TgHacker
Sign In Sign Up
Recovery hub Hacked account Login code Password & 2FA Blocked or limited
Sign InSign Up
Telegram security · defensive hardening

Telegram SIM-Swap Protection: Lock Your Number Before an Attacker Ports It

A SIM-swap moves your phone number onto an attacker's SIM so they can catch the SMS login code Telegram would send you. Here is why that alone no longer gets them in — and the two-minute cloud-password setup that seals the door. Strictly defensive, for the number in your own hand.

See the hardening stepsSet up Two-Step Verification
Owner-only, always
Every step assumes the number and account are yours; we never act on a third party's.
No code ever leaves you
We never ask for, store, or relay a Telegram login code — yours or anyone's.
Nothing to retain
This is guidance, not an account link — we hold no credentials, sessions, or codes.
Official channels only
Paths point to the Telegram apps, t.me, @SpamBot, and [email protected].
Defense, not bypass
We help you strengthen a cloud password; we never remove or bypass one.

You can confirm every path yourself in Settings > Privacy and Security — we introduce no third-party tool or login.

A SIM-swap, link by link, and where you cut it

A takeover through your number is a chain. You don’t need to stop every link, just one that comes before your account.

  1. 1
    Your number is moved to another SIMUsually by talking a carrier into a “replacement SIM” or a port-out.
    You can cut it here

    Ask your carrier about BOTH protections: one for SIM replacement and one for porting out. They are separate operations, and a lock on one may not cover the other. Either makes the move harder, not impossible.

  2. 2
    They ask Telegram for a login codeThey type your number on a new device and ask for the code by SMS or call.
    Not a defence

    Codes usually go to your signed-in devices first, but the login screen can offer SMS or a call, and that now rings their SIM. Delivery order is not a lock.

  3. 3
    They enter the codeThe code proves they hold the number. Without a cloud password, they are in.
    You can cut it here

    With Two-Step Verification on, Telegram asks for your cloud password next. They don’t have it, and the number can’t produce it.

  4. 4
    They try “Forgot password”The recovery code goes to your recovery email, not to the phone.
    You can cut it here

    A recovery mailbox with its own 2FA keeps this door shut. If they can read that inbox, they can reset the password, so guard it like the account.

  5. 5
    They request an account resetWithout the password, the last thing they can try is to have the account deleted.
    You can cancel it

    Telegram may notify your signed-in devices and hold the request for a while, but not always: in some cases deletion is immediate. Cancelling also asks you to confirm the phone number, which the attacker may now control. So the real fix is upstream: get your number back from the carrier fast.

Your number can still be stolen. A cloud password stops the code alone from signing anyone in; getting the number back from your carrier quickly closes the deletion route too.

Defence only: this describes what an attacker needs so you can deny it, not how to do any of it.

Harden your number in six steps

  1. 1
    Set a cloud password (Two-Step Verification)
    In Settings > Privacy and Security > Two-Step Verification, create a cloud password Telegram will demand on any new device AFTER the login code.
    ⏱ 3–5 minutes · The Two-Step Verification screen shows 'On', and a fresh login is stopped at a password prompt even when the code is entered.
  2. 2
    Attach a recovery email to that password
    On the same screen add a recovery email, so a forgotten cloud password can be reset by you — the masked hint appears on the password-entry screen.
    ⏱ 2–3 minutes · Telegram sends a confirmation code to the address; once you enter it, a masked hint of the address appears under the password field.
  3. 3
    Keep a trusted in-app session alive
    In Settings › Devices, make sure at least one device you hold stays signed in, ideally for more than 24 hours. It is where Telegram’s service messages reach you, and an older session can terminate any new one.
    ⏱ 2–4 minutes · Settings > Devices lists your current device as active with a recent 'last active' timestamp and no sessions you don't recognise.
  4. 4
    Lock your number with your carrier
    Ask your mobile carrier what protects your line against BOTH a SIM replacement and a port-out (a port-out PIN, number lock, port-freeze or SIM-change protection). It makes moving your number harder, not impossible.
    ⏱ 10–30 minutes (carrier call or app) · The carrier confirms a port-out PIN or 'number lock / SIM protection' is now active on your line.
  5. 5
    Stop treating SMS as your only key
    A ported number can receive your SMS code, so the code is not the lock. Once a cloud password guards the account, the code alone signs nobody in.
    ⏱ About 5 minutes to review · You can explain why the cloud password, not the SMS code, is the real lock on your account.
  6. 6
    Re-check the posture periodically
    Every few months revisit Settings > Devices and Two-Step Verification; terminate sessions you don't recognise and confirm the recovery email still reaches you.
    ⏱ 5 minutes, recurring · Devices shows only sessions you recognise, and the cloud password remains 'On' with a live recovery email.

None of these steps run on a countdown; hardening is done while you control the account, not during an incident. If a takeover is already underway, don’t harden: follow the hacked-account recovery route.

Hard limits — what this page will never do

⛔ We never explain or perform a SIM-swap against any number.
The port-out itself is the takeover method — describing it as a recipe would hand an attacker the keys, not protect a victim.
→ Harden your own line: ask your carrier for a port-freeze, number-lock, or port-out PIN.
⛔ We never obtain, intercept, or ask for a login code.
A Telegram login code is single-use account access — getting anyone's is the takeover, and 'send me the code' is exactly the scam we warn against.
→ Receive your own code in-app on a device you already hold; never forward it to anyone.
⛔ We never bypass, 'remove', or crack a cloud password / 2FA.
The cloud password is the very wall that stops a SIM-swap; a bypass tool would defeat the defense this page exists to teach.
→ Reset your OWN password with “Forgot password” and your recovery email, or from a device that is still signed in.
⛔ We never help with a number or account you don't own.
This is prevention for the phone in your own hand; touching someone else's account is unauthorised access, full stop.
→ The account holder performs these steps themselves, from their own device and their own carrier.
⛔ We never coach carrier social-engineering.
Impersonating a subscriber to a mobile operator to move a number is fraud — the criminal half of a SIM-swap.
→ Contact your OWN carrier through their verified app or hotline to add a port lock to your line.

FAQ

Can a SIM-swap really take over my Telegram even if I have a strong SIM PIN?
It can, if a cloud password isn’t set. A ported number lets the attacker receive the SMS or call that the login screen offers, so the code alone is no protection. What stops them is the next step: with Two-Step Verification on (Settings › Privacy and Security › Two-Step Verification), Telegram asks for your cloud password after the code, and a ported SIM can’t produce it. A carrier port-out PIN or number lock makes the port itself harder; together they close both ends.
Can you SIM-swap a number for me, or pull the login code so I can get into an account?
No — and this is a firm line, not a technicality. We never perform or explain a SIM-swap, never intercept SMS or OTP, and never obtain or ask for anyone's login code, because those are the exact methods used to steal a Telegram account. This page exists only to help you protect the number and account in your own hand. If it's your own account, everything you need runs through the official Telegram app and your own carrier; if it isn't yours, the only correct path is for the real owner to do it from their own device.
If someone ports my number, do they instantly get all my messages?
Not if a cloud password is set. The ported number gets them a login code, and Telegram then asks for the cloud password they don’t have, so the login doesn’t complete and your cloud chats stay where they are. What they may still try is an account reset; that is why getting the number back from your carrier fast matters. Without a cloud password, the code alone would let them in, which is why Two-Step Verification is the step to take today.
What's the difference between the login code and the cloud password?
The login code is a one-time code Telegram sends to sign a new device in, usually to your signed-in devices, otherwise by SMS, a call or email as the login screen offers. Because it can reach your SIM, it is what a SIM-swap targets. The cloud password (Two-Step Verification) is a secret you set yourself; it is never sent by SMS and doesn’t travel with your number, so a ported SIM can’t reproduce it. The code proves you hold the number; the password proves you’re you. Only the password survives a SIM-swap.
I forgot my cloud password — can it just be removed?
Not by us or anyone else, because a removable 2FA wall would be no wall at all. On your own account you have official options: “Forgot password” sends a recovery code to your recovery email; a device that is still signed in can reset the password after a wait and keeps the account. With neither, only the account reset is left. The account reset deletes the account and its cloud chats. Depending on the account, Telegram either makes you wait or deletes it straight away; follow what the screen shows. We never bypass a cloud password for you or for anyone else.
Does calling my carrier actually help against a SIM-swap?
Yes, it reduces the risk at its source. Ask your carrier specifically about two things: protection against a SIM replacement in a store or call, and protection against porting your number to another carrier (a port-out PIN, number lock or port-freeze). They are separate, and a lock on one may not cover the other. None makes a move impossible, which is why we pair it with a cloud password: the carrier lock makes the move harder, and the cloud password means the login code alone can’t open your Telegram account.

Topic

Protect your account

Security CenterHarden the account before anything happensStart hereSet up Two-Step VerificationAdd a cloud password in two minutes
SIM-swap protectionStop a number port from becoming a takeoverYou are here
Monitor your own accountWatch your own account for intrusions

All recovery routes

Lock the number before anyone tries to move it

SIM-swap protection isn’t a tool you buy: it’s a cloud password only you know, a recovery inbox with its own 2FA, a device you keep signed in, and a port lock on your carrier account. Set them up while the account is calm and a ported number becomes a dead end. If you’re already locked out, don’t harden: follow the hacked-account route. Either way, we only ever help with the account in your own hands.

Set up your cloud password
We use cookies.
We use cookies to collect data to improve your experience on our website. Read our usage policy cookies You can your preferences at any time.