Business Email Compromise on Telegram
Fraudsters use Telegram to impersonate colleagues or suppliers and push fraudulent payment instructions, exploiting the app's anonymity to pressure finance staff.
Part of: Business Email Compromise (BEC)
Last reviewed: 1 June 2026
Business email compromise tactics also appear on Telegram, where username-based identities and easy anonymity let an attacker pose as a colleague or supplier with little to verify. A message urging an urgent payment can carry surprising authority when it arrives under a familiar name.
Telegram's reputation for privacy and its use in some business contexts give an impersonator cover. Finance staff who already use the app may not pause to question a payment request there, which is exactly the gap the scam relies on.
How this scam works on Telegram
The attacker messages a finance or operations employee on Telegram posing as an executive, colleague, or supplier contact, sometimes explaining the channel choice as a matter of convenience or discretion. They may reference a real project or invoice to seem credible.
The request mirrors business email compromise: an urgent transfer, a change of payment details, or sensitive data, framed as time-critical and confidential. The username-based identity and informal channel discourage formal verification.
If the employee complies, the funds reach a criminal account. Because Telegram identities are not tied to a verifiable corporate identity, tracing the impersonator afterwards is difficult, and the loss is usually found only later.
Common red flags
- A Telegram account using a colleague or supplier name contacting finance
- An urgent payment or bank-detail change requested through chat
- A stated reason for using Telegram over normal channels
- Reference to a real project or invoice to build credibility
- A username that matches no verified company contact
- Pressure to act immediately and confidentially
How to protect yourself
- Verify any payment request by phone on a known number
- Treat username-based identities as unverified by default
- Apply dual authorisation to transfers regardless of channel
- Confirm bank-detail changes through an independent, known contact
- Remind staff that colleagues and suppliers can be impersonated on Telegram
- Keep payment approvals within official, auditable systems
How to report it
- Report the account using Telegram's in-app reporting feature
- Notify your bank immediately if a payment was made
- File a report with your national cybercrime or fraud centre
Frequently asked questions
If a Telegram account has a verification checkmark or badge, does that confirm it's genuine?
Not necessarily for this kind of impersonation — verification features, where they exist, typically confirm only that an account matches a claimed username, not that the person is who they say they are in a private conversation. Treat any such badge as inconclusive and verify the person through a phone call or another channel you already trust.
We paid after a Telegram request — can the payment be traced or reversed?
Contact your bank or payment provider immediately, since options depend heavily on the payment method and how quickly you report it. Also report the Telegram account and file a report with your national fraud authority — tracing anonymous accounts is difficult, so acting fast on the payment side matters most.
Is a payment request from a colleague on Telegram trustworthy?
Treat it with caution. Telegram identities are based on usernames anyone can choose, so a name proves nothing. Verify any payment or bank-detail request by phone on a known number before acting, and apply your normal approval checks.