Losing your phone, or opening Potato one day and finding a few messages in your chat list that you didn't send—the order of handling these two situations is actually the same: first cut off access from unfamiliar devices, then shore up verification, and finally check whether any "backdoors" were left behind. Below are actionable steps, and you don't need to understand technical jargon.
Step 1: Use another device to take back control
Potato supports multiple devices online at the same time, which is both convenient and the most useful thing when your phone is lost. If you still have Potato logged in on a tablet, backup phone, or computer, operate from that device first:
- Go to the device or session management page in settings and check the list of currently online devices.
- For unfamiliar devices and the lost phone, select "Log out" or "Terminate session" one by one.
- After confirming the logout, change your account password. Do not reverse the order.
Why log out devices before changing the password? Because some clients may retain established sessions after a password change, so manually terminating them first is safer. If you cannot log in on any device, you can only choose to log in again via SMS or email verification code on the login page. If this step fails, go directly through the account recovery process. Do not repeatedly try passwords, to avoid triggering a short-term restriction.
Step 2: Check login records and verification methods
Using a common Android phone as an example: open the privacy and security-related options in settings and check recent login activity, focusing on login time, device, and approximate region. If you find records at 3 a.m. or in clearly mismatched locations, it means your account may have already been used by someone else, not just "attempted login."
Next, add verification. You can enable two-factor verification, so that when logging in you enter an additional password besides the verification code; at the same time, confirm that the bound email and phone number are still your own. The root cause of many people's problems is not a weak password, but that the recovery email is an old, deactivated email registered years ago—if an attacker controls that email, they can bypass your new password.
If you previously forwarded login verification codes to a chat or bot, be sure to cancel that. Forwarding rules can send verification codes directly into someone else's hands, and this type of setting has the highest priority in account security.
Step 3: Check groups, bots, and automatic forwarding
If an account has been briefly controlled, traces are usually left in several places. It is recommended to go through them one by one:
- Check whether you have been pulled into unfamiliar groups, especially groups with only a few people and garbled names.
- Check the bot conversation list to see whether there are bots you never added, especially those with words like "forward," "backup," or "verification."
- Check rules such as automatic forwarding, auto-replies, and scheduled messages, and turn off or delete all suspicious items.
- Check whether your profile, username, and avatar have been changed, and restore your own information.
- If payments or subscriptions are involved, check billing records and immediately submit an appeal in the app if you find anything unusual.
For bot permission boundaries and common risks, you can refer to our guide on Potato bot usage and permission descriptions, which categorizes permissions such as "read messages," "manage groups," and "read phone number," making it easier to judge whether a bot has overstepped its authority.
Step 4: Handling the lost phone itself
If the phone is lost but Potato is still logged in, besides terminating sessions, you also need to consider the device itself:
- Use the phone manufacturer's find feature to remotely lock or erase the device. Both Android and iOS have corresponding entry points.
- If the phone number is also lost, contact your carrier first to replace the SIM card; otherwise SMS verification codes will fall into someone else's hands.
- After replacing the SIM card, log in to Potato again and confirm that the account binding information has been updated.
The SIM replacement step is often overlooked. Some people think that changing the Potato password makes them safe, but if the phone number is still in someone else's hands, the other party can still use SMS recovery. After replacing the SIM card, it is recommended to verify the phone number bound to the account again.
Common questions and ongoing habits
Some people ask: after terminating a session, can the other party still see historical messages? Chat records that have already been synced to the other party's device cannot be remotely withdrawn. This is also why you should act as soon as you discover something unusual, rather than waiting a few days. As for situations such as being restricted from logging in, not receiving verification codes, or getting stuck in the recovery process, you can refer to the troubleshooting steps in Potato FAQ. Most problems fall into two categories: verification code channels and expired binding information.
As a daily habit, it is recommended to open the device list every two or three months and promptly clean up old phones and tablets you no longer use; do not reuse passwords from other websites; and do not send screenshots of verification codes to anyone, including accounts claiming to be customer service. For explanations of data retention and privacy options, you can check Potato privacy and data processing explanation to understand what information is retained and what can be turned off yourself.
If you have not yet installed Potato on a new device, you can first read the Potato download and installation guide, choose the corresponding installation package for your system, and after installation complete the account security settings in the order above. The whole process usually takes only about ten minutes, which is much less trouble than appealing afterward.
Continue reading: downloads and installation, accounts and verification codes, groups, channels, and bots, and privacy and security.
