In this guide · 8 sections
- 01How the 2026 GST Voucher Telegram scam takes over accounts
- 02Why a hijacked Telegram account hurts a business
- 03Telegram account hacked: what to do in the first hour
- 04Settings that prevent a Telegram account takeover
- 05Protect business groups, channels and staff accounts
- 06Teach staff to spot the login-code phishing trick
- 07Do it yourself or get help?
- 08Frequently asked questions
Short answer
Log in on any device you still control, go to Settings > Devices (Active Sessions) and terminate every session you do not recognise, then turn on Two-Step Verification with a recovery email. Warn your contacts and groups that messages from the account were not from you.
How the 2026 GST Voucher Telegram scam takes over accounts
The SPF advisory on fraudulent Telegram messages on GST Voucher describes a resurgence of messages with infographics inviting people to 'check eligibility' for GSTV Cash and MediSave payouts through a link.
The link asks for a mobile number, name and sometimes NRIC number, then for the Telegram verification code. That code is all a scammer needs to log in as you. They then send phishing links to your contacts or add them to chat groups that promote fake investment schemes.
The Police are clear that nobody needs to disclose credentials or bank logins to receive GSTV Cash or MediSave. Eligible citizens are paid automatically, and the Ministry of Finance does not have a Telegram broadcast channel. Our guide to government official impersonation scams covers the related scams aimed at businesses.
Why a hijacked Telegram account hurts a business
Many Singapore businesses run customer groups, broadcast channels or supplier chats on Telegram. A taken-over account speaks with your name and photo, so messages from it are trusted. A fake 'promotion', payment request or investment tip sent to your customers can cost them money and cost you their trust.
If the hijacked account owns a group or channel, the attacker may also remove admins, change the name or post scam links to every member. The same pattern hits WhatsApp; our guide to a hacked business WhatsApp, Facebook or Instagram covers those platforms.
Telegram account hacked: what to do in the first hour
Work through these in order. The aim is to cut the attacker out, then limit the damage to the people they can reach.
Open Telegram on a device that is still logged in
Your phone, a laptop or Telegram Desktop. If none is logged in, request a new login code on your phone number and sign in.
Terminate sessions you do not recognise
Go to Settings > Devices (or Privacy and Security > Active Sessions). Check the device, location and time of each session and terminate any you do not own, or choose to terminate all other sessions.
Turn on Two-Step Verification
Settings > Privacy and Security > Two-Step Verification. Set a strong, unique password and a recovery email, and make sure that email account has its own 2FA.
Check the account details the attacker may have changed
Look at your username, profile name, photo, linked email, passkeys (Settings > Privacy and Security > Passkeys) and any bots or business features. Remove anything you did not add.
Secure your groups and channels
Review the admin list in each business group and channel. Remove admins you did not appoint, check the pinned message and delete scam posts.
Warn contacts and members
Post in your groups and message key customers that links sent from your account during the takeover were not from you and should be deleted, not opened.
Report and get help if money was lost
If anyone paid or shared bank details, they should call their bank at once. Report to the Police and check suspicious messages with the ScamShield Helpline on 1799.
If you cannot log in at all, for example because the attacker set their own Two-Step Verification password, contact Telegram through its support form from the phone number linked to the account. Keep a note of what happened and when; it helps support and any Police report.
Settings that prevent a Telegram account takeover
Telegram's own FAQ recommends these settings. They take about ten minutes per account.
| Setting | Where | What it stops |
|---|---|---|
| Two-Step Verification | Settings > Privacy and Security > Two-Step Verification | Login with a stolen SMS code alone |
| Recovery email | Inside the Two-Step Verification screen | Losing access if you forget the password |
| Passkey | Settings > Privacy and Security > Passkeys | Phishing of SMS login codes (you can log in with your device PIN or biometrics) |
| Passcode lock | Settings > Privacy and Security > Passcode | Someone reading chats on an unlocked phone or PC |
| Active sessions review | Settings > Devices | A forgotten or rogue login staying active for months |
Use a password manager for the Two-Step Verification password so it is long and unique. Our guides to setting up MFA for business accounts and password managers for small businesses explain how to roll this out to a team.
Protect business groups, channels and staff accounts
A few habits make a big difference when a business relies on Telegram for customers or teams.
- Two or more trusted admins on every business group and channel, each with Two-Step Verification on. Telegram notes that admins keep their rights even if the creator's account is deleted.
- Only the permissions people need. Give staff 'post messages' or 'delete messages' rights, not full admin with the power to add admins.
- A business phone number you control. Do not tie a company channel to a staff member's personal number that leaves with them.
- A stated rule for customers. Pin a message: 'We never ask for payment, login codes or OTPs in this group. Payments only through our website.'
- Leaver checks. When staff leave, remove them as admins and from internal groups on their last day.
Teach staff to spot the login-code phishing trick
The GSTV variant is only one version. The trick is always the same: a link that looks official, then a request for a code that was sent to your phone. Staff who know that a login code is never shared will stop most attempts, whatever the cover story.
Show the team real examples from the SPF advisory and run through the basics in our guide on how to spot a phishing email; the same signs apply to Telegram and WhatsApp messages. The Police also advise checking that government links end in .gov.sg and, when unsure, calling the ScamShield Helpline.
Do it yourself or get help?
Recovering one account and switching on Two-Step Verification is a job you can do yourself in under an hour. It gets harder when the attacker has locked you out, when several staff accounts are involved, or when the same password was used on email or banking.
After a Telegram takeover
If the takeover spread to email or other logins, our hacked account recovery service (S$290) secures the accounts and checks for rules and sessions the attacker left behind. To stop the next one, security awareness training (S$390) walks your team through login-code and link scams.
Frequently asked questions
Common signs are messages or group invites in your chats that you did not send, being logged out unexpectedly, contacts asking about strange links, or unknown devices in Settings > Devices. Check that list first. Any session you do not recognise should be terminated straight away, then turn on Two-Step Verification.
Try logging in on any device that is still signed in and terminate the attacker's sessions. If you have no logged-in device and the attacker's password blocks you, contact Telegram through the support form on telegram.org from the linked phone number. Recovery is not guaranteed, which is why setting your own Two-Step Verification early matters.
No. The Police advisory of 15 July 2026 says the Ministry of Finance does not have a Telegram broadcast channel and will not contact the public through Telegram. Eligible citizens receive GSTV Cash and MediSave automatically, and the gov.sg SMS only informs them; it never asks them to reply, click a link or give information.
Yes, for most people. Telegram says passkeys let you log in with your device PIN, fingerprint or face scan instead of an SMS code, and that they are more secure than SMS codes. You can still request an SMS code, so keep your phone number current and add a Two-Step Verification password as well.
Not necessarily. Telegram is fine for customer groups and team chat if accounts use Two-Step Verification, admins are limited and customers know you never ask for payments or codes in chat. Treat it like any other business login: owned by the company, protected by a strong second factor and reviewed when staff leave.