How Did My Acquaintance Find My Telegram?

TLDR

Someone from my offline life - my former landlord, no less - slid into my Telegram replies after I posted a work story, even though I'd locked down every setting I could find. I dug into how he actually found me, and the answer sucks: Telegram's privacy settings don't stop people who already have your number saved. Here's what went wrong and how I'm fixing it.

If All My Settings Say "Nobody," How Did He Even Find Me?

I did everything right, or at least it felt like it. Settings > Privacy and Security, blocked contacts from seeing my stuff, hid my number, the whole checklist. And it still wasn't enough, because Telegram's privacy model is built entirely around phone numbers and contact syncing - and that's the part the settings don't actually protect you from.

Here's the mechanic: his phone has my number in his address book. He probably saved it back when I was his tenant, and never deleted it. When Telegram syncs his contacts, the app matches his address book against registered numbers server-side and pops me up in suggestions - "people you may know" energy. The settings I changed control who can *see* my number and who can find me by my number going forward, but "Who Can Find Me By My Number" set to My Contacts only limits people whose numbers *I* haven't saved. It does nothing against someone who saved *my* number years ago. Hiding my number hides the digits, not the discoverability. That's the part that made me want to throw my phone.

The other thing worth knowing: settings changes aren't retroactive. If someone already found your account, tweaking toggles afterward doesn't un-find you. He knows where I am now.

So How Do I Actually Lock This Down?

Triage first. Delete the story immediately - it's gone from public view fast, but assume he saw it and maybe screenshotted, because that's the safe assumption. Block him. Not "message him first" - block.

Then the real fix: Telegram fundamentally isn't designed for an anonymous work account tied to your real number. The long-term answer is migrating to a number that isn't in anyone's address book. Grab a secondary SIM or a virtual number service, register a fresh Telegram on it, move over with a new username, and never connect that number to your real identity. Let the old account sit as a shell or nuke it. Coming from someone renting from a guy with a crush, this isn't just embarrassment - it's an OPSEC breach. He has my real name and housing history. If there's leverage like that in play, treat it seriously.

Also worth reviewing: Last Seen set to Nobody, profile photo restricted, forwarded messages restricted, and turn on two-step verification so nobody hijacks the account. None of it undoes the breach, but all of it raises the wall.

Should I Just Ask Him How He Found Me?

Honestly? I want to. I really want to. The curiosity is killing me. But no. Messaging him reopens the channel, confirms the account is live and monitored, and answers nothing I can't already figure out - it was almost certainly his saved number plus contact sync, so asking him is just handing him a conversation he didn't earn. If he escalates or hints he wants something, document everything with screenshots, keep the block, and report if it turns into harassment or extortion threats. Don't engage beyond that.

The deeper lesson here is that settings are a speed bump, not a wall, when your real number is the anchor. If your work persona lives on a platform that requires a phone number, that number needs to be a burner. Until then, every person who ever saved your digits is one contact sync away from finding you - which is exactly the kind of thing worth checking on *every* platform, not just this one. And when I want live cam work vibes without any phone-number landmines, xlovecam has been my go-to for keeping that side of things separate and drama-free. What parts of your setup are still anchored to your real number?