I want to highlight a Telegram account recovery design issue that can result
in permanent account takeover after phishing.
If an attacker obtains an active Telegram Web/Desktop session (e.g. via social
engineering), the legitimate phone number owner may be unable to reclaim the
account even after regaining access and enabling two-step verification (2FA).
The core problem is that critical security actions (session termination,
account deletion, confirmation of changes) are confirmed inside Telegram itself,
not via an out-of-band channel such as SMS.
As a result:
- the attacker’s older active session remains authoritative
- the legitimate user’s new sessions can be immediately terminated
- enabling 2FA does not invalidate existing sessions
- even account deletion may be impossible if confirmation codes are delivered
only to the attacker-controlled session
This creates a permanent lockout scenario where:
phone number ownership + in-Telegram verification + newly enabled 2FA
are insufficient to recover the account.
This is not about phishing being a bug.
The issue is the lack of a recovery mechanism that prioritizes verified phone
number ownership over existing sessions.
If an attacker obtains an active Telegram Web/Desktop session (e.g. via social engineering), the legitimate phone number owner may be unable to reclaim the account even after regaining access and enabling two-step verification (2FA).
The core problem is that critical security actions (session termination, account deletion, confirmation of changes) are confirmed inside Telegram itself, not via an out-of-band channel such as SMS.
As a result: - the attacker’s older active session remains authoritative - the legitimate user’s new sessions can be immediately terminated - enabling 2FA does not invalidate existing sessions - even account deletion may be impossible if confirmation codes are delivered only to the attacker-controlled session
This creates a permanent lockout scenario where: phone number ownership + in-Telegram verification + newly enabled 2FA are insufficient to recover the account.
This is not about phishing being a bug. The issue is the lack of a recovery mechanism that prioritizes verified phone number ownership over existing sessions.
I’ve filed a detailed report with Telegram: https://bugs.telegram.org/c/58477
Curious whether others have encountered similar recovery dead-ends, and how this compares to recovery models used by other messaging platforms.