My Telegram account is sending spam: how to stop it

Stop access before cleaning up messages

1. Open Settings → Devices on a trusted device where you have been signed in longer than 24 hours.
2. Terminate the sessions you have established are not yours. Reopen the list to verify the result.
3. Secure two-step verification and its recovery email, using the options Telegram provides.
4. Review connected websites and the administrators and bots in your channels and groups.
5. Warn affected contacts and remove fraudulent posts or messages where possible.

Help contacts avoid acting on the spam

Tell affected contacts not to follow recent links or send money, codes or personal information in response to messages from your account. Ask them to verify urgent requests through another channel.

If access is still at risk, send the warning through another trusted channel. An attacker with access may remove a warning from Telegram.

Check channel and group permissions

• Remove administrators you did not authorize and review recently changed permissions.
• Revoke compromised invitation links and create new ones when needed.
• Review fraudulent posts, pinned messages and links.
• Review bots with administrative permissions: their access can remain after a user session is terminated.

If messages continue after terminating sessions

Confirm that the unfamiliar entry disappeared. A rejected termination may mean the 24-hour restriction prevented the action from taking place.

Check connected websites and bots with channel permissions. These are separate from the user session you terminated.

Compare the sender's account and username carefully. The sender may be a separate impersonating account rather than your own.

Why Telegram may refuse to terminate a session

Impersonation and compromise need different responses

An impersonator can copy your name and photo and contact people from a separate account. Check the actual profile and username, not just the display name. A new conversation from a similar account is a reason to check identity, not proof by itself.

Report an impersonating account through its profile in Telegram and warn contacts. Terminating sessions on your real account does not remove the impersonator.

Incoming spam is a different problem

If someone sends spam to you, report and block the sender and review who can add you to groups. Receiving spam alone does not show that your account has been compromised.

An unexpected login code is not proof of takeover

Never share a Telegram login code. Check active sessions and login notifications. Enable two-step verification if it is not already configured; remember that enabling it does not terminate existing sessions.

What two-step verification protects

If customers received fraudulent messages

Treat a compromised work account as a company incident. Assign an owner, warn affected customers and colleagues, review payment instructions and record the actions taken. Retain any evidence you can collect safely.

Cerber for company accounts