My account was hacked or I suspect surveillance

• Another device first. Act from a device you trust, not the one that may have been hacked or seized. In Telegram, WhatsApp, Google and Apple, open the list of active sessions and end any you don't recognise. Change your password and turn on two-step verification; in Telegram this is the cloud password. Check your email for an unfamiliar recovery address or forwarding rules. SMS codes can be intercepted, including by security services, so a cloud password or an authenticator app is more reliable.
• Warn family and colleagues through another channel: they should not trust messages in your name, open links or send money. Hijacked accounts are used to write to your contacts and lure out their data. If your chats held information about other people, think about whom to warn separately.
• Phishing 'from Telegram'. From October 2024 to July 2026, users in Russia, Belarus and Kazakhstan received fake 'Telegram security warnings'. A message arrived in a secret chat from an unknown account: there were many complaints about you, and the account would be blocked unless you confirmed it via a link. The link led to a fake login page asking for your code. RESIDENT.NGO advises not entering a login code or cloud password on a page opened from a link, and turning on the cloud password in advance. If you have already entered a code, take the first step straight away.
• Your phone was taken. If your phone was taken during a detention, search, interrogation or at the border, assume spyware may have been installed. Such programs read messages, record calls and track location. Use another device for anything important and have this phone checked by specialists.
• How it happened. In December 2024 Citizen Lab and First Department (foreign agent) described a program resembling 'Monokl' on the phone returned to programmer Kirill Parubets after his detention. In December 2025 RSF ('undesirable' in Russia) found the ResidentBat program on a Belarusian journalist's phone after questioning by the KGB: officers had watched him enter the unlock code.
• What not to do. By law a phone can be seized only with a written record; in practice it may be returned with spyware installed. Don't remotely wipe a seized device or delete accounts before talking to a lawyer: if there is a case, this can be used against you, and your messages remain with the other people and in the cloud anyway. Decide with your lawyer what to do with the accounts on a seized phone.
• Who can help. The Access Now Digital Security Helpline works around the clock, for free and in Russian: it helps activists, journalists and human rights defenders recover accounts and check devices. The RSF Digital Security Lab helps journalists (RSF is 'undesirable' in Russia). RESIDENT.NGO helps NGOs and activists from Eastern Europe. If you suspect surveillance after a detention, you can contact First Department (a 'foreign agent'). First Line explains in detail how to set up Telegram and two-step verification.

Designations of organisations in this guide: Reporters Without Borders (RSF) (undesirable); RSF Digital Security Lab (undesirable). Contacting them carries a risk: do not write from a phone that may be seized, and do not repost their materials.

current as of 26 September 2026. More: RESIDENT.NGO: phishing disguised as Telegram warnings against an exiled activist (23.07.2026); RESIDENT.NGO: two years of phishing against Telegram users in Russia, Belarus and Kazakhstan (23.07.2026); Citizen Lab: device confiscated by Russian authorities returned with Monokle-type spyware (05.12.2024); First Department: what Monokle is and how to protect yourself (04.12.2024, in Russian) (foreign agent); RSF: ResidentBat, new spyware used by the Belarusian KGB (17.12.2025) (undesirable); Meduza: how to prepare your phone for the Russian border and what to do if it was checked (undesirable); Telegram FAQ: my phone was stolen, what do I do?; First Line: two-factor authentication (updated 20.09.2024, in Russian); Access Now: Digital Security Helpline