Hi everyone. I want to share a frustrating and eye-opening experience I just went through — not to complain, but to warn others and maybe even spark a conversation about a serious security flaw in Telegram.
A week ago, I tried to log into Telegram… and was asked for a "cloud password" — something I never set up.
That’s when it hit me: someone had accessed my account and enabled two-factor authentication (2FA) with their own password, locking me out completely.
At first, I was confused: "How is that even possible? Doesn’t Telegram require an SMS code to log in?"
Yes — to log in, you absolutely need an SMS sent to your phone number. That part works.
But here’s the critical issue:
This means that if a scammer gains even temporary access to your account — maybe you entered a login code on a phishing site, left your phone unlocked, or missed a session alert — they can:
And the worst part? They don’t need your phone or SIM card. They just need one moment of access.
Compare this to Google, Apple, or even WhatsApp:
— Any security change (like enabling 2FA) requires additional verification — SMS, email, or biometrics.
— In Telegram? Nothing. Just tap a few buttons, and suddenly you’re the intruder.
My only option: initiate a full account reset — a 7-day waiting period that deletes all data permanently.
The consequences:
And here’s the kicker: I never lost access to my phone number.
No SIM swap. No missed SMS. My number was always under my control.
Yet I still lost my account — because Telegram doesn’t protect the 2FA setup process itself.
I’m now waiting for the 7-day reset to finish. Soon, I’ll log back in — but to an empty account.
I hope my story helps someone avoid this nightmare.
Don’t assume “it won’t happen to me.” Hackers don’t need your phone — they just need one slip-up… and Telegram’s current design makes the damage irreversible.
Stay safe,
— A regular user who learned the hard way.
A week ago, I tried to log into Telegram… and was asked for a "cloud password" — something I never set up.
That’s when it hit me: someone had accessed my account and enabled two-factor authentication (2FA) with their own password, locking me out completely.
At first, I was confused: "How is that even possible? Doesn’t Telegram require an SMS code to log in?"
Yes — to log in, you absolutely need an SMS sent to your phone number. That part works.
But here’s the critical issue:
This means that if a scammer gains even temporary access to your account — maybe you entered a login code on a phishing site, left your phone unlocked, or missed a session alert — they can:
- Go to Settings,
- Enable Two-Step Verification,
- Set their own recovery email (or leave it blank),
- And permanently lock you out of your own account.
And the worst part? They don’t need your phone or SIM card. They just need one moment of access.
Compare this to Google, Apple, or even WhatsApp:
— Any security change (like enabling 2FA) requires additional verification — SMS, email, or biometrics.
— In Telegram? Nothing. Just tap a few buttons, and suddenly you’re the intruder.
What did I have to do?
Since the attacker didn’t use my email (and I never set one up for 2FA), I had no way to recover my account without losing everything.My only option: initiate a full account reset — a 7-day waiting period that deletes all data permanently.
The consequences:
- All chats, photos, documents — gone forever.
- My custom username — released immediately and likely already taken.
- My contacts won’t find me unless I tell them my new details.
And here’s the kicker: I never lost access to my phone number.
No SIM swap. No missed SMS. My number was always under my control.
Yet I still lost my account — because Telegram doesn’t protect the 2FA setup process itself.
My advice to you:
- Go to Telegram NOW:
Settings → Privacy & Security → Two-Step Verification
→ Set a strong password and add a recovery email you actually control. - Check active sessions:
Settings → Devices → log out anything suspicious. - To Telegram’s team (if you’re reading this):
Please consider adding mandatory SMS or email confirmation when a user enables or changes 2FA.
This isn’t about convenience — it’s about preventing exactly what happened to me.
I’m now waiting for the 7-day reset to finish. Soon, I’ll log back in — but to an empty account.
I hope my story helps someone avoid this nightmare.
Don’t assume “it won’t happen to me.” Hackers don’t need your phone — they just need one slip-up… and Telegram’s current design makes the damage irreversible.
Stay safe,
— A regular user who learned the hard way.
