Set up security before you deposit

Do this before you put money in. It takes a couple of minutes and it’s the difference between a stolen Telegram session being an inconvenience and being a disaster.

Everything below lives under More → Security.

1. Set your PIN (do this first)

The PIN is a 4–8 digit code, and it’s the base factor for withdrawals — every withdrawal has to be confirmed with it. Without a PIN you can’t withdraw at all.

Set it before your first deposit. While the wallet is empty, a new PIN takes effect immediately. Once the wallet holds funds, a newly set PIN waits out a safety delay before it can authorize anything beyond a small total — the delay exists so someone who has just taken over your session can’t set their own PIN and cash out. The app shows a banner reminding you of this, with the current delay.

Details: your account PIN.

2. Add a backup email (optional, but do it)

The backup email has exactly one power: it lets you reset a forgotten PIN yourself, using a code mailed to that address. Without it, a forgotten PIN means going through support.

Adding it is confirmed by a code sent to the address. Note that if you later change the email, the new address has to sit out a cool-down before it can authorize a PIN reset — again, so a hijacked session can’t just re-point your recovery channel.

Details: email verification.

3. Enroll Face ID (optional)

If your device supports Telegram’s biometrics, you can enroll Face ID or a fingerprint as a faster alternative to typing the PIN at confirmation time. The PIN still exists underneath and enrolls the biometry — biometry never replaces it.

Details: Face ID and biometrics.

4. Consider the withdrawal address allow-list

You can restrict withdrawals to addresses you’ve explicitly saved. Turning it on is instant; turning it off is deliberately delayed, so an attacker can’t disable it and withdraw in the same session.

Details: the withdrawal address allow-list.

Every change to these settings fires a Telegram message to you. If one arrives that you didn’t trigger, act on it immediately.