Telegram is a messenger used by millions of people to communicate, share information, and run businesses.
Although Telegram offers a convenient and feature-rich communication service, it is important to understand the technical risks involved in using it. Using it without proper security measures, such as two-factor authentication, regular software updates, and caution when sharing information, increases the potential threats.
Losing access to your account can have serious consequences. In this article, we look at the main risks of losing an account and the steps to recover access or delete the account if it has been hacked.
Technical Vulnerabilities of Telegram
Server-Side Data Storage
Centralized storage: Telegram stores messages, contacts, and other information on its servers. This makes the data vulnerable to attacks and compromise from both outside and inside.
Data leaks: If an attack on the servers succeeds, attackers may gain access to sensitive data such as message history or user information.
Russian traces in Telegram: We do not rule out that Russian intelligence services have access to Telegram’s servers and can analyze the collected information both to run disinformation campaigns and to gather critical information as part of the war.
Software Vulnerabilities
Code errors: Like any software, Telegram’s server side may contain vulnerabilities that attackers can exploit to access the system or steal data.
Unsecured APIs: Using APIs for communication between clients and servers can create entry points for attacks if proper security measures are not in place.
Encryption and Security
Encryption issues: Although Telegram uses MTProto encryption, not all chats are end-to-end encrypted. This means the data may be available on the servers, and attackers with server access could view it. The possibility of employees themselves passing data to third parties also cannot be ruled out.
Regulatory Issues
Lack of oversight: Telegram is registered outside Ukraine, which makes it harder to oversee its activities and ensure compliance with local data protection laws.
International jurisdiction: Data leaks or misuse can be difficult to investigate because of international legal issues.
Accountability: The absence of obligations under local laws may lead to inadequate data protection.
Lack of Moderation
Telegram positions itself as a platform for free speech. This means its administrators do not interfere with published content, except in cases that violate its terms of service.
Harmful content: Inappropriate, extremist, or even illegal content can spread in public groups and channels. Due to the lack of moderation, such materials may remain untouched for a long time.
Lack of accountability: Channel and group administrators may not be held responsible for published content, since Telegram does not control message content.
No account verification: Anyone can clone your account and impersonate you to obtain money by deceiving your family and friends.
Use of bots: Users can create bots to automate content, which makes moderation even more difficult. This can lead to the spread of spam and harmful materials.
Lack of Censorship
Telegram has become an important tool for political activists, journalists, and human rights groups. The lack of censorship allows them to share information freely and organize protests. There is, however, another side: the uncontrolled spread of disinformation and psychological operations. Disinformation can undermine trust in reliable sources of information and make the struggle for justice harder.
As a result, Telegram has become an arena both for the defense of human rights and for information conflicts, where critical thinking is essential.
The Threat of Disinformation
Spread of fake news: The lack of censorship can lead to the widespread distribution of disinformation, which poses risks to society. During political crises, for example, fake news can influence public opinion.
User anonymity: Users can spread false information anonymously and without consequences, which makes fact-checking harder.
Use in military conflicts: Telegram is actively used in conflict zones for organization and communication. The lack of censorship allows information to be shared quickly, but it can also be used for propaganda.
Types of Phishing on Telegram
Phishing via Fake Bots
Scammers create fake bots that claim to represent popular services such as banks or delivery companies. They ask users to enter their data to “verify” their accounts.
Example: In 2022, a bot appeared that posed as the support service of a Ukrainian bank. Users received messages about suspicious transactions and followed a link to the bot, where they were asked to enter their login and password.
Prize Phishing
Scammers use giveaways that promise prizes to lure people in. Users receive a message saying they have won a prize and must provide personal data to claim it.
Example: In 2023, a scheme emerged that promised users free smartphones in exchange for filling out a form. Many people fell into the trap and gave away their personal data.
Social Engineering Phishing
Scammers use psychological tricks to make victims do what they want. They may pose as friends or colleagues and ask for an urgent money transfer or personal information.
Example: In 2023, messages appeared in which scammers posed as users’ acquaintances and claimed their account had been hacked. They asked for money to be transferred to a “new account.”
Phishing via Fake Websites
Scammers create fake websites that copy real services. Users reach these sites through links in Telegram messages and are asked to enter personal information.
Example: In 2022, several Ukrainian entrepreneurs fell victim to phishing sites that imitated online trading platforms. After they entered their data, their accounts were hacked.
Phishing via Account Takeover
Scammers use stolen information to hack other users’ accounts and then send phishing messages to the victim’s contacts.
Example: In 2023, several cases were recorded in which hacked accounts were used to send “business opportunity” messages offering investments that turned out to be fraudulent.
Voting Phishing
Attackers create fake polls and petitions. Users follow a link where, in order to vote, they are asked to enter logins and passwords or other account or personal data.
Example: In 2024, many Ukrainians fell victim to this scheme. Exploiting the realities of the war, attackers created numerous fake petitions to posthumously award fallen soldiers the title of Hero. Later, following the same pattern, fake votes for children in various contests began to appear.
We analyzed several of these voting links. When the link is opened, malware is automatically downloaded to the device. The image in this article shows indicators of malware installation through remote processes.
Risks and Consequences of Losing an Account
A Telegram hack can happen through various mechanisms that mainly affect user accounts and their data rather than the devices themselves. However, if malware is involved or vulnerabilities are exploited at the operating system level, the consequences can be more serious.
Compromise of personal information: A hacked account can become a source of personal data that attackers may use for fraud or blackmail.
Reputational damage: If an attacker starts spreading false information in your name, it can harm your reputation.
Loss of important contacts: An account hack can lead to losing access to important chats, groups, or contacts.
Financial costs: In case of fraud, you may need to spend money to cover losses or recover data.
Time costs: Recovering access or deleting an account can take a lot of time and effort.
Recovering Access to Your Account
If you believe your account has been hacked, follow these steps:
Reset your password:
- Open Telegram and tap “Forgot password?”
- Follow the instructions to reset your password via email or SMS. Before doing so, make sure the attackers have not changed the email address or phone number linked to the account.
Check your security settings:
- Review your security settings, including two-factor authentication. Turn this feature on if it is not active.
Report the hack:
- If you believe your account has been hacked, report it to Telegram Support.
Review active sessions:
- Go to Telegram settings and review your active sessions. Terminate all suspicious sessions.
If someone has started a parallel session on your account, the main mobile number you registered with will remain linked to it. This means you can still receive login codes on that number and have a chance to use them to recover access. For this reason, make sure the phone number in your Telegram account is current and one you have access to.
Telegram settings include a Devices tab that lists all the devices that have connected to the messenger. To recover access, terminate all active sessions in this tab. Then make sure you remember your two-factor authentication password, log out of the session on your current device, and log back into the messenger. These steps will help you cut off the stolen session and regain control of your account.
There are also cases when SIM cards are cloned or intercepted, and the recovery code does not arrive on your number. In this case, keep trying to log in, and as soon as you succeed, change your two-factor authentication password. Sometimes, however, fully recovering an account is quite difficult. If it does not work, you will need to delete the account and, if necessary, create a new one.
Deleting Your Account
If you have decided that your account cannot be recovered, or if you no longer want to use Telegram, you can delete your account:
Go to the Telegram website:
- Visit the Telegram account deletion page.
Enter your phone number:
- Enter the phone number linked to your account and confirm the deletion.
Choose the deletion option:
- Select the account deletion option and confirm your decision.
Losing access to a Telegram account can have serious consequences. It is important to take timely steps to protect your account, use strong passwords, and enable two-factor authentication. It is also best not to store or share sensitive information in the messenger.
If your account is hacked, act quickly to recover access or delete the account to minimize the risks. Keep your data safe and stay cautious when using Telegram.
