Fake Telegram Phishing Bot Credential Scam
Scammers deploy automated Telegram bots that impersonate official services or Telegram itself to collect usernames, phone numbers, and login codes under the pretence of verification or support.
Part of: Fake Customer-Service Chatbots
Last reviewed: 7 June 2026
Telegram's Bot API allows developers to create automated chat accounts that can interact with users conversationally. This powerful feature has been misused extensively by scammers who build convincing bots that impersonate official verification services, customer support systems, and even Telegram's own security infrastructure.
Because bots are integrated naturally into the Telegram experience — legitimate services from banks, airlines, and retailers use verified bots — users may not instinctively be suspicious of an automated conversation. A well-designed fraudulent bot can feel indistinguishable from a legitimate enterprise service chatbot.
The credential harvesting through bots is highly automated: the bot can process hundreds of victims simultaneously, collecting phone numbers and login codes that are forwarded in real time to attackers who use them to seize accounts.
How this scam works on the Telegram brand
Fraudulent bots are promoted through multiple channels: fake channel posts, direct messages from hijacked contacts, phishing links in emails, or ads in Telegram groups. The bot typically opens with an official-sounding welcome message — 'Welcome to Telegram Account Security. To verify your account, please enter your phone number.' After the phone number is collected, the bot guides the user through entering the login code sent by Telegram, completing the account takeover.
Other variants impersonate cryptocurrency exchange bots, airline booking assistants, or delivery tracking services. These bots collect financial credentials and personal data rather than Telegram login codes specifically, but often include a step that also captures Telegram session information.
Legitimate Telegram bots linked to official businesses display the 'Official' badge next to their name or are linked from the brand's verified channel. Unofficial bots have no such marker, but many users do not check for this distinction.
Common red flags
- A bot requests your phone number and asks you to forward a Telegram verification code
- The bot arrived via an unsolicited message or a suspicious link rather than from a service you intentionally subscribed to
- The bot claims to be from Telegram itself and asks for personal account details
- A 'customer support' bot asks for your username, email, and account password in sequence
- The bot uses urgent language such as 'your account will be restricted in 2 hours unless you verify now'
- The bot link came from a message that was forwarded multiple times in a channel
How to protect yourself
- Never share Telegram login codes with any bot, regardless of how official it appears
- Verify any Telegram bot by checking whether it links from the brand's official verified channel before interacting
- Enable Telegram's two-step verification to protect your account even if a login code is compromised
- Be cautious about which bots you start conversations with — once started, a bot can request your phone number
- Check Telegram's privacy settings to control which apps and bots can access your account
How to report it
- Report the fraudulent bot within Telegram by opening the bot's profile, tapping the three-dot menu, and selecting 'Report'
- Forward suspicious bot messages to @notoscam within Telegram
- Report to Action Fraud at actionfraud.police.uk (UK) or the FTC at reportfraud.ftc.gov (US)
- If your account was taken over, contact Telegram Support at telegram.org/support
Frequently asked questions
Are all Telegram bots dangerous?
No. There are thousands of legitimate, useful Telegram bots built by reputable companies and developers. The risk is from bots that were not built by who they claim to represent, or that request sensitive information like login codes and passwords. Verify a bot's legitimacy by checking whether it is linked from the company's verified official channel.
Can a Telegram bot access my account without a login code?
A bot that you start a conversation with cannot access your Telegram account directly. The danger is when the bot tricks you into providing the information needed for an attacker to access your account manually — such as your phone number and the login code sent by Telegram's authentication system.
What makes a Telegram bot 'official'?
Official bots for notable brands can receive a blue verified badge from Telegram. Outside of this, you can check whether a bot is linked from the brand's own verified Telegram channel, or from the brand's official website. A bot without these endorsements should not be trusted with sensitive account information.