'Telegram Security Center' Texts: Where Real Alerts Arrive

Where real Telegram alerts come from

Notices about your Telegram account arrive inside the app, in a chat named Telegram with a verified check next to its name and "service notifications" under it. That is where login codes, new-login alerts and web login codes appear. A text message that calls itself "Telegram Security Center", "Telegram Account Protection" or similar, and asks you to tap a link or reply with a code, is not from Telegram.

Telegram's FAQ says login codes for your account are sent to "the verified service notifications chat named 'Telegram'" and should never be shared with anyone, "including other services or apps".

The places Telegram actually uses

None of these ask you to visit a website to "secure", "verify" or "unblock" your account. Telegram's code message itself warns you not to give the code to anyone, even someone who says they are from Telegram. A text asking you to send that code somewhere contradicts the warning attached to the code.

If you got a "Security Center" text

1. Don't tap the link. Fake login pages that collect your phone number, login code and Two-Step Verification password are the usual goal.
2. Open the Telegram app yourself and look in the Telegram service chat. If there is no matching notice there, the text did not come from Telegram.
3. Check your signed-in devices and end any you don't recognise; see checking active sessions.
4. Turn on Two-Step Verification if it is off. A stolen code is useless without the password; see turning on Two-Step Verification.
5. Report the text as spam in your phone's messaging app and delete it.

A login code from an unknown number

Telegram runs a peer-to-peer login program in which people using the Telegram for Android app downloaded directly from telegram.org can let their own number send login codes to other users. Its terms say the message contains a code, word or phrase generated by the Telegram app, and that Telegram "cannot prevent the OTP recipient from seeing your phone number". So a genuine login code can arrive from a stranger's personal number.

• If you were logging in just now, enter the code in the app. Don't reply to the sender.
• If you were not logging in, someone tried to log in with your number. Give the code to no one, check your devices, and make sure Two-Step Verification is on.
• If the text contains a link, it is not a peer-to-peer login code. Those carry only the code.

If you entered a code or password on a page from a text, see what to do if an account was hacked.