The Telegram fake admin scam, and how to stop it

How does the fake admin scam work?

It needs no hacking. It needs your group's member list and a few minutes.

1. The account joins and watches. Often it has been in the group for weeks, silent.
2. A member asks for help. "My withdrawal is stuck." "I can't connect my wallet." "Who do I talk to about my order?"
3. A private message arrives. The sender has the same name and the same photo as one of your admins. The username differs by one character, or says "support".
4. It sounds official. A ticket number, a "verification" step, a form, a link to a "support portal".
5. It asks for one thing that gives the scammer control: a seed phrase, a login code, a wallet connection, an app install, or a fee.

The member thinks the group's admin did this. Your group takes the blame.

How do I tell a real admin from a fake one?

In a private chat you cannot tell by looking. Telegram shows an admin's title next to their messages inside the group, and nowhere else. So check from the group, not from the message:

1. Open the group, open its member list, and open Administrators.
2. Tap the admin the message claims to be from.
3. Compare the @username, letter by letter, with the account that messaged you.

The copy usually gives itself away in one of these ways:

• A near-miss username. A capital I for a lowercase l, a zero for an o, a doubled letter, an extra underscore.
• Lookalike letters in the display name. Usernames only allow Latin letters, digits and underscores, but a display name can use a Cyrillic "а" for a Latin "a" and look identical.
• Words added to the name. "Support", "Admin", "Help desk", "Official".
• No username at all, only a display name.
• It wrote first. You asked in the group; the reply came in private.
• It is in a hurry. "Your funds are at risk", "this ticket closes in ten minutes".

If the group hides its member list, ask in the group itself: "Did an admin just message me?" A real admin will answer there.

What does a fake admin ask for?

There is no version of real support that needs any of these. The same asks come from fake verification bots, which the fake Safeguard bot covers.

What should I do if a fake admin messages me?

1. Do not reply and do not open links.
2. Report the account. Open its profile, choose Report, and pick the option for a fake account. You can also send the details to Telegram's @notoscam.
3. Block it.
4. Tell the group's real admins, in the group. If the group runs Targa, /report calls the admins without other members seeing who reported.

If you already acted on the message:

• You shared a seed phrase: move what is left to a new wallet now, from a clean device. The old wallet is lost for good.
• You approved a wallet request: revoke the approval with a token approval checker for that chain, then move your funds.
• You shared a login code: open Settings → Devices and end every session you do not recognise, then turn on Two-Step Verification under Privacy and Security.
• You installed something: disconnect the device from the internet and change passwords from another device.

What can a group owner do to stop it?

You cannot stop a private message. You can make your members hard to find, hard to fool, and you can remove the copy before it is used.

1. Hide the member list. Groups with 100 or more members can. The scam starts with that list.
2. Pin one sentence. "Admins will never message you first. Anyone who does is a scammer." Repeat it in your welcome message.
3. Answer help questions in the group. When support happens in public, a private offer of help looks wrong.
4. Keep the admin list short and give each admin a title. Members can check a short list.
5. Protect the admin accounts themselves. Two-step verification on every one. A stolen real admin account is worse than any copy.
6. Remove the copies. An account in your group that wears an admin's name or photo has one purpose.

The last step is hard to do by hand. Nobody compares every member's name and photo against the admin list each time a profile changes. Targa does: it compares names, photos and bot handles against your admins, normalizes lookalike characters first, and checks again when a member changes their profile. Every action carries a reason you can read with /why.

The limit, stated plainly: Targa sees your group, not your members' private chats. An impostor who copied the member list last month and never joined cannot be caught by any bot. That is why steps 1 to 3 come first. For the rest of the list, see how to protect a group from scammers, or check what your group exposes today.