Fake Safeguard bot on Telegram: the verification scam, explained

What is the fake Safeguard bot scam?

Many Telegram groups, crypto groups above all, make newcomers pass a check before they can post. Safeguard is one of the real bots that does this. Its name and its look are familiar, and that is what the scam uses.

Scammers build a group or channel that looks like a real project. At the door stands a bot named like Safeguard, with the same picture. You tap Verify, and the "verification" is the theft.

The security firm SlowMist described it in January 2025 and named two forms. One takes your Telegram account. The other puts malware on your computer.

How does the scam work, step by step?

How you get there. A link, usually from outside Telegram. In January 2025 the links were posted on X by fake accounts of well-known people, under real posts, offering an "exclusive" or "official" group. BleepingComputer reported one wave that used fake accounts of Ross Ulbricht in the days after his pardon.

Form one: your account.

1. The fake bot opens a page that looks like a Telegram login.
2. It asks for your phone number, then for the login code Telegram just sent you, and sometimes for your two-step password.
3. With those, the scammer logs in as you. They read your chats, message your contacts and take over any group where you are an admin.

Form two: your computer.

1. The fake bot shows a check that fails, or a list of steps for "manual verification".
2. In the background, the page copies a command to your clipboard.
3. The steps tell you to press Windows and R, paste, and press Enter.
4. The command downloads and runs malware. SlowMist found remote-access tools that take wallet files, seed phrases, private keys and saved passwords.

The second form works because nothing looks dangerous. You never see the command. You paste it into a box and it is gone.

How do I tell a real verification from a fake one?

One rule covers all of it. A login code goes into the Telegram app and nowhere else, and nobody verifies you by having you run a command.

Also look at how you arrived. If the link came from a reply on X, a private message or an "admin" who wrote to you first, check the group before you join. See is this Telegram group legit?

What should I do if I fell for it?

Act in this order. The first minutes matter most.

If you typed your phone number and a code:

1. Open Settings, then Devices, and terminate every session that is not yours.
2. Under Privacy and Security, set a Two-Step Verification password. If you typed your old one into the fake page, change it.
3. Warn your contacts, and tell the owner of any group where you are an admin.

What to do when a Telegram account is hacked has the full list.

If you pasted the command:

1. Disconnect the computer from the internet.
2. From a different device, change your passwords, starting with email.
3. Create a new wallet with a new seed phrase on a clean device and move your funds. A seed phrase that was on the infected computer is no longer yours alone.
4. Do not use that computer again until it has been cleaned or its system reinstalled.

Either way: report the fake bot in Telegram, and tell the real admins of the project it imitated.

What can group admins do?

Your members are the target, and the scam happens outside your group, where you cannot see it. What you can do:

1. Publish your verification bot's exact username in a pinned message and on your site. "We only use this bot, and it will never ask for a code or a command."
2. Keep verification inside Telegram. Member approval, which Telegram calls join requests, needs no outside page. See how join requests work.
3. Say the rule often. Admins never message first. No check asks for a code.
4. Watch for copies of your group. Search for your project's name in Telegram now and then, and report groups that imitate yours.

Targa helps with the part that happens inside your group. As a Telegram Guardian bot it screens join requests inside Telegram, so members are never sent to an outside page. It compares names, photos and bot handles against your admins, after normalizing lookalike characters, so a bot or an account dressed as one of yours is noticed. It reads links, pictures and QR codes in messages, which is how invitations to fake groups are usually posted.

The limit, stated plainly: Targa sees your group. It does not see X, private messages or a fake group that someone else built. That is why the pinned message matters more than any bot.