Telegram Scams: How to Check an Account Before You Pay

Somebody wrote to you first. The offer is fine, the profile photo is fine, the replies come quickly and in reasonable English, and the only thing standing between you and the transfer is a feeling you cannot name. Most advice at this point is a list of vibes. Look for typos, be suspicious of urgency, trust your gut. None of that is checkable, and none of it survives contact with somebody who has done this a hundred times.

There is a better approach, and it is hiding in plain sight. Telegram itself publishes a set of machine readable facts about every account and every channel, and your app already receives them before you send a single word. Some of them are shown to you in the bar at the top of a new chat. Some sit in the profile where nobody looks. Two of them are warnings that Telegram attaches to accounts on its own initiative. None of them require a tool, a bot or a paid service to read.

This article walks through all of them in the order you would actually use them, and it is honest about the ones that prove nothing. Every field, flag, error and limit quoted below was pulled from Telegram's own documentation and live configuration on 9 August 2026, from forty two addresses in one pass. There is no dedicated scam page in that documentation, which is part of why this information is so poorly known.

What Telegram Already Tells You About a Stranger

When somebody who is not in your contacts writes to you, your app quietly asks the server for a small object describing that conversation. That object is where the useful facts live, and most people never learn that it exists. It carries a set of switches about what you are allowed to do next, and, more interestingly, a handful of plain facts about the person on the other side.

The registration month

The first field worth knowing is the one that tells you how old the account is. The documentation describes it as a string used to display the user's registration year and month, in a month and year format where the month runs from one to twelve. That is not a guess derived from an account identifier or from folklore about number ranges. It is the registration date, published by the platform, in the bar at the top of the chat.

Use it as a floor rather than a verdict. An account registered three weeks ago that is offering to sell you something expensive deserves a much slower conversation than one registered in 2019. An old account is not automatically safe, because old accounts are themselves traded, but a brand new account claiming a long reputation has just contradicted itself in a place it cannot edit.

The country the phone number came from

Alongside it sits a field the documentation describes simply as the country code of the user's phone number. You do not see the number, and privacy settings do not need to be relaxed for this to appear. You see the country. That is a useful thing to know about a platform where almost everything else about a person can be hidden behind a setting, as the ten switches behind last seen and the rest of the privacy panel demonstrate.

This matters because a story and a number often disagree. Somebody presenting themselves as a long established business in one country, on a number registered in another, has not proved anything against themselves, but they have created a question worth asking out loud. The answer to that question, and how it is delivered, tells you more than the field did.

When the name last changed

Two more fields record change dates rather than values. The first records when the user's name was last changed. A profile that has carried the same name for two years behaves differently from one renamed yesterday, and renaming is the cheapest step in impersonation. Somebody who wants to look like a person you already trust changes the name and the photo, and both of those actions leave a timestamp that they cannot remove.

When the photo last changed

The second records when the photo was last changed. Read the pair together rather than separately. A years old account whose name and photo both changed within the last few days is the exact signature of a purchased or recovered account being dressed up, and it is the single most useful combination on this list. Neither timestamp accuses anybody of anything by itself, which is precisely why both are worth reading before you decide how much of your own time to spend.

The Two Labels Telegram Puts on Accounts Itself

Beyond the facts, Telegram maintains two warnings that it attaches to accounts and to chats directly. They are separate flags with separate meanings, and the difference between them is the difference between a suspicion and a count.

The scam flag

The first is a bit on the user object, and its published description is four words long. This may be a scam user. The same flag exists on channels and supergroups, where the wording is that the channel or supergroup is probably a scam. It also exists on the preview you get for an invite link before you join anything.

The hedging in that wording is deliberate and you should keep it. The label is a warning, not a conviction, and it does not tell you who applied it or when. What it does tell you is that the platform itself considered this account worth marking, which is a far stronger signal than a stranger's opinion in a group chat.

The fake flag

The second flag has a different origin, and the documentation says so explicitly. If it is set, the user was reported by many users as a fake or scam user, and the sentence ends with an instruction to be careful when interacting with them. The channel version repeats the same wording for supergroups and channels.

So one label reflects an assessment and the other reflects volume of reports. Neither is common, and that is the point. When you do see one, the correct response is not to argue with it in the chat, because you are not talking to the system that applied it. The correct response is to stop the transaction.

What neither label promises

Here is the part that gets people hurt. The absence of both flags means nothing at all. New accounts have not been reported by anybody yet, which is exactly why the account writing to you is often new. Treat a clean profile as the normal state of the world rather than as a clearance, and keep reading the fields that do not depend on anybody else having complained first.

The Verified Badge Is Not What You Think

Verification on Telegram is now two different things wearing similar clothing, and the difference is worth ten minutes of your attention because it is routinely misrepresented.

Platform verification

The original one is a flag on the user object and on the channel object, and the channel version is documented in the plainest possible terms as whether this channel is verified by Telegram. It applies to a small number of public figures, organisations and official channels. Nobody sells it, and anybody offering to arrange it for you is selling something that does not exist in that form.

The third party badge that arrived quietly

The newer one is easy to mistake for the first. Telegram's documentation says that official third party services are able to assign extra verification icons to user accounts and chats, and it states the purpose in the same sentence, which is to prevent scams and reduce misinformation. The mechanism is a bot that Telegram itself has verified, and the settings behind it carry an icon, a company name and an optional custom description.

That is genuinely useful, and it is also a new surface for confusion. A badge granted by a third party is a statement by that third party, not by Telegram, and the company name attached to it is the thing you should actually be reading. A verification icon whose company you have never heard of has told you who vouched, and nothing more. If you run bots of your own, the same icon can appear on them, which is one of the things worth watching from a single place rather than app by app, and the reason Bot Manager exists.

What a badge does not prove

Neither kind of badge says anything about whether a particular transaction will complete. A verified channel can be run badly, and a verified account can still be having a bad month. Verification answers the question of identity, not the question of conduct. Confusing those two is the most expensive small mistake on this list, and it is the one that sellers rely on when they lead with a screenshot of a badge.

Restrictions, and the Setting That Hides Them

There is a third state that most people never notice, sitting between fine and flagged.

The restriction reason

Both users and channels carry a flag meaning that access must be restricted, and when it is set, a companion field explains why. The structure of that explanation has exactly three parts. A platform identifier, a short reason keyword with published examples such as terms, and a text message to be shown to the user. That third part is the sentence your app displays when it refuses to open something.

The list that can ignore them

Now the part that surprises people. The documentation for that reason field says to ignore the restriction if it appears in a named list in the client configuration. In other words, restrictions are advisory to the app, and an app can be configured to skip them. When we read the live configuration this turn, that list was empty, and so was the companion list of platforms to which restrictions are added.

The practical lesson is not about those two empty lists. It is that what one app shows you and what another app shows you can legitimately differ, because the enforcement of this particular signal happens on your side of the connection. If a stranger tells you their channel looks fine on their phone, they may be telling the truth and it may still be restricted for you.

Restriction also arrives from the other direction, on accounts that have been limited for sending unwanted messages rather than for content. That is a different mechanism with a different appeal route, and confusing the two wastes a week. A restricted counterparty is not automatically dishonest, but they are somebody the platform has already had a conversation with.

Reading a Profile Properly

Once the chat is open, a fuller object arrives with far more in it than the profile screen suggests. Four of its fields are worth learning by name.

Chats in common

The full user object carries a count of chats in common with this person. It is a small number and it is easy to dismiss, but it converts an anonymous stranger into somebody with a traceable history you can actually inspect. If you share a group, you can read how they behave in it, over months, without asking them anything. That is the cheapest reference check available on the platform, and it costs one tap.

The bio and the personal channel

The same object carries the bio text, and a field pointing at an associated personal channel that should be shown on the profile page, along with the identifier of its latest message for the preview. A personal channel is a small commitment of effort over time, and effort over time is the one thing a disposable account does not have. Read the channel rather than counting its subscribers.

Gifts, birthdays and the things that look like history

Three more fields exist purely to make a profile look lived in. There is a count of gifts the user has chosen to display, a birthday field, and the business fields covering working hours, location, greeting and away messages. All of these can be set in a minute, and the gift count in particular is now something that can be bought outright. Treat them as decoration rather than evidence, and be aware that a profile which is heavily decorated and three weeks old has spent money to look older than it is.

The warning about unofficial clients

The most interesting field in the whole object is one almost nobody has heard of. The documentation says that if it is set, this user is on an unofficial Telegram client, that messages sent to them may be less secure, and that clients should display a warning. Read that carefully, because it is not an accusation. Plenty of legitimate people use alternative apps. What it does tell you is that the other side is running software neither of you can audit, which is worth knowing before you send anything you would not want copied automatically. If you run many accounts yourself, this is also the flag your counterparties are reading about you, and keeping that side clean is part of what Account Manager exists to do.

The Profile Rating Is a Spending Score

A newer badge has appeared on profiles and it is being read as a trust score. Telegram's own explanation makes clear that it is not one.

What the badge counts

The published answer says that profiles show a badge with a numerical rating based on the total volume of successful transactions that user has made with Telegram Stars, and that it helps channel owners see the user can be trusted for suggested posts and similar requests. So it is a real signal, it is derived from real spending, and it has a specific intended use.

What moves it in each direction

The same answer lists the mechanics without varnish. Purchasing gifts, sending paid messages and funding suggested posts with Stars all increase the rating. Refunding Star purchases or converting gifts back to Stars decreases it. That is a spending record with a small penalty for reversals attached.

Why that makes it weak evidence

Read as a trust score, a number that rises with spending is exactly backwards for the situation you are in. Somebody planning to take a large payment can afford to raise the number first, and the amount required is a rounding error against the target. The rating tells you that money has moved through this account. It does not tell you that the account kept its promises, and it was never designed to.

Checking a Channel or Group Before You Join

Private invite links get treated as a leap of faith, which they are not. There is a documented preview step, and every client uses it.

What the preview contains

Before you join anything, your app resolves the link and receives a preview object. It carries the title, the description, the photo, the participant count, a few of the participants, whether it is a channel or a supergroup, and whether it is public. It also carries the verified, scam and fake flags, along with the third party verification icon. Every warning discussed above is therefore available to you before you are a member of anything.

Approval queues and paid entry

Two more flags in the same preview change what happens next. One says that a join request must first be approved by an administrator. The other carries subscription pricing, because a paid channel on Telegram is not a separate product, it is an invite link with a price attached to it. If a link asks you for Stars before you have seen anything inside, you are paying for entry rather than for a service, and the preview is the only look you get.

What the numbers hide

Once inside, the full channel object carries member count, administrator count, the count of kicked and banned users, and an online count. It also carries a flag meaning participants are hidden, and a flag for whether the native antispam system has been switched on. A large member count with a hidden participant list and almost nobody online is a specific shape, and it is the same shape a channel padded with fake members makes. Counting the gap between claimed audience and observable activity is exactly what our free Channel Analytics was built for.

Usernames Are the Weakest Signal on the Platform

The name in the address bar feels like identity. It is closer to a rented street sign.

Usernames move

A username is a pointer, not a person. It can be released and picked up by somebody else, and the account underneath keeps its history while the address changes hands. Telegram's own error vocabulary makes the mechanics visible, with one error meaning the username is not valid and another meaning it is simply not occupied. An address that worked last month and resolves to nothing today has not necessarily been banned. It may have been dropped.

Collectible usernames and the marketplace

Some usernames are tradable assets. Telegram's own answer says they can be bought and sold through third party platforms, that acquiring one gives permanent ownership verified on the TON blockchain, and that owners can freely assign them to chats or sell them on. The same answer states plainly that Telegram cannot assign collectible usernames and that they can only be managed by their owners. A user, group or channel can also hold several at once, each with its own address.

The consequence is direct. A short, expensive looking username proves that somebody paid for a name. It says nothing whatsoever about the person currently holding it, and the resale market means the current holder may have arrived last week.

The domains Telegram treats as its own

The live configuration publishes a list of domains that Telegram treats as its own, and it is short. It contains the two main sites, the two message link domains, the link shortener, the translations platform and the collectible username marketplace. Anything else presenting itself as an official Telegram property is presenting itself, and this list is the cheapest way to check that claim without leaving the app.

Impersonation of Support, Staff and You

The most effective approach on the platform is not a fake seller. It is a fake helper who arrives just after you have a problem.

Where real login codes arrive

Telegram's answer on this is unambiguous and worth memorising. Login codes for your Telegram account are sent to the verified service notifications chat named Telegram in your chat list, and the answer states that they should never be shared with anyone, including other services or apps. Codes from third party services arrive in a separate verified chat used only for those codes. Anybody asking you to read a code aloud, forward it or paste it is ending the conversation, whatever they claim to be.

The official support flag

There is also a dedicated flag on the user object recording whether an account is an official support user. It is a small thing, and it settles a question that people otherwise try to settle by reading a display name. Support does not open a conversation to tell you that your account is at risk and then ask you for anything.

If somebody is pretending to be you

This one has a specific published route rather than general advice. Telegram's answer says that if a scammer is pretending to be you, contact a named account set up for exactly that, and the same section gives an automated address for takedown requests and asks that you include the links to the content in question. If you run a brand on Telegram, the useful preparation is a public page listing who genuinely represents you, which is why we maintain a list of registered partners that anybody can check before paying somebody who claims to speak for us.

The harder half is finding out that it is happening at all, because impersonation of a brand usually surfaces somewhere public before it surfaces in your inbox. Watching the places where your own name gets typed is a monitoring problem rather than a Telegram problem, and it is the job ProspectPulse does across the open platforms.

Paid Messages, Stars and Where the Money Goes

A recent set of features changed the shape of unsolicited contact, and they are worth understanding because they appear directly in the fields you are already reading.

Paid messages

Both users and supergroups can require Stars to receive a message, and the amount sits right there on the object as a number of Stars. Your own settings can require either Premium or a payment from strangers, and the requirement is exposed through a small set of documented shapes covering no requirement, a Premium requirement and a paid requirement with an amount. The live configuration this turn had paid messages available, a default channel amount of ten Stars, and a published ceiling of thirty five thousand.

The commission nobody mentions

The same configuration carries the commission on paid messages as a value in parts per thousand, and it stood at eight hundred and fifty. That is a large share, and it is worth knowing before you treat somebody's paid inbox as a sign of seriousness. It is a toll that mostly does not reach them.

Refunds and who can issue them

Refunds for Star payments have one documented route, and the direction matters. The refund is invoked by the party that received the payment, passing the identifier of the person who paid and the charge identifier from the payment notification, and a service message is emitted when it happens. There is no endpoint for the payer to claw a payment back unilaterally. Once Stars have moved, getting them back depends entirely on the willingness of the account that received them, which is the whole reason the checks in this article are worth running first.

Reporting, and What Each Reason Actually Covers

Reporting is not a formality and the reason you pick is not cosmetic.

The eight reasons

The documented list of report reasons has exactly eight entries. Spam, violence, pornography, child abuse, copyright, an irrelevant location based group, impersonation, and other. That is the complete vocabulary available to the system, and everything you write in a free text box is being sorted into one of those buckets eventually.

The one that covers impersonation

The impersonation entry is the one people miss, because its internal name says fake while its description says impersonation. If somebody is wearing the name and photo of a real business, that is the correct reason and it is not the spam one. Choosing accurately is the only lever you have over how quickly a report is understood.

Where the button is on each platform

Telegram publishes the exact route per platform. On Android you tap the message and select report from the menu. On iOS you press and hold. On Desktop, Web and macOS you right click the message and select report, then choose a reason. There is also an automated address for takedown requests by email, and the guidance asks that you include the links to the content so that moderators can find it.

Blocking, Archiving and the Quiet Failure

Two settings decide what happens to strangers before you ever see them, and one of them fails silently in a way that costs real money.

Blocking and what stays visible

The settings object carries switches for whether you can still report, add, block or share this contact, and the full profile records whether you have blocked somebody already. Blocking is cheap and reversible, and it is usually the right move the moment a conversation turns into pressure. Nothing about blocking prevents you from reporting first.

The archive setting that hides your replies

The global privacy settings include a switch that automatically archives and mutes new chats from people who are not in your contacts. If you do outreach of any kind, that switch quietly sorts your answers into a folder you never open, and the reply rate you then measure is a number your own settings produced. We wrote about where those chats end up in the archive, and the same settings object is where the Premium and paid requirements for new contacts live.

Your Own Account Is Half of the Check

Everything above assumes the account doing the checking is actually yours.

The session list

Every active session is described by a rich record. Device model, platform, system version, application name and version, creation date, last active date, last known address, and the country and region determined from it. Reading that list monthly is a two minute habit that catches the one problem no counterparty check can catch, which is that the danger is already inside your own account. It is also the list to read the moment you move to a new phone, because that is when an old session is easiest to overlook.

Unconfirmed sessions and the seven day window

Sessions carry flags for whether they came from an official app, whether they are still waiting for a second factor password, and whether they are unconfirmed. The live configuration publishes the automatic confirmation period, and it stood at six hundred and four thousand eight hundred seconds, which is seven days. A session you do not recognise becomes permanent on a timer, so the window in which noticing costs nothing is the week after it appears. If you keep many accounts at once, that review is not optional.

Passkeys and the extra password

Telegram's published answer describes passkeys as an additional login method managed in the privacy and security settings, showing the creation date and last use for each. It also carries a warning that people skip. With a passkey you can still request a code by message in order to log in, so the answer asks you to make sure your account uses an up to date phone number that you control. Adding the extra password on top is the step that turns a stolen number into a dead end.

The Two Minute Check

Put together, the sequence is short enough to run every time and it does not need a single tool. Open the chat and read the bar at the top for the registration month and the phone country. Look for the two warning labels on the account and on any channel involved. Read what the verification badge actually says and who granted it. Check the two change dates for a recently renamed or rephotographed old account. Open the profile and read chats in common, the bio and the personal channel, then discount the gifts and the birthday. Treat the rating as a spending record. If a link is involved, read the preview before joining and note whether entry is priced. Then, before anything moves, remember that the refund route runs through the other party, not through you.

None of this makes you safe, and no article can. What it does is replace a feeling with about eight facts, most of which are published by the platform and none of which the other side controls. When those facts disagree with the story you are being told, you do not need to prove anything. You just need to stop.

If your work involves talking to a lot of strangers on Telegram rather than a few, the same fields become an operational problem rather than a personal one, and reading them one profile at a time stops working. That is the part we build for, whether that is keeping many accounts and their sessions in order, watching where a conversation started, or something specific enough that it belongs in Custom Solutions. Before you decide anything, it is worth reading the honest version of how accounts are actually bought, because the checks in this article apply just as hard when you are the one paying a supplier.

Frequently Asked Questions

How can I check if a Telegram account is a scammer

Read the bar at the top of a new chat before you reply. It carries the account's registration month and year, the country its phone number belongs to, and the dates its name and photo last changed. Then look for the two warning labels Telegram attaches itself, one meaning this may be a scam account and one meaning many users reported it as fake.

Does Telegram show when an account was created

Yes, to the month. The settings object for a chat carries a registration field in a month and year format, with the month running from one to twelve, and clients display it in the action bar for people who are not in your contacts. It is a published field rather than a guess from the account identifier.

What does the scam label on Telegram mean

It is a flag Telegram sets on an account or a chat, and its published description is that this may be a scam. There is a second, separate flag whose description says the account was reported by many users as fake or a scam, ending with an instruction to be careful when interacting with them. One reflects an assessment, the other reflects report volume.

If an account has no scam label is it safe

No. The labels depend on somebody having reached that account before you, so a new account has a clean profile by definition. Absence of a warning is the normal state rather than a clearance, which is why the registration month and the change dates matter more in practice.

Can a Telegram verified badge be bought

Platform verification is not sold, and anybody offering to arrange it is describing something that does not work that way. There is now a second kind of badge that official third party services can assign to accounts and chats, and it carries the granting company's name. Read the company, because a badge is a statement by whoever issued it.

Is the Telegram profile rating a trust score

Not in the way people read it. Telegram's own answer says the number is based on the total volume of successful transactions made with Stars, that buying gifts and sending paid messages raise it, and that refunding purchases or converting gifts lowers it. It records spending, and spending can be arranged in advance.

Can I check a private Telegram channel before joining

Yes. Resolving an invite link returns a preview containing the title, description, photo, participant count and a few members, plus the verified, scam and fake flags and any third party verification icon. If the link requires approval or carries a subscription price, both of those appear in the same preview.

Someone is impersonating my Telegram account, what do I do

Telegram publishes a dedicated account for exactly this and asks you to contact it when a scammer is pretending to be you. The same section gives an automated address for takedown requests and asks you to include the links to the content. Reporting the impersonating account directly, using the impersonation reason rather than spam, is the other half.

Can I get my Telegram Stars back after paying a scammer

Only if they refund you. The documented refund call is invoked by the party that received the payment, using the charge identifier from the payment notification, and there is no equivalent for the payer to reverse it. That asymmetry is the reason the checks above are worth two minutes before the transfer rather than two hours after it.