What it means
Telegram supports multiple simultaneous sessions under one phone number. Each active session is a signed-in device or web client with account access, including cloud chats. A contact is simply another account in the address book or conversation list. An unfamiliar contact may be spam; an unfamiliar session in Settings, Devices is a much more direct account-access concern and should be investigated promptly.
A real-world example
A user sees an odd name in a group and assumes the account is hacked. Devices shows only their phone and laptop. Later a second unknown desktop appears in Devices, which is the actual sign-in evidence.
What to do
Inspect Settings, Devices, terminate an unrecognized session, enable Two-Step Verification and secure the phone number and recovery email. Block or report suspicious contacts through their chat separately.
The distinction that matters
A device label and approximate location can be inaccurate or renamed, so compare timing and your own device history. Terminating a session cannot undo content already copied. Secret Chats are device-specific and do not sync as cloud chats do; their exposure should be assessed on the originating device. A newly received login code is a warning to check sessions, not a code to read to a support caller.
Telegram sessions and stolen phone
