How Telegram impersonation scams work

The scam is borrowed trust

A Telegram impersonation scam begins with a simple substitution: the person or organization you think you are talking to is not the one controlling the conversation.

Everything after that can change. The fake identity might ask for a Telegram login code, send a phishing link, offer account support, request a loan, promise to recover lost crypto or tell you to move funds somewhere “safe.” The impersonation is the wrapper. The payload is whatever the scammer thinks you are most likely to do.

This is part of a much larger fraud category. In a 2026 data release, the Federal Trade Commission said people reported $3.5 billion in losses to imposter scams during 2025. That figure covers many channels, not Telegram specifically, but it explains why the tactic keeps appearing: borrowing an identity can be more persuasive than inventing a story from scratch.

The Telegram version is especially easy to misunderstand because there are two very different situations that can look almost identical on screen.

One is a copy. The scammer uses a familiar name, photo, branding or near-matching username.

The other is a takeover. The message comes from a real account that the scammer has already compromised.

The second is much harder to spot because the account itself may genuinely belong to your friend, colleague or community admin. The person behind it has changed.

A typical impersonation chain

Most variants move through the same sequence.

First comes recognition. The account looks like an admin, support agent, friend, founder, government official or brand you already know.

Then comes context. The message refers to something plausible: a question you just asked in a public group, an account-security problem, a withdrawal, a giveaway, a frozen account, a mutual contact or money you already lost.

Then comes pressure. You are told the problem is urgent, the opportunity is temporary or the process must happen privately.

Finally comes the action the scam actually needs: disclose a code, follow a link, send money, reveal credentials or hand control of another account to the impersonator.

That is why the best question is not “does this profile look real?” It is “what action is this identity trying to make me take?”

The three versions worth recognizing

A copied admin or support profile

This is the classic community scam. You ask for help in a public Telegram group. A private message arrives shortly afterward from an account carrying the project logo and the name of an admin or support person.

The timing does much of the persuasion. The scammer does not need to know much about you. Your public question already revealed that you have a problem and are waiting for someone authoritative to solve it.

A copied profile can look convincing at a glance while still being a different account. Telegram says public usernames can be searched globally and can allow people who do not know your phone number to contact you. The platform’s FAQ is therefore useful for understanding the distinction between a recognizable profile and the account you actually intended to reach.

A genuine organization may also publish a strict support policy elsewhere. The safest comparison is not the stranger’s bio; it is the support route linked from the organization’s own website or established official channel.

A real account that has been taken over

This version removes the easiest warning sign: the username may actually be correct.

A joint advisory from the Singapore Police Force and Cyber Security Agency of Singapore documented schemes in which scammers used already-compromised Telegram accounts to target the victim’s contacts. Some victims were tricked into exposing Telegram login codes through screenshots or fake verification flows. Once the next account was taken over, it could be used to approach another set of contacts.

That creates a chain of borrowed trust. Each new victim can become the next convincing sender.

It also explains why “but this message came from my friend’s real account” is not enough. If the request is unusual — money, codes, account access, a strange link — verify it through another route you already trust.

A cloned channel, group or bot

The identity being copied does not have to be a person. A scammer can imitate the branding and language of a project, support channel, community or automated service and use it to distribute a fraudulent announcement or move users into private conversations.

Telegram verification can help here, but it needs to be read correctly. Telegram’s verification guidelines say its own verification program applies to large and active official channels, groups and bots. Telegram does not currently give its own verification check to ordinary user accounts, although approved third-party organizations can apply separate verification icons to users and chats.

A badge is therefore one signal, not a universal answer. More importantly, Telegram says verification identifies an official source; it is not an endorsement of everything that source says.

What the scammer actually needs from you

The story changes. The useful part is the request.

The request	What may actually be at risk
“Send me the Telegram code you just received.”	Your Telegram account. Telegram says its account login codes should never be shared.
“Send a screenshot of this chat/search/result.”	Information visible in the screenshot, which can include a login code or other security-sensitive context.
“Use this support or verification link.”	Login credentials, personal information or access to another service.
“Move your funds to protect them.”	The money itself. This is a common support-impersonation pretext.
“Pay a fee so we can recover your lost funds.”	More money, often from someone already victimized once.
“Send your wallet recovery phrase/private key so I can fix it.”	Control of the wallet and its assets.

The FBI’s cryptocurrency-exchange impersonation warning describes the same pressure pattern outside Telegram: an unsolicited contact claims there is a security problem, creates urgency, then asks the victim to provide information or follow a link. The platform can change while the social engineering stays almost identical.

Real authority can be impersonated too

One of the strongest recent examples did not involve a random crypto admin.

On 20 July 2026, the FBI warned that scammers were impersonating FBI and Internet Crime Complaint Center personnel. In one documented variant, a person who had already been scammed was contacted by someone pretending to be an FBI agent, with the impersonator communicating through Telegram and directing the victim toward a fraudulent “recovery” process.

The useful detail is not that the profile looked fake. It is that the claimed communication route contradicted the real organization’s policy. IC3 says it does not maintain a social-media presence and does not recover funds through Telegram or similar platforms.

That is a much stronger test than visual polish.

Verify the route, not the appearance

The fastest way to break an impersonation scam is to leave the conversation that created the pressure.

If an account claims to represent a company, open the company’s website yourself and find its documented support or Telegram link. If the message claims to come from a group admin, return to the group you already know and inspect the admin list rather than trusting the name in the DM. If it claims to be a friend, contact that person through another established channel before sending money or sharing anything sensitive.

For channels, groups and bots, an authentic Telegram verification badge can help identify an official source. For people, the absence of a Telegram check is not automatically suspicious because Telegram does not currently verify ordinary user accounts itself. The point is to compare the account against a source you reached independently.

And treat the display layer as weak evidence. A name, avatar, bio and familiar writing style can all support recognition without proving control. The same principle applies to screenshots used as online proof: appearance is evidence of what you saw, not automatically of who was behind it.

Login codes deserve their own rule

Telegram’s guidance is unusually clear: Telegram account login codes are sent through the verified service notification chat named “Telegram” and should never be shared.

That matters because some takeover scams do not simply ask “what is your code?” The Singapore advisory documented more indirect tricks, including getting victims to send screenshots that happened to expose a login code. The request can sound harmless even when the information inside the screenshot is not.

Telegram also supports Two-Step Verification and passkeys. A second password can prevent a login from succeeding with the phone-number code alone, while Telegram describes passkeys as a more secure additional login method. If the term is unfamiliar, our passkey explainer covers what changes when a login is tied to a cryptographic credential instead of a reusable password.

No security setting makes a fraudulent message trustworthy. It changes what the attacker can do after you make a mistake.

If you already interacted with the impersonator

If you only replied, stop the conversation and verify the account independently before doing anything else.

If you shared a Telegram login code or believe someone entered your account, Telegram’s FAQ directs users who still have access to another device to open Settings > Devices or Privacy & Security > Active Sessions and terminate the unwanted session. Turning on Two-Step Verification adds another password to future logins. If the account was used to message other people, warn those contacts through a channel the attacker does not control.

If you gave away credentials for another service, go to that service directly — not through the link in the Telegram conversation — and follow its account-recovery process. If money was transferred, contact the bank, exchange or payment provider immediately. Recovery impersonation is itself a common second scam, so an unsolicited person promising to retrieve lost funds for an upfront payment should not be treated as a solution.

Telegram says messages can be reported through the app’s Report function. Its FAQ separately says that if a scammer is pretending to be you, the impersonation can be reported to @NoToScam.

The useful mental model

Telegram impersonation scams work because identity is doing two jobs at once.

The profile tells you who you think is speaking. The scammer uses that belief to influence what you are willing to do next.

Break the link between those two steps. A familiar identity can justify checking. It should not, by itself, justify sending money, sharing a login code, exposing a recovery phrase or following an unexpected support link.

The safest habit is simple: when the request becomes sensitive, leave the conversation and re-enter through a route you already know is real.