This guide is for prevention and incident response. It is not legal or financial advice. Rules and reporting channels differ by jurisdiction; use the current official service pages linked below.
Telegram is useful for communities, support bots, and Mini Apps, but an account, channel, or bot can imitate a legitimate project. The reliable question is not whether a message looks professional. It is whether the identity, domain, contract, transaction, and claim can be independently verified.
Stop before you respond
Urgency is a control technique. Pause when a message says an account will be closed, a claim expires immediately, a wallet must be “verified,” or a fee is needed to release funds. Do not click the link, reply with personal information, or sign a wallet request while investigating.
Never share a recovery phrase, private key, Telegram login code, password, or remote-access session. Legitimate support cannot use those secrets to repair a wallet. A request for a “test transfer,” “unlock fee,” or “recovery deposit” is not proof that recovery is possible.
Identity and domain verification
Find the first-party route
Open the project’s official website from a known source, such as its published documentation or a verified app listing. Then follow the Telegram handle and domain linked there. Do not treat a forwarded message, search advertisement, channel directory, logo, or subscriber count as authentication.
Compare the exact username and domain. Impersonators often add a character, change a hyphen, use a look-alike Unicode character, or move the support conversation to a new account. A blue check or familiar avatar is only one signal; it does not establish that a payment or contract is safe.
Check the message context
Inspect whether the sender can actually publish in the official channel, whether the offer is described in the project’s documentation, and whether the same instruction appears through another first-party route. Do not rely on an image capture: captures omit the sender, timestamp, edited status, and destination URL.
For Telegram account security, read the Telegram FAQ security guidance. Use Telegram’s in-app reporting controls for spam, impersonation, and abusive messages.
Contract and transaction checks
Identify the contract
A token name, ticker, collection image, or Telegram username is not a contract identifier. Copy the address from the project’s official documentation and compare it with an independent explorer. Check the network, code or verified metadata where available, deployment history, and whether the project has disclosed administrator controls.
For TON, use the project’s documented address and an independent explorer such as Tonviewer. For other networks, use the explorer named by the project’s official documentation. If addresses differ, stop and ask through a first-party support route—not the account that sent the unsolicited message.
Read wallet prompts
Before signing, verify recipient, asset, amount, attached network fee, payload, deadline, and any approval or operator permission. Reject requests that transfer an unrelated NFT, approve an unfamiliar spender, or require a seed phrase. A valid signature can authorize a malicious contract; the wallet cannot judge the project’s intentions for you.
After signing, save the transaction hash and inspect the result in an independent explorer. A successful transaction can still be the wrong transaction. If a transfer is irreversible on the network, a support agent cannot simply “reverse” it.
For Telegram Mini Apps, read the official Web Apps documentation. A Mini App is a web application launched through Telegram; its presence inside Telegram does not certify the publisher. For wallet connection requests, consult the TON Connect documentation and review every transaction request separately.
Common Telegram scam workflows
Fake support
An attacker watches public questions and privately offers help. They request a login code, recovery phrase, screen share, or remote access. Close the chat and open support from the service’s official website or in-app help menu. Do not continue because the account knows details about your public question.
Fake claim or airdrop
The message promises tokens or a collectible and asks for a wallet connection, a fee, or a signature. Verify eligibility and the claim contract through the project’s official documentation. Treat an unsolicited link as hostile until independently confirmed. Internal guides on airdrop verification and Mini App safety provide related checklists.
Recovery scam
After a theft, another account promises to recover the funds for an upfront payment or asks for access to the wallet. This is a second scam pattern. Record the incident, secure remaining accounts, and contact the exchange or service through its official channel. Do not give a stranger control in the hope of reversing an on-chain transfer.
Fake marketplace or investment group
The group displays fabricated balances, profitable claims, or a “withdrawal tax.” A balance in a website is not evidence of an on-chain asset. Test the withdrawal route independently, identify the legal entity and terms, and never pay a fee to unlock a balance that cannot be verified on-chain.
Preserve evidence
Evidence is most useful when preserved before blocking or deleting the account. Save:
- the sender’s exact username, numeric ID if visible, and channel or group link;
- the message link, original text, attached files, destination URL, and visible timestamps;
- image captures showing the full context, while redacting your own secrets;
- wallet addresses, contract addresses, network names, and transaction hashes;
- email headers, exchange ticket numbers, payment receipts, and device details;
- a short timeline stating when you received the message, clicked, signed, paid, or noticed the loss.
Do not edit the original files. Keep copies in a location the suspected account cannot access. Preserve UTC timestamps when exporting logs, and note any local timezone conversion. Never upload a recovery phrase or private key as evidence.
Reporting workflow
Telegram
Use Telegram’s built-in report function on the message, account, channel, or group. Include the original message link where available and describe the impersonation or malicious request. If the account is pretending to be a public person or service, use the current reporting instructions in the Telegram FAQ.
Financial and cybercrime reports
For a US-linked internet crime, submit the evidence to the FBI Internet Crime Complaint Center (IC3). The FTC cryptocurrency scam guidance explains consumer reporting and common patterns. For commodity or derivatives fraud, consult the CFTC complaint and tip resources. For investment-offer concerns, use the SEC Investor.gov questions and complaints page.
Use the regulator or police service in the victim’s jurisdiction where appropriate. A report does not guarantee recovery, but complete identifiers and transaction hashes improve the chance that reports can be linked.
If your account or wallet is compromised
Secure the email account and Telegram account first: change passwords from a clean device, terminate unknown sessions, and enable two-step verification. For a custodial service, contact support only through its official help centre and ask it to freeze or review the account.
If a self-custody recovery phrase or signing device was exposed, treat the wallet as compromised. Create a new wallet from a clean environment and move remaining assets only after checking every destination. Disconnect suspicious Mini Apps and review wallet permissions. Do not reuse the exposed phrase.
If funds were transferred on-chain, preserve hashes and report quickly to the exchange, wallet provider, explorer, and relevant authorities. Blockchain transfers may be irreversible; anyone promising guaranteed recovery for a fee is another warning sign.