Since the beginning of 2023, some Telegram users face the following issue: all their sessions are suddenly terminated, and after re-logging into their account, they see that some messages they sent recently have been deleted. In this article, we explain what may be the reason for this behavior of the Telegram platform.

Please note: the data in this article is based on messages received by the editorial staff of @tginfo from subscribers. The Telegram administration has never published any data about the mechanism we describe in this article, and has not provided any comments to @tginfo representatives regarding its existence and how it works.

1. What the problem looks like

1. The user discovers that all of their sessions have been terminated. On all devices where the account was logged in, it is no longer logged in: the account simply does not appear in the list of accounts.
   
2. After logging in back, the user sees that some messages have disappeared from the chats. Upon closer inspection, it turns out that:
   
   • Only the messages that were sent in private chats have been deleted. Messages in groups and channels are still displayed. There are exceptions to this rule: occasionally, users find that their messages in groups have also been deleted.
     
   • Only the messages that were sent by the user are deleted. Incoming messages from interlocutors are still displayed.
     
   • Only the messages that were sent in the last few hours or days are deleted. Older messages remain untouched.
     
   • The messages are deleted for both interlocutors, meaning they are not displayed for either the current user or the users to whom they were addressed.
     
3. Sometimes, for several hours or days after this, the user may see new messages that they send to private chats being deleted.
   
4. Sometimes the user gets spamban.

2. Why this happens?

We assume that this is how the mechanism created to counteract the sending of malicious messages works. In some cases, the Telegram platform believes that messages are being sent on behalf of the user that could be potentially dangerous for the recipients, and takes measures to stop this sending.

2.1. What does Telegram react to?

The platform may consider that a user poses a threat to interlocutors if many identical messages are sent to different users in a short period of time on behalf of their account.

As in other similar cases, the exact number of messages and the exact duration of the period that can trigger the protection mechanism are unknown. Judging by the messages of our subscribers, sometimes literally a few messages sent to different contacts within a few minutes are enough.

The editorial staff of @tginfo has no data on whether the content of the messages affects the triggering of the mechanism.

2.2. What does Telegram do?

When Telegram detects suspicious activity on an account, it does the following:

1. Terminates all user sessions so that the mailing author loses access to the account. A legitimate user will then be able to log back into their account by receiving a login code on their SIM card. However, an attacker who has hacked the account or a spammer who has used a virtual phone number to create an account will not be able to do this.
   
2. Deletes messages sent by the user to private chats over the past few hours or days, since the mailing author may have tried to deceive the interlocutors in these messages.
   
3. Sometimes it continues to delete messages sent for some time after all sessions have been terminated.

3. What else you should keep in mind

1. Sometimes, after all sessions have ended, the user trying to log in to the account sees a message that the authorization code has been sent to another device. Although in fact there are no such devices. This behavior of the application is probably due to the fact that data on the absence of other sessions does not appear in the system immediately, but only after some time. Usually, within a few tens of minutes or hours, the data is successfully updated, and the application allows you to send the code to the SIM card in the form of a phone call or SMS message. We wrote about problems with receiving such codes in the article «What to Do When Telegram Auth Code Doesn’t Arrive?» Remember: you can request a code for a SIM card only from the official Telegram mobile applications installed on devices with Android or iOS.
   
2. If all your sessions suddenly ended, this does not necessarily mean that the mechanism described above worked with respect to your account. A hack of an account that you did not notice in time or which occurred through theft of data from your Telegram Desktop application may look exactly the same. We wrote about this in the article What to do if your Telegram account is hacked?