

That code is YOUR login code, triggered the moment before they messaged. Forwarding it signs them into your account. Telegram sends codes only to you, and no real person ever needs yours.

⚑ 'This is the official Telegram Login bot — reply with the code to verify.'

Telegram's service messages arrive from the verified 'Telegram' account (ID 777000), never from a bot, and never ask you to type or forward a code. Any bot requesting a code is the attack.

⚑ 'Vote for my daughter in this contest — just confirm with the code you'll get.'

The 'vote' link opens a cloned login page or fires a code request. The contest is bait; the real target is the login code that signs them in as you.

⚑ 'Sign in here to claim your Telegram Premium or gift.'

The link is a look-alike of t.me or web.telegram.org on a different domain. It captures your phone number and code as you 'sign in,' then hijacks the session.

⚑ 'We can hack or recover any Telegram account — just pay the fee.'

No one can bypass Telegram's login or Two-Step Verification from outside. Such services either phish YOU, take the money, or ask you to code-phish a victim. Real recovery happens only through Telegram's own channels, for your own number.

✓ Telegram sends your login code to you: usually to your other signed-in devices, otherwise by SMS or a call when your login screen offers it. Never to a middleman.

✓ Service messages come from the verified 'Telegram' account (777000); it alerts you to new logins but never asks for a code.

✓ You sign in only inside the official apps or on web.telegram.org / t.me — never on a link a stranger sent you.

✓ Your cloud password (Two-Step Verification) is set only by you at Settings > Privacy and Security > Two-Step Verification, and is never requested in a chat.

✓ Lost access to your OWN number? If any device is still signed in, change the number there (Settings › Phone number); otherwise ask your carrier to restore the SIM. A recovery email only resets a forgotten cloud password. Never pay a third party.

The scam, message by message

A typical code-phishing chat from a contact whose account was already stolen. Every message has one job, and the tag says which.

Anna K.online

hey!! are you there? 🙏

A familiar name: her account is already hijacked

sorry, I sent a code to your number by mistake, can you send it back?

The lie: the code is YOUR login code

Telegram · Login code: 41927. Do not give this code to anyone, even if they say they are from Telegram!

quick please, it expires in a minute. and don’t tell anyone

Urgency plus secrecy

41927

Not sending any code. I’ll call you.

Right move: refuse, then check another way

If you already sent it

On a device signed in for more than a day, open Settings › Devices and end every session you don’t recognise.
Set a cloud password (Two-Step Verification) so the code alone can’t get them in again.
Warn your friend by phone or in person: their account is the one sending these messages.
Not sure it reached them? Run the hacked-account triage anyway. It takes five minutes.

We do

✓ Explain the exact code-phishing tricks so you can recognize and refuse them
✓ Guide you to Telegram's own login-code, recovery-email, and reset paths for YOUR number
✓ Show how to review and end logins at Settings > Devices / Active Sessions
✓ Point you to @SpamBot for limits and [email protected] for account appeals
✓ Help you harden your account with Two-Step Verification and a recovery email

We never

✗ Ask for, receive, intercept, or forward anyone's login code — including yours
✗ Bypass, 'remove,' or reset a Two-Step Verification cloud password
✗ Access, read, or monitor any account or chats that are not your own
✗ Sell 'hack any account' services or intercept SMS / OTP codes
✗ Guarantee recovery of a deleted or self-destructed account, or promise a timeline

Everything here serves one person: the owner of the account, protecting or recovering their OWN Telegram through Telegram’s official channels. A login code is never shared, forwarded or read aloud, and is entered only into a login you started yourself in the official app or on web.telegram.org. We will never ask for it, and neither does any legitimate person, bot or website.

The vocabulary of a code-phishing attack — know the words, spot the trap.

Login code: The one-time code Telegram sends to sign a device in, usually to your other signed-in devices, otherwise by SMS or call. Yours alone; never share it.
Code-phishing: Tricking you into revealing or forwarding your login code so an attacker can sign in as you.
Cloud password (2FA): Optional Two-Step Verification password set at Settings > Privacy and Security. A second lock the login code alone can't open.
Recovery email: The optional address tied to your cloud password; its hint appears on the password screen and can reset 2FA.
Active Sessions: Settings > Devices — every place your account is signed in; end any you don't recognize.
Account reset: The last-resort option on the password screen when you are signed out with no recovery email. It DELETES the account and its cloud chats, sometimes after a wait, sometimes straight away. It is not recovery.
777000: The number / ID of the official 'Telegram' service account that sends codes and login alerts — and never asks for them.

FAQ

Can you get me the login code for someone else's Telegram, or help me recover an account that isn't mine?

No, and no legitimate service can. Obtaining, intercepting, or asking for someone's login code IS the account-takeover method this page exists to stop. We only ever help the owner of an account protect or recover their OWN Telegram, through Telegram's official channels for their own phone number. A login code is never shared, forwarded, or entered for anyone — we will never ask for it, and neither does any real person, bot, or website.

A friend messaged saying they accidentally sent a code to my number and need me to forward it. Is that safe?

No — that is the classic 'send me the code' scam, and it's almost always sent from a friend's already-hijacked account. The code that just arrived is YOUR login code, triggered by an attacker trying to sign in as you. Forwarding it hands them your account. Don't send it. Reach your friend another way to warn them their account is compromised, and check your own Active Sessions at Settings > Devices.

How do I know a login code is really from Telegram and not a scam?

Codes come from the official ‘Telegram’ service account in your other signed-in apps, or by SMS, call or email when your login screen offers it. The source doesn’t change the rule: you never type it into a link someone sent you, read it aloud, or forward it. Telegram never asks you to give a code back; it only expects you to enter it into the login you started yourself.

I clicked a t.me look-alike page and entered my number and code. What now?

Act fast. On a device signed in for more than a day, open Telegram > Settings > Devices and terminate any session you don’t recognise. If you use Two-Step Verification, the attacker still needs your cloud password; change it at Settings > Privacy and Security > Two-Step Verification. If you have lost access to your own number, change it from any device that is still signed in, or ask your carrier to restore the SIM, then follow our account-recovery guide.

What's the difference between the login code and the cloud password?

The login code is a one-time code Telegram sends every time a device signs in, usually to your other signed-in devices first, otherwise by the options the login screen offers. The cloud password (Two-Step Verification) is an optional, permanent password you set yourself: a second lock. Even if a scammer phishes your login code, they still can’t get in without your cloud password. Setting one is the single strongest defense against this scam.

A bot says it's 'Telegram Login' and needs me to confirm with my code. Is it legit?

No. Telegram does not run a bot that asks for your login code, and its real service messages never request one. Any bot, channel, or contact asking you to enter or forward a code is running a phishing attack. Block and report it, and never send the code.

Topic

Hacked & suspicious logins

Account hackedSomeone else is in, or changed your number or passwordStart here New login detectedTelegram warned you about a sign-in Active sessions & devicesSee and end every logged-in device

“Send me the code” scamSomeone asked you to share a login codeYou are here

All recovery routes

The One Rule That Ends Every Version of This Scam

Code-phishing wears a hundred disguises: the panicked friend, the fake login bot, the cloned t.me page, the vote-for-my-kid link. One defense beats all of them: a login code is never shared, forwarded or read aloud, and is entered only into a login you started yourself. We will never ask for it, and neither does any legitimate person, bot or website. If someone wants your code, that someone is the attack. To protect or recover your own account, use Telegram’s official channels, starting with a cloud password.

Set up Two-Step Verification