Virtual scammers invent new ways to scam every day and co-opt victims through all available channels: emails (phishing), WhatsApp calls impersonating another person, text messages with apocryphal links or fake job offers or fraudulent investment schemes. How to recognize a scam on Telegram?
Telegram scams
With over 800 million monthly active users, Telegram is one of the most popular instant messengers in the world. This large number of users and the supposedly high level of security attract not only honest users, but also hackers and cybercriminals. They try to steal personal data and deceive people through targeted fraudulent actions.
So how do scammers scam users, and how can you protect yourself while using the messenger? In this article, you will learn about the most common types of scams that Telegram users encounter, and what you can do to avoid becoming their victim. The most common scam schemes on Telegram look like this:
1. Phishing bots and data sales
Phishing scams using bots on the platform have become more common in the messenger. This is evidenced by a study by digital security experts at Kaspersky Lab. In addition, criminals are using the application's functionality to sell stolen data, such as bank accounts, etc. According to experts, they use bots to automate a wide variety of illegal actions. Two main examples are the creation of phishing pages and the collection of people's data in the application.
According to Kaspersky, the process of creating fake sites in the messenger is simple and free. The attacker simply needs to subscribe to the bot creator’s channel, select a language, create the bot, and start sending a signal to the main simulator. All they need to do is share the bot to receive data from victims who click on phishing links on the fake page. From there, cybercriminals can collect personal information, such as email and IP addresses, phone numbers, and even account passwords.
Messenger has already faced obstacles when it comes to hacking bots like Z-Library and WishFlix, which were banned from GitHub and TikTok. So, the stolen data is being put up for sale.
According to Kaspersky experts, scammers offer paid services using the TG phishing bot model. They sell “VIP pages” costing from 10 to 300$, which are created from scratch for those who don’t want to bother. These sites have a wide range of advanced features aimed at more targeted fraud.
These VIP pages may have elements of social engineering, such as offering the user attractive earnings. There is even protection from detection, which should appeal to those who want to run a scam but are afraid of the authorities. Once the criminals have obtained the victim's data, they put it up for sale for hundreds of dollars. They provide relevant information, such as bank account balances and related options.
Don't give in to temptation. Remember that in the pursuit of cheap chips, you will lose much more.
2. Fake job offer and investment schemes
Scammers are using them as bait to scam people on social media, offering easy money in exchange for simple tasks. This practice, known as “extra income scams,” has spread rapidly and requires users to be extra vigilant.
How does it work? Criminals approach through various digital platforms such as WhatsApp, Facebook, Tik Tok, etc., posing as representatives of a company specializing in reviews and likes, the most famous of which are currently called Microworkers, Clickworker and Amazon Mechanical Turk, but others work on a similar principle. If the victim shows interest, they are redirected to groups in TG, which supposedly have thousands of members and contain fictional stories of success stories.
The attractive thing is the fact that you can earn part-time without interfering with your other job, if you have one. You only need to like videos on digital platforms and send screenshots, there are no membership fees. The initial cost of one like is 4$ for each video. First, while in the Whatsapp environment, you need to like 4 TikTok videos and you are guaranteed to receive 20$. As soon as you are added to the group by a person called the "administrator", the tasks begin, which are set at 20 tasks per day, and once they are completed and you accumulate 20 dollars, you will have the right to request a withdrawal.
It turns out that starting from the fourth task, the victim will have to pay the “investment cost” of the pre-paid tasks, which varies from 120 to 1000$, with promises of a return of 30% to 100% of the deposit, as reported by the victims. If you do not make the “investment”, the tasks are reduced from 4 to 1$ per liked video. After the victim has made a transfer, she is referred by a “mentor”, who adds her to another group, usually called a “Working Group”. In this group, only the mentor can post messages, and he does so daily, sharing evidence of transfers via a third-party card, which, according to him, are “wages” for the services provided by him.
This "mentor" also points out that there are other groups called VIPs, where only the service providers receive much larger amounts because they invest more, which in turn encourages the victim to invest more.
What happens after the “investment” is made? In some cases, victims are blocked when they can prove that they have transferred the “invested amount”, leaving them “with nothing”. Others, more gullible, are offered to register on a cryptocurrency website (Btcinvestd.com or the Bitforex app), and each amount sent is invested in cryptocurrency. But the interesting part is just beginning: they promise to return the investment plus profit through the “administrator”, which is about 30 percent larger, but this transfer is not saved.
After that, they point to 4 more like tasks on platforms like TikTok and others, after which they start tasks that require “investments” but with larger amounts, the minimum of which is 250$ in cryptocurrency. In this first “paid task”, the victim can withdraw the invested amount plus a bonus, totaling 350$ in cryptocurrency.
However, the subsequent “investments” are much larger, which prevents the victim from continuing to “invest.” They also have problems getting the money back because they offer to make the return of the invested amount conditional on new deposits of even larger amounts, so they never return it and always ask for new ones.
At this stage, the victim exits the “scam” and asks for a refund of the invested money plus the earnings on the cryptocurrency wallet. But even after following the “mentor’s” instructions, the money never arrives in her checking account. After several unsuccessful attempts to contact him, he informs her that the amount on the wallet is “blocked” because she made some wrong purchase on the cryptocurrency website. Since this is the work of the platform itself, there is nothing they can do about it. Or they claim that in order to withdraw the funds, a certain amount needs to be transferred, and then this amount will be returned together, which in practice does not happen.
As stated in the Kaspersky article, do not transfer cryptocurrency to an unknown or unrecognized wallet. When it comes to cryptocurrencies, it is recommended to use a security system that warns you, for example, about phishing cryptocurrency links. In Telegram, you can use @wallet-bottom, the official wallet of the platform, launched in 2023, which will warn you about suspicious transfers.
3. Fake manager
This scam can take many forms. One is an offer via email of “senior discounts” for a streaming platform, but often the attacker pretends to be a manager, such as a Netflix manager. The goal: to obtain bank details and empty accounts. In other cases, the cybercriminal may also pose as a manager of other platforms (depending on the region), under the pretext of authorizing a purchase.
In addition to this scam, there is a fake email called “Keep Watching Your Favorite TV Shows and Movies,” with messages that may vary slightly. They state that the Netflix account has been canceled due to a problem with the “Payment Collection Center,” with a red button that says “Update Account Now.” Clicking on this button will take you to a fake page with fields to fill in personal information, including credit or debit card details. This message can also be sent via SMS, but the ultimate goal is the same: to steal users’ bank details.
4. Fake groups
Many users appreciate TG for its thematic channels and groups, often offering interesting discussions and content. However, scammers use this feature to create deceptively real fake versions of popular channels. They look exactly like the originals, from the profile photos and admin names to the messages they share. However, in reality, these are fake groups created to lure users into a trap.
Scammers mimic legitimate activities and ask users to click on malicious links. These links often lead to phishing pages where you are asked to reveal personal information or even your crypto wallet information.
How to recognize them? An important sign of a fake channel is that it allows posting only on behalf of the administrator. Check whether the ability to post a message in the group is available or whether it is only available to administrators. Fraudulent channels often do not allow interaction with users to avoid questions and discussions.
5. Crypto expert scam
Cryptocurrencies have found a loyal audience in the TG, and with them, scammers have appeared. They present themselves as crypto experts or financial advisors and promise high, "guaranteed" profits from supposedly safe investments. They lure their victims into special groups (ICO scams and others), or contact them directly to convince them to invest in dubious cryptocurrency platforms.
Victims are often promised unrealistically high profits — sometimes up to 50 % within a few days. The attackers present you with detailed charts and reports that are supposed to make your investments “grow.” But when you try to withdraw your profits, this option suddenly becomes unavailable.
How to spot it: Be suspicious if someone promises high returns without risk. Offering an “exclusive” cryptocurrency exchange or trying to pressure you into making a quick decision is also a red flag.
6. Romantic scam
Love scams, also known as romance scams, are not uncommon on TV. Scammers pretend to be interested partners in order to establish an emotional connection with their victims. After a few weeks of virtual relationships, they ask for money for “urgent” expenses or lure the victim into supposedly profitable investment opportunities. Sometimes, the attackers also ask for intimate photos or videos, which are then used for blackmail, a method known as “sextortion.”
How to spot them: Scammers insist on a quick, intense relationship but avoid meeting in person or video calling. If they suddenly make financial demands or ask for gift cards, be extremely cautious.
7. Gift scam
One of the oldest tricks in the world of online fraud is the promise of free gifts or prizes, and this scam is also popular in TG. Bots or fake accounts contact users and claim that they have won a prize, for example – Bitcoin. However, this is just a bait. In order to receive this prize, users are asked to provide bank details or cryptocurrency wallet details, or to pay a “commission” in advance.
How to understand that it is a scam? If you did not participate in the prize draw, and then suddenly you receive a prize - how to understand it? A gift of fate? No! Another tip - the requirement of prepayment. Never pay a commission in advance to receive the alleged prize. Block the account and report the incident.
Kaspersky also recently conducted phishing detection tests using ChatGPT, obtaining both satisfactory and not entirely encouraging results.
Conclusion
Unfortunately, the rise in popularity of the Telegram scam has led to an increase in criminal activity on the platform. With improved automation features, cybercriminals have turned Telegram into a new avenue for Dark Net activities, including phishing, selling stolen data, and more. It is important for individuals and security experts to be vigilant and understand how to avoid Telegram scams.
