Business Email Compromise on Telegram
Fraudsters use Telegram to impersonate colleagues or suppliers and push fraudulent payment instructions, exploiting the app's anonymity to pressure finance staff.
Part of: Business Email Compromise (BEC)
Last reviewed: 1 June 2026
Business email compromise tactics also appear on Telegram, where username-based identities and easy anonymity let an attacker pose as a colleague or supplier with little to verify. A message urging an urgent payment can carry surprising authority when it arrives under a familiar name.
Telegram's reputation for privacy and its use in some business contexts give an impersonator cover. Finance staff who already use the app may not pause to question a payment request there, which is exactly the gap the scam relies on.
How this scam works on Telegram
The attacker messages a finance or operations employee on Telegram posing as an executive, colleague, or supplier contact, sometimes explaining the channel choice as a matter of convenience or discretion. They may reference a real project or invoice to seem credible.
The request mirrors business email compromise: an urgent transfer, a change of payment details, or sensitive data, framed as time-critical and confidential. The username-based identity and informal channel discourage formal verification.
If the employee complies, the funds reach a criminal account. Because Telegram identities are not tied to a verifiable corporate identity, tracing the impersonator afterwards is difficult, and the loss is usually found only later.
Common red flags
- A Telegram account using a colleague or supplier name contacting finance
- An urgent payment or bank-detail change requested through chat
- A stated reason for using Telegram over normal channels
- Reference to a real project or invoice to build credibility
- A username that matches no verified company contact
- Pressure to act immediately and confidentially
How to protect yourself
- Verify any payment request by phone on a known number
- Treat username-based identities as unverified by default
- Apply dual authorisation to transfers regardless of channel
- Confirm bank-detail changes through an independent, known contact
- Remind staff that colleagues and suppliers can be impersonated on Telegram
- Keep payment approvals within official, auditable systems
How to report it
- Report the account using Telegram's in-app reporting feature
- Notify your bank immediately if a payment was made
- File a report with your national cybercrime or fraud centre
Frequently asked questions
Is a payment request from a colleague on Telegram trustworthy?
Treat it with caution. Telegram identities are based on usernames anyone can choose, so a name proves nothing. Verify any payment or bank-detail request by phone on a known number before acting, and apply your normal approval checks.