WhatsApp or Telegram Account Hacked? How to Recover It and Lock It Down

What should you do if your WhatsApp account is hacked?

WhatsApp's help centre gives one recovery route for a compromised account, provided you still have the SIM card for your number ^[1]:

1. Open WhatsApp and tap Log back in, then Continue. If prompted, enter your full international phone number ^[1].
2. Enter the 6-digit code you receive by SMS or phone call. When you re-register with this code, all devices logged into your account are automatically logged out ^[1].
3. If you are asked for a two-step verification PIN you do not know, the intruder may have set one. WhatsApp says to wait 7 days and try again; anyone using your account is still logged out once you enter the SMS code ^[1].
4. Tell family and friends, because the intruder could impersonate you in chats and groups ^[1].
5. Once back in, turn on security features and review the devices linked to your account ^[1].

What does not work?

Changing your password will not remove someone else from your account; WhatsApp says passwords and two-step verification protect an account you still have access to, and re-registering with the 6-digit code is the only way to remove an intruder ^[1]. WhatsApp also warns that if you report the compromised account you are trying to recover, it might ban it and you could lose access, so it recommends recovering first ^[1].

Can the intruder read my old chats?

According to WhatsApp, messages are end-to-end encrypted and stored on your device, so someone who re-registers your account on a new device cannot read your past conversations ^[1]. They can, however, receive new messages and write to your contacts while they control the account.

How do WhatsApp and Telegram accounts get taken over?

The takeover methods described by fraud agencies and security researchers below do not break encryption. They trick the owner, or the owner's mobile carrier, into handing over the means to log in ^[7][8][9].

The 'I sent you my code by mistake' scam

Action Fraud, the UK's national fraud reporting centre, described the pattern in 2023: a criminal first takes over a WhatsApp account that has you as a contact, then messages you while posing as your friend ^[7]. At the same time you receive a WhatsApp text with a six-digit code, because the criminal is trying to log in with your number; they claim they sent the code to you by accident and ask you to pass it on ^[7]. Once they have it, they log in and lock you out, then repeat the trick on your contacts ^[7]. At the time, Action Fraud had received over 60 reports of this scam ^[7].

SIM swapping

In SIM swapping, criminals persuade or bribe a mobile carrier to move your number to a SIM card they hold, after which your calls and texts, including one-time codes, go to their device ^[9]. The FBI's Internet Crime Complaint Center received 1,611 SIM-swapping complaints in 2021, with adjusted losses of more than 68 million US dollars ^[9].

Malicious QR codes and linked devices

Both apps let you use your account on computers and other devices. In November 2024, Microsoft observed a Russian state-linked group it calls Star Blizzard emailing targets an invitation to a WhatsApp group; the QR code on the landing page actually linked the victim's account to a device controlled by the attackers, letting them read and export messages through WhatsApp Web ^[8]. Microsoft said the campaign was limited and appeared to end at the end of November 2024 ^[8].

Other routes

WhatsApp advises setting a hard-to-guess voicemail password so no one can access your voicemail, and not clicking links in unrequested emails containing a registration code, which may mean someone is trying to register your number ^[2]. Telegram warns users to treat any bot as a stranger and never give it passwords or Telegram codes ^[6].

How do you recover a hacked Telegram account?

Telegram says the phone number is currently the only way it identifies a user: whoever has the number has the account, and it cannot help unless you have access to the number or to Telegram on one of your devices ^[6]. Its advice for a stolen phone is the best guide for any takeover ^[6]:

1. If you are still logged in on another device: go to Settings, then Privacy and Security, and turn on Two-Step Verification, so the phone number alone is no longer enough to log in ^[6].
2. Go to Settings, then Devices (or Privacy and Security, then Active Sessions), and terminate the session you do not recognise. Without your password, that device cannot log in again ^[6].
3. If you have no access on any device: contact your phone provider to block the old SIM and issue a new one with your number, then log in and terminate the unknown sessions ^[6].

If someone is pretending to be you on Telegram, the FAQ says to contact @NoToScam ^[6]. Login codes for Telegram itself arrive in the verified service chat named 'Telegram' and should never be shared with anyone, including other services or apps ^[6].

What is at risk on Telegram?

Telegram keeps cloud chats so you can reach them from any device, and they sync instantly to every device you log in on ^[6]. Cloud chats use server-client encryption, while secret chats add end-to-end encryption, are not part of the Telegram cloud and can only be accessed on their devices of origin ^[6]. In practice, then, a session an intruder opens can see your cloud chats but not your secret chats, which is why terminating unknown sessions quickly matters.

Which settings protect WhatsApp and Telegram accounts?

Both apps offer layers that make a stolen code or phone number insufficient on its own. WhatsApp stresses that these features work only on an account you can still access; they cannot restore lost access or remove someone who is already in ^[2].

• Two-step verification. On WhatsApp, go to Settings, Account, Two-step verification, turn it on, create a strong password and optionally add an email address ^[3]. WhatsApp notes that it is upgrading the 6-digit PIN used in two-step verification to a password ^[3]. On Telegram, 2-Step Verification is under Settings, Privacy and Security; once on, you need both an SMS code and a password to log in ^[6].
• Recovery email. WhatsApp says an email added at registration lets you recover the account without SMS or a phone call ^[2]. Telegram lets you set a recovery email for a forgotten password and advises protecting that email account with a strong password and 2-step verification too ^[6].
• Passkeys. A passkey is a login method tied to your device's screen lock, fingerprint or face. WhatsApp links your account to your device's security system when you set one up ^[4]. Telegram says passkeys are more secure than SMS codes and can be backed up in a password manager such as iCloud Keychain or Google Password Manager ^[6].
• App and chat locks. WhatsApp offers app lock and chat lock ^[2]; Telegram recommends a passcode to lock the app ^[6].
• High-risk options. WhatsApp's strict account settings apply its strictest privacy and security controls and are meant for people who believe they may be targeted ^[2]. Telegram recommends secret chats in official or verifiable open-source apps for people worried about their personal security ^[6].

How do you check linked devices and active sessions?

A linked device or session that you do not recognise is a common sign of takeover, and the QR-code attack described above works entirely through one ^[8].

• WhatsApp: open the menu, tap Linked Devices to review all devices, then tap a device and Log Out to remove it ^[2]. WhatsApp says it is important to check linked devices regularly, and that you can log out of all WhatsApp Web sessions from your phone ^[5].
• WhatsApp Web: before scanning the QR code, you can untick 'Stay logged in on this browser' so the session ends when you close the tab or browser ^[5].
• Telegram: Settings, then Devices (or Privacy and Security, then Active Sessions), lists sessions you can terminate ^[6]. Passkeys can be reviewed under Settings, Privacy and Security, Passkeys, with their creation date and last use ^[6].

Only scan a WhatsApp or Telegram QR code from the official app or website you opened yourself. A QR code sent in an email or message as a way to 'join a group' deserves the same suspicion as a link; Microsoft's advice for such emails is to contact the supposed sender using a known, previously used address ^[8].

WhatsApp adds that it cannot tell you who accessed your account or when and where it was accessed ^[5].

Why are passkeys and two-step verification recommended?

A code sent by SMS proves only that someone can receive texts for your number. If a criminal tricks you into forwarding it, or moves your number to their SIM, the code works for them ^[7][9]. A second secret or a device-bound passkey stops that.

The FBI recommends strong multi-factor authentication such as biometrics, physical security tokens or standalone authenticator apps, and advises never giving mobile account details to callers who ask for your password or PIN ^[9]. Telegram states that SMS codes frequently fail to arrive and can be intercepted ^[6].

In October 2026, the UK's Report Fraud service launched a campaign urging people to switch to passkeys after reporting that sums stolen through email and social media account hacking rose to 6.3 million pounds in 2025/26, from 1.2 million pounds the year before; reports of this type of account takeover rose 34% ^[10]. Report Fraud said one of the most common ways criminals use hacked accounts is to impersonate family and friends ^[10].

What should users in Iran know?

Access to both apps in Iran has been shaped by government blocking. Freedom House reports that Telegram was permanently filtered in April 2018 and that WhatsApp and Instagram were blocked in 2022 amid the Woman, Life, Freedom protests ^[11]. In December 2024, Iran's official IRNA news agency said a vote had been reached to lift limitations on WhatsApp and Google Play ^[12].

Freedom House also notes that Iranian versions of popular apps, such as Bale, Rubika and Soroush, receive significant financial support from the government, and that a hacking group linked to the Islamic Revolutionary Guard Corps impersonated journalists and human rights activists online to lure critics into phishing operations ^[11]. Buying a SIM card requires real-name registration with a passport or identity document ^[11].

Practical points that follow from the platforms' own guidance: install apps only from official sources, because Telegram recommends official or verifiable open-source apps for sensitive chats ^[6]; never share a login code, whoever asks ^[2][6]; and keep two-step verification on, so that control of the phone number alone is not enough to take the account ^[6].

What can recovery not fix?

Recovery restores control, but it has limits worth knowing in advance:

• A WhatsApp account cannot be recovered without a SIM card with the same phone number ^[1].
• WhatsApp cannot deactivate accounts for others, block or unblock contacts on your behalf, or tell you who accessed your account ^[1].
• If you move to a new SIM but keep the old WhatsApp account, you must use the change number feature, or you could permanently lose access ^[1]. Telegram likewise warns that if its account is not linked to a number you control, you risk losing access forever ^[6].
• Recovery does not undo what the intruder already sent; WhatsApp's advice is to notify family and friends, because the intruder could impersonate you in chats and groups ^[1].

If money was taken or requested in your name, report it to the police or the national fraud reporting service where you live; in the UK that is Action Fraud, which also advises calling a friend or relative to confirm an unusual request ^[7].