How to Fix Telegram Verification Code Not Arriving on Android?

Why a Telegram Verification Code Is Not Arriving on Android

When a Telegram verification code is not arriving on Android, the instinct is to tap the resend option until something happens. That is usually the wrong reflex. Telegram rate-limits repeated code requests, and hammering the button mostly means you spend the next few minutes waiting with no new information about which link in the chain actually failed. The productive approach is to treat the code as a delivery chain with four links — Telegram's authentication servers, the international SMS route, the Android telephony and notification stack, and the messaging app that finally renders the message — then work out which link is broken.

This guide walks that chain from the outside in. It begins with a fast triage that separates "the code was never sent" from "the code arrived but you could not see it," then moves layer by layer through Android permissions, battery restrictions, spam filtering, number formatting, carrier-level blocking, and finally the account-level features that can bypass SMS entirely: in-app delivery through an existing session, the automated voice-call fallback, two-step verification, and recovery options when the phone number itself has become a problem. Later sections cover shared devices and managed fleets, where the identical symptom has an entirely different root cause — which is why the same complaint can require two completely different responses.

Terminology first: throughout this article, "code" means the short numeric login code Telegram sends during sign-in or registration. The "two-step verification password" is a separate secret that you create yourself and that Telegram never sends to you by SMS. Confusing the two is one of the most common reasons two people describe the same problem in completely different words — and it leads to very different fixes.

What the Verification Code Is, and Which Channels Can Deliver It

Telegram treats the phone number as the primary account identifier. There is no username-and-password sign-up: the number is the identity, and the code is the proof that you control it. That design has an important consequence for troubleshooting. Anything that interferes with the number — a carrier block, a formatting error, a SIM that has been reassigned — will look like a Telegram bug even though Telegram's side of the transaction completed normally.

Positioning matters here. The login code is a transient, single-use credential. It expires quickly, it is bound to the specific sign-in attempt that requested it, and requesting a new one generally invalidates the previous value. This is why an old code you find in your message history ten minutes later will usually be rejected, and why screenshotting codes for later use is a bad habit rather than a convenience.

Three delivery channels, three distinct failure modes

1. SMS to the registered number. The default path for a fresh registration or a sign-in with no other active session. It depends on the international A2P (application-to-person) SMS route between Telegram's provider and your carrier.
2. In-app message from the Telegram service account. If you are already signed in on another device or another platform, Telegram typically delivers the code into that existing session instead of sending an SMS at all. On Android this appears as a chat labelled with the Telegram service account.
3. Automated voice call. Many clients and regions offer an alternative where a synthetic voice reads the code aloud. Availability depends on the region, the client build, and whether the flow has already fallen back to it.

The practical value of separating these three is that each one fails for different reasons. SMS fails at the carrier. The in-app message fails when you have no other active session — meaning the option is simply not offered. The voice call fails when the number cannot receive international inbound calls, or when the client has hidden the option because a previous attempt is still within a cooldown window. Identifying which channel you are actually on, in other words, already halves the search.

Boundaries: what this code is not

Several adjacent flows get mixed into the same support conversation, and untangling them early saves time. The login code is not the two-step verification password, which is validated on a separate screen after the code is accepted. It is not the recovery code sent to a login email, which is a different channel you may have configured yourself under the security settings. And it is not a confirmation dialog for changing your number, which runs through its own verification step inside the app.

Fast Triage: "Not Delivered" Versus "Delivered but Invisible"

Before touching any setting, answer one question: is there any evidence the message reached the device at all? A code that never arrived and a code that arrived in a filtered folder look identical from inside the Telegram login screen, but they have almost nothing in common in terms of repair. The table below is the fastest way to sort the two apart.

Reading the table top to bottom is roughly the order of likelihood in my own testing, but that ordering is an empirical observation rather than a published statistic. Carriers differ enormously by country, and a corporate-managed device skews the distribution toward the diagnostic paths in the later sections. What is stable across environments is the separation principle itself: establish delivery first, visibility second.

Layer 1 — Android Itself: Permissions, Notifications, and Battery Rules

Android sits between the radio and the app, and it is allowed to drop, delay, or hide the message without telling anyone. Three subsystems are worth checking, in this order — and it helps to treat them as a sequence rather than a checklist, since the first one that changes the outcome tells you where the fault actually lives.

SMS permission and code auto-fill

Depending on your Android version and the build you installed, Telegram may ask for SMS-related access at some point. It is worth being precise about what that permission does and does not buy you. Denying it does not prevent the SMS from arriving at the device — the message still lands in your default messaging app, because SMS delivery is handled by the system telephony stack, not by Telegram. What you lose is usually the convenience layer: the app reading the incoming message and pre-filling the code field.

So if your problem is that no message appears anywhere, granting a permission inside Telegram cannot fix it. If your problem is that the code arrives but you cannot find it in time to type it, that is exactly the scenario where permission settings and auto-fill behaviour become relevant.

Shortest path (Android): open the system Settings app → Apps (on some builds, Applications) → Telegram → Permissions. The exact wording of the Permissions entry varies between stock Android and vendor skins; on Samsung devices the same screen is reachable from Settings → Apps → Telegram → Permissions, while on several vendor builds there is an additional "Autostart" or "App launch" list worth checking separately.

Notification channels and the silent-message trap

Since Android 13, the notification permission is granted per app and can be revoked without uninstalling anything. More subtly, Android groups an app's notifications into channels, and one channel can be muted while the rest behave normally. A user who muted the service-message channel months ago to stop promotional noise will see a perfectly functioning Telegram that simply never surfaces the login code as a banner.

Verification step: go to Android Settings → Apps → Telegram → Notifications and confirm that notifications are enabled at the top level, then expand the category list and confirm that no category is set to silent. Then send yourself any message from another account and observe whether a heads-up banner appears. If the test message behaves correctly but the login code still seems missing, the problem is not notification visibility — move to the next layer.

Battery optimization and Doze

Doze and App Standby defer background work for apps the system considers idle. In practice, this shows up as messages that arrive only after you unlock the phone or open the app. The behaviour is a well-documented Android power-management trade-off rather than a Telegram defect, and the fix is to exempt the app.

Shortest path (Android): system Settings → Apps → Telegram → Battery → choose Unrestricted (the exact label varies; some builds say "Don't optimize" or offer a three-way toggle). Vendor skins often layer a second, stricter scheduler on top — the "Autostart," "Protected apps," or "Battery saver" lists found in some manufacturer builds. If those exist on your device, allow Telegram there as well.

Layer 2 — The Messaging App and Its Spam Filters

The second layer is where the message physically appears, and it is frequently the culprit. Modern Android messaging clients ship with aggressive classification: unknown senders, alphanumeric sender IDs, and short codes all get routed into a separate folder rather than the main inbox. From the Telegram login screen, that folder is invisible.

The practical check is straightforward. Open your default SMS app, look for a spam, blocked, or unknown-senders folder, and search the message list for any recent message from an unfamiliar alphanumeric sender. Note that Telegram's SMS may not arrive from a sender literally named "Telegram" — sender IDs vary by country and by the route the message takes, so searching for the word alone is not conclusive.

A second, less obvious interaction involves third-party SMS replacement apps and RCS. If you have installed a different default messaging app with its own filtering rules, the message may be classified there instead. Similarly, RCS Chat features in some messaging clients change how messages are threaded and notified, and in my testing this occasionally produced confusing results with short-code senders. Toggling Chat features off temporarily is a reasonable isolation step, though it is an empirical observation rather than a documented Telegram requirement.

Reproducible isolation test: set the system's default SMS app back to the stock messaging client, send yourself a test SMS from a different phone, confirm it lands in the main inbox, and only then trigger a new Telegram code. If the test SMS also gets filtered, you have found a device-level filtering problem and Telegram is irrelevant to it.

Layer 3 — Number Format, Country Code, and Dual-SIM Traps

Formatting errors are boring and extremely common. Telegram's login field expects the number in international form: country code, then the national number with any leading zero removed. Typing a local-format number, or leaving the auto-detected country prefix in place while also typing the country code, produces a number that is syntactically valid but routes nowhere.

The country prefix shown in the field is derived from your SIM, your network, or your IP address, and it is not always right. A traveler with a foreign SIM, a device using a privacy tool, or an eSIM alongside a physical SIM can easily see the wrong prefix pre-filled. Leaving it there and typing only the national part produces a mismatch that the app cannot detect for you.

Dual-SIM: which line actually receives SMS

On dual-SIM Android devices, the SMS that Telegram triggers goes to one specific number — the one you typed — but the device's inbound routing depends on which SIM slot has the SMS subscription active for that line. If the SIM associated with that number has been disabled in the SIM manager, or if the device has assigned messaging to the other slot, the message can be rejected at the radio level before any app sees it. Check the SIM manager inside Android Settings and confirm both that the line is enabled and that it has messaging capability.

A related case is the eSIM plus physical SIM arrangement common on newer devices. The eSIM profile may not yet be provisioned for SMS if it was activated as data-only. This is a carrier provisioning question, not a Telegram one, and the fastest test is to ask another person to send an ordinary SMS to that number and observe whether it arrives.

Layer 4 — Carrier Filtering, Roaming, and Short-Code Blocks

If everything above checks out, the message is being dropped before it reaches the handset. Carriers routinely filter application-to-person traffic: bulk sender routes, alphanumeric sender IDs, and messages originating outside the home country all sit behind reputation systems that occasionally produce false positives. When that happens, the sender's logs show a successful submission and your phone shows nothing at all.

A useful diagnostic is comparison. Ask a colleague on a different carrier in the same country to attempt a Telegram sign-in with a spare number and see whether the SMS arrives. If it does for them and not for you, the carrier becomes the prime suspect. This is a rough signal rather than a proof, but it narrows the search space quickly and gives you something concrete to say when you contact your carrier.

Roaming and international inbound

Roaming changes the routing path substantially. Inbound SMS while abroad normally still work, but premium and application-to-person traffic is sometimes restricted depending on the roaming agreement between the visited network and your home carrier. If you are traveling, the quickest workaround is usually to connect to Wi-Fi and request the code by voice call instead, which uses a different path, or to switch to in-app delivery through a session you are already signed into.

VoLTE, Wi-Fi calling, and message delivery

VoLTE and Wi-Fi calling affect voice routing more than SMS, but I have observed cases where toggling Wi-Fi calling changed whether short-code messages were delivered, particularly on networks that route voice over IP differently from messaging. Treat that as a working hypothesis: it is cheap to test, produces a clear yes-or-no result, and it is easier to toggle one switch than to argue with a carrier's first-line support. Turn Wi-Fi calling off, try a new code, and if it makes no difference, turn it back on.

Using Resend and the Voice Call Fallback Without Locking Yourself Out

Telegram applies cooldowns to repeated code requests, and the cooldown tends to lengthen after each new attempt. Repeatedly tapping the resend control therefore moves you backwards. The practical rule is to make one request, wait a genuinely generous interval — minutes, not seconds — and use that time to inspect the device layers described above instead of watching the login screen.

When the resend control offers alternatives, choose the one that uses a different transport. If SMS is blocked, a voice call travels a different route and frequently succeeds where the text did not. The reverse is also true: if you are roaming and inbound calls are restricted, SMS may be the more reliable of the two. The point is to switch transports rather than repeat the failing one.

When the Number Itself Is the Problem

Some failures have nothing to do with delivery. The number is reachable, the SMS arrives, and the account state is still wrong. This section covers the cases where the identity rather than the pipe is broken.

Recycled, ported, and recently reissued numbers

Mobile numbers are recycled. A prepaid SIM that sat unused for a long enough period can be reassigned to a new subscriber, and if the previous holder had a Telegram account on it, the number may still be attached to that account. The sign-in flow cannot tell you apart from the previous owner — it simply verifies that whoever holds the SIM also receives the code.

The signature of this scenario is specific: you enter your number, receive the code correctly, and land inside an account that is not yours — unfamiliar chats, an unfamiliar profile name, or an existing two-step verification password you never set. If that happens, do not use the account. Sign out immediately, and contact Telegram through the in-app support form rather than attempting to take over a session that belongs to someone else. This is the one situation in this entire guide where the correct action is to stop troubleshooting.

Ported numbers create a milder version of the same problem. Number portability changes the carrier of record while the number stays the same, and some routing databases update more slowly than others. Codes may be delivered inconsistently for a period after a port. The practical remedy is patience plus transport switching — try the voice call, and give the port a few days to propagate.

Numbers already tied to an account you own

If the number is already registered to your own account, entering the code signs you in rather than registering you — which is correct behaviour and occasionally surprises people who expected a fresh account. If instead you want to move your account to a new number, that is a deliberate operation inside the app rather than something the login screen does for you. On Android the path runs through Settings → Edit Profile → Phone Number → Change Number, which verifies the new number before switching. Doing it this way preserves your chats, contacts, and channel memberships.

Two-Step Verification, Login Email, and Account Recovery

Two-step verification adds a password on top of the SMS code. It is the single most effective protection against the recycled-number scenario, and it also introduces its own recovery problem: a forgotten two-step password is a much harder situation than a missing SMS.

Shortest path (Android): open Telegram → tap the menu → Settings → Privacy and Security → Two-Step Verification. From this screen you can set or change the password and, crucially, configure a recovery email. That email address is what makes the difference between a recoverable account and a permanently lost one.

Where the recovery email actually helps

If you forget the two-step password and a recovery email is set, the recovery flow can send a reset code to that mailbox. If no recovery email is set, the only remaining path is the account reset option, which wipes the account after a waiting period. That waiting period is deliberately long, and it exists to protect you: it gives a legitimate owner time to notice and cancel a hijack attempt. Plan for it as a last resort, not a same-day fix.

There is also an inactivity deletion setting, reachable at Settings → Privacy and Security → Delete my account if away for. If it is configured aggressively and the account goes unused, it can be removed automatically. For an account you rely on, a longer window is the safer configuration; for a throwaway test account, a short one is fine.

Passkeys and other sign-in factors

Telegram has been progressively adding passwordless sign-in options on some platforms. If your installed build supports them, the relevant entry appears alongside the existing security settings. Rather than assuming, verify against your own client: open Settings → Privacy and Security and look for a passkey or passwordless sign-in entry. If it is not there, your build or region does not expose it yet, and nothing is broken. I mention this only because readers occasionally report that a security screen looks different from a screenshot found online — the fix is to compare against your own installed version, not against someone else's.

Getting the Code Without SMS: In-App Delivery and Other Sessions

The most reliable workaround for persistent SMS failure is to avoid SMS entirely. If you are already signed in somewhere — a tablet, a desktop client, Telegram Web — a new sign-in request is typically delivered as an in-app message to that existing session rather than as a text message. The message arrives in a chat with the Telegram service account.

This changes the troubleshooting problem completely. Instead of fighting the carrier, you check whether the other session is still active. Open Settings → Devices on the signed-in client, confirm the session is live and not pending termination, then trigger the sign-in on the Android device and watch for the service message. If the other session was signed out, the fallback disappears and you are back to SMS.

The same Devices screen is worth auditing for its own sake. Any session you do not recognise should be terminated, especially after a recycled-number scare. Terminating sessions is immediate and does not affect the account itself.

Team and Small-Group Setups: Shared Devices and Shared Responsibilities

The moment a Telegram account is used by more than one person, the verification problem acquires a social dimension. A support team that shares a single phone number, a newsroom that rotates a duty device, or a small business that hands a phone to whoever is on shift will all eventually hit a login prompt that nobody can satisfy, because the SMS lands on a device currently in someone else's pocket.

The structural fix is to stop sharing the credential. Telegram's terms assume one account per phone number, and sharing a number means sharing a single identity with a single two-step password. For teams, the cleaner pattern is one account per person, with shared work happening in groups and channels rather than through a shared login. Where a shared inbox is genuinely needed, the account should live on a device with a fixed location and a documented owner, not on whoever's phone happens to be closest.

If the team runs Telegram Business features — the subscription tier that adds business hours, quick replies, and automated greeting messages — the configuration lives under Settings → Telegram Business. Note that Telegram Business features are configured inside the account, not separately from it; they do not create an independent login and they do not change how the verification code is delivered. A team that loses access to the underlying account loses the business configuration too, which is another argument for keeping recovery email current.

Enterprise Deployment: Work Profiles, MDM, and Managed Numbers

On a managed Android fleet, the diagnostic order changes. Several of the layers described above can be locked down by policy, and the user cannot see or change the setting that is dropping the message.

The first thing to determine is whether Telegram is installed in a work profile or in the personal profile. In a work profile, notifications and background execution are governed by the profile's own policies, and a personal-side exemption for battery optimisation does not apply inside the work container. An administrator who has restricted background data or disabled notifications for managed apps will produce the exact symptom this article is about, with no visible cause on the device.

The second variable is the number itself. Some organisations issue corporate SIMs with SMS restrictions, or route messaging through an aggregator that blocks application-to-person traffic by default. Where the number is provisioned that way, no device-side change will help; the fix is a provisioning change on the carrier or aggregator side.

Administrator-side verification, in order: confirm the app distribution channel and profile placement; confirm that notifications and background data are permitted for the managed app; confirm with the carrier or aggregator that inbound A2P SMS to the corporate number range is not blocked; and only then escalate as a Telegram-side issue. In my experience of fleets, the fourth step is rarely needed — the first three account for most cases.

Compliance and Privacy Considerations Around SMS Codes

SMS as a second factor has known weaknesses: it is vulnerable to SIM swapping, to carrier-side interception in some network configurations, and to the recycled-number problem described earlier. That matters more in regulated environments, where an organisation may be required to demonstrate that access controls are appropriate to the data being handled.

The compliance-relevant point is that the login code is only one factor. The two-step verification password is the second, and it is the one you control. A support process that treats "we received the SMS" as sufficient proof of identity is relying entirely on the weaker factor. Where Telegram is used for anything sensitive, the practical controls are: enforce two-step verification, keep recovery email under organisational control rather than an individual's personal mailbox, audit active sessions periodically, and use per-person accounts so that access can be revoked when someone leaves.

A caution worth stating plainly: nothing in this article should be read as advice on bypassing Telegram's authentication. Every technique described here assumes you are the legitimate holder of the number. Attempting to access an account belonging to someone else is both a terms violation and, in most jurisdictions, a legal problem.

Symptom → Cause → Verification → Fix Matrix

How to Verify Each Fix Actually Worked

Troubleshooting goes wrong when several changes are made at once and the result is attributed to the wrong one. The discipline is to change one variable, observe one outcome, and record it. A short written log makes this concrete and also gives you something useful to hand to a carrier or an administrator.

Latency should be recorded as a band rather than a stopwatch figure. Real-world delivery time varies with carrier routing, network congestion, and device state, and a precise number from one attempt tells you very little. What is diagnostic is the pattern across attempts: consistently sub-minute, consistently delayed, or consistently absent. Never write an actual live code into a log file — record only whether one arrived.

When This Playbook Applies — and When It Doesn't

This guide is written for the ordinary case: a personal Android device, a number you legitimately control, and a login that fails at the delivery stage. It applies well to individual users, to small teams running per-person accounts, and to administrators diagnosing a managed fleet where the app is deployed but the code does not arrive.

It does not apply cleanly in a few situations. If the device is enrolled in a management programme that prohibits third-party messaging apps outright, the correct action is to raise the issue with the administrator rather than to work around the policy. If the number is a virtual or VoIP number issued by a service that does not support inbound SMS from application senders, no device-side setting will change that — the number itself is unsuitable for the purpose. And if the account in question belongs to somebody else, including a former employee whose number you now hold, the correct path is Telegram support and, where relevant, your legal or HR process, not technical troubleshooting.

Best-Practice Decision Rules

The following rules compress the article into decisions you can apply in the moment. They are ordered by the sequence in which a real incident usually unfolds.

1. Before you request anything, confirm the number format. Country code, no leading zero, no spaces. This costs five seconds and prevents the most common false alarm.
2. Request the code once, then stop touching the button. Use the waiting time to inspect the device rather than to repeat a failing request.
3. Check the spam folder before changing settings. It is the fastest test with the highest hit rate on consumer devices.
4. Change one variable at a time. Battery exemption, Wi-Fi calling, default SMS app — one at a time, with an observation recorded after each.
5. Prefer a different transport over a repeat. If SMS failed twice, try the voice call, or the in-app route through an active session.
6. Treat a cooldown as information, not an obstacle. If the alternatives disappear, the server is telling you to wait, and waiting is faster than working around it.
7. Set two-step verification and a recovery email before you need them. Both are configured under Settings → Privacy and Security, and both convert a potential permanent loss into a recoverable interruption.
8. Audit active sessions after any recovery event. Settings → Devices shows what is signed in; terminate anything you do not recognise.
9. Give every account a single named owner. Shared logins fail at the worst possible moment, and the failure has nothing to do with SMS.
10. Stop and escalate when the account is not yours. Recycled numbers, former employees, and inherited devices belong in a support or HR process, not a settings menu.

One further rule deserves its own emphasis because it is counter-intuitive: uninstalling and reinstalling almost never helps with a missing verification code. The delivery failure happens outside the app, and reinstalling clears local caches, resets notification settings you may have tuned, and can leave you waiting on a cooldown you did not know you had triggered.

What to Do Next

A missing Telegram verification code on Android is almost always a delivery-chain problem rather than an account problem. The chain has four links — Telegram's servers, the international SMS route, the Android system layer, and your messaging app — and the useful skill is not memorising fixes but knowing which link to interrogate first. Start with delivery versus visibility, verify the number format, check the spam folder, and only then begin changing settings one at a time.

Three actions are worth taking today, regardless of whether you are currently locked out. First, open Settings → Privacy and Security and confirm that two-step verification is enabled with a recovery email you actually control. Second, open Settings → Devices and terminate any session you do not recognise. Third, if you rely on Telegram for work, make sure each account has a single named owner rather than a shared device, because that single change removes an entire class of future incidents that no amount of SMS troubleshooting can fix.

Where a fix involves an unverifiable claim — carrier filtering behaviour, the effect of Wi-Fi calling on short-code delivery, or the routing quirks of a recently ported number — treat it as a hypothesis to test on your own device and record the result. Telegram, Android, and carrier networks all change over time, so the version of this article that matters most is the one you verify against your own setup.

Future Trends and Version Expectations

Because the delivery chain spans three parties that release independently, any specific behaviour described here may drift. As more people keep a session active on a second device, the in-app delivery path is likely to become the default in more situations, quietly reducing reliance on SMS. If passwordless sign-in continues to expand across builds and regions, some of the two-factor friction discussed above may shift as well — though that is an empirical observation rather than a commitment, and availability will lag in some markets. The durable practice is the same regardless: test each recommendation against your own installed version, keep your recovery paths current, and treat a new client or Android release as a reason to re-verify assumptions rather than to trust an offline guide.