Urgent
Unknown device in Telegram sessions: what to check
Short answer
An unfamiliar device name or city is a reason to investigate, not proof of an attacker. Compare the application, login time and last activity with your own devices and sign-ins. Device labels are supplied by clients; location depends on the network. If you establish that the session is not yours, terminate it from a trusted, older session and verify that it disappears. Review password settings and connected access separately.
Author: Cerber Team · Reviewed by: Cerber Security Review
Updated: 2026-10-12
Compare several signals
- Application / Client: which Telegram application and version authorized the session.
- Login date: when the authorization was created. Compare it with your own sign-ins.
- Last active: whether the session was active when you were using that device.
- Device: a client-supplied label; a familiar name alone does not establish trust.
- IP and location: a network clue. VPNs, proxies and mobile providers can change the apparent city or country.
Record what you need without delaying action
If it is safe, record the application, device, login time, activity and network information. For a work account, preserve an incident record without exposing login codes, passwords or customer data. Confirmed unauthorized access should be contained promptly.
Terminate confirmed unauthorized access
- Open Settings → Devices from a trusted session where you have been signed in longer than 24 hours.
- Select the unfamiliar entry and terminate that session.
- Reopen the device list and confirm that the entry is no longer active.
- Review two-step verification, the recovery email and any separately connected websites or channel permissions.
One session or all other sessions?
Terminate a specific session when you can identify the unwanted entry. Your other devices stay signed in.
Terminate All Other Sessions signs out every device except the session performing the action. You will need to sign in again on your own other devices. If Cerber is connected, its session is also terminated and must be reconnected.
If Telegram refuses the termination
A session cannot terminate other sessions during its first 24 hours after login. Look for an older trusted session. This restriction is based on the session performing the action, not the age of the target session.
Check the wider impact
Closing a session does not undo messages already sent, copied data or administrator permissions already granted. Review channels, groups, connected websites and recent outgoing messages. If harmful messages were sent, warn affected contacts through a trusted channel.
Related guides
Telegram active sessions: find and read the device list
Find Telegram sessions on iOS, Android and Desktop, understand client and device fields, and choose between terminating one session and all other sessions.
ReadTelegram will not terminate a session: the 24-hour restriction
Why Telegram blocks a fresh session from terminating other sessions, which login time matters and what you can do while the restriction applies.
ReadTelegram account hacked: what to do now
Recover control of a compromised Telegram account: close unfamiliar sessions, handle the 24-hour restriction and use official recovery if you have lost access.
ReadCheck your Telegram account for free
If you have access to the account, Cerber brings active sessions, two-step verification status and connected access into one result.