Some services now send their login codes to you inside Telegram instead of by text message. The code arrives in a chat from a verified sender, and no SMS is involved.
It is faster and cheaper for everybody, and it changes where you have learned to expect codes — which is the part worth thinking about.
What you will be able to do
- check_circle Recognise a genuine code message.
- check_circle Tell it from the imitations it invites.
- check_circle Know why a service chose this route.
- check_circle Keep the habit that protects you either way.
The code arrives as a message rather than as a text, with the sender marked.
verified_user A code is still a key
Nothing about the delivery route changes what a verification code is: a temporary key to an account, useful to anybody who has it for the next few minutes. Every rule that applied to codes by text applies here unchanged.
What does change is your expectations. Once codes start arriving in Telegram, a message in Telegram containing a code stops looking unusual — and that is precisely the assumption fraud depends on. The person asking you to forward one now has an easier job than they did last year.
The defence is the same as it has always been and it does not depend on recognising anything: a code you did not just request is a code somebody else is trying to use. Nobody legitimate ever needs you to send one on, read it out, or confirm it in a chat.
Worth knowing why services are moving: sending text messages internationally is expensive and slow, and this route is neither. That means more of them will do it, so the situation is going to become more common rather than less. Treating every code the same way regardless of how it arrives is the habit that survives the change.
Four things to hold onto
The second is the one that ends every version of the attack.
task_alt What it looks like
gavel One sentence
warning Somebody is trying
payments The reason it is spreading
The route changed; the rule did not. Type it where you asked for it, and nowhere else.
settings Handling codes
- Ask for the code yourself Then expect it.
- Type it into the app or site that asked Never into a chat.
- Ignore any message requesting one Regardless of who appears to be asking.
- Treat an unprompted code as an attempt And change that password.
- Turn on two-step verification Everywhere that offers it.
- Apply the same rule to texts and chats The delivery route is irrelevant.
This page is a code arriving by a new route. The curriculum step is the machinery behind logins: how verification is delivered, what each route costs and exposes, and the settings that decide how your own account is confirmed.
At a glance
- 1Codes via Telegram
Some services send login codes in a Telegram message.
- 2Same rule
Enter the code only where you asked for it.
- 3Never share
Nobody legitimate asks you to forward a code.
Updated
