The short answer
Spammers replace letters with characters that look the same: a Cyrillic а for a Latin a, a zero for an o, or an invisible character in the middle of a word. People read the word as normal, but a word list sees a different word. The fix is to normalize text to plain letters before judging it.
Key facts
- A lookalike character is a different character to a computer, even when it is drawn the same on screen.
- Telegram usernames can only contain a-z, 0-9 and underscores, so a copied @username uses digits, underscores and added words.
- Display names and messages are not limited that way. That is where other alphabets and invisible characters appear.
- A word list matches exact characters. One swapped letter is enough to pass it.
- A bot has to fold lookalike characters back to plain text before it compares anything.
What is lookalike-character spam?
It is spam written so that a person reads one word and a filter reads another. The spammer swaps some letters for characters that are drawn the same way but are different characters underneath. The technical name is a homoglyph.
"c0inbаse" is an example. It has a zero where the o should be, and its second "a" is a Cyrillic letter. You read the brand. A blocklist that holds the brand's name finds no match.
Which tricks do spammers use?
| Trick | Example | What a person sees |
|---|---|---|
| A letter from another alphabet | "аirdrop" with a Cyrillic а | airdrop |
| Digits for letters | "B1nance", "c0in" | The brand, slightly off |
| Two alphabets in one word | "Suррort" with two Cyrillic р | Support |
| Invisible characters | A zero-width character inside "airdrop" | airdrop, with nothing odd to see |
| Spacing and punctuation | "a i r d r o p", "air.drop" | A word read at a glance |
| Styled alphabets | Bold or script "math" letters, small capitals | A word in a fancy font |
| Letter pairs | "rn" for "m", "vv" for "w" | The right word, at small sizes |
Spammers combine them. A message can use a digit in the brand name, a Cyrillic letter in "claim", and a zero-width character in the middle of the link text.
Why do word lists miss them?
A word list compares characters one by one. The Latin "a" and the Cyrillic "а" are two different characters, so "airdrop" and "аirdrop" are two different words. The list blocks the first and passes the second.
You can add the second spelling to the list. The spammer then swaps a different letter. A seven-letter word with several possible stand-ins for each letter has thousands of spellings, and the list is always one behind.
Longer lists also raise the other cost: your own members, removed for quoting the spam or for writing in their own language.
Where do lookalikes show up in usernames and names?
This part is often misunderstood, so it is worth being exact.
- @usernames. Telegram usernames can only contain a-z, 0-9 and underscores. A Cyrillic letter cannot appear in one. A copied username uses what is allowed: a zero for an o, a 1 for an l, "rn" for "m", a doubled letter, an extra underscore, or an added word such as "support" or "official".
- Display names. These are not limited that way. A copy of your admin's display name can be made with letters from another alphabet or with invisible characters, and it will look identical in a chat.
- Bios and messages. The same as display names.
So an impostor usually has a display name that looks perfect and a username that is slightly off. That is why the check in the fake admin scam guide is the @username, compared letter by letter.
Copied groups and channels use the same near-miss handles. Is this Telegram group legit? lists what to check before joining one.
How do I spot lookalike characters by hand?
- Type and search. Copy the suspicious text into a plain text editor. Type the real word yourself and search for it. If the search does not find the copied word, at least one character differs.
- Walk through it with the arrow key. If the cursor stays in place for a keypress, it just stepped over an invisible character.
- Change the font. Lookalikes that match in one font often differ in another. A monospace font shows most of them.
- Read usernames aloud, character by character. "Zero" and "underscore" are easy to say and hard to overlook.
- Do not judge a link by its text. Check where it goes before you open it.
This works for one message. It does not work for a busy group.
What must a bot do?
Normalize first, judge second. Before a bot compares a message with anything, it should fold the text back to plain letters:
- Remove zero-width and other invisible characters.
- Map lookalike characters from other alphabets, and styled letters, to the plain letter they imitate.
- Read digits used as letters as the letters they stand for.
- Close up spacing and punctuation games.
Then it judges the result. The same applies to names: a bot should compare each member's display name with your admins' names after normalizing both.
Normalizing has one risk. Text that is truly written in Russian, Greek or any other language must stay what it is. The signal is the mix inside a word, not the alphabet.
Targa does this on every plan. It folds lookalike characters, zero-width tricks and spacing games back to plain text before matching. Your own blocklist is applied after the same folding. A member whose display name or profile photo copies one of your admins is flagged, and handles shaped like "@Brand_Official_Support" are checked too. Members are checked again when their name, bio or photo changes. Every action carries a reason you can read with /why.
What it cannot do: follow the impostor into a private chat. A copied name is caught while the account sits in your group. For the settings that cover the rest, see how to stop spam bots, or read how Targa works.
Common questions
What are lookalike characters?
Characters from another alphabet or symbol set that look like the letters you expect. The Cyrillic а, е, о, р and с are drawn like the Latin a, e, o, p and c. To a person they are the same word. To a filter they are not.
Why does my word filter miss obvious spam?
Because it compares characters, not shapes. If you block the word airdrop and the spammer writes it with a Cyrillic а, a zero-width character or a dot between the letters, the filter is looking at a word it has never seen.
Can a Telegram username contain Cyrillic letters?
No. Telegram usernames can only use a-z, 0-9 and underscores. Copies of a username use what is left: a zero for an o, a 1 for an l, rn for m, an extra underscore or an added word. Display names have no such limit.
How can I check a suspicious word by hand?
Copy it into a plain text editor, type the real word yourself, and search for your typed version. If the search does not find the copied word, at least one character is different. Pressing the arrow key through the word also reveals invisible characters.
Is mixed-script text always spam?
No. People who write in two languages mix alphabets all the time, between words. The warning sign is two alphabets inside one word, especially a brand name, a coin name or the word support.
See what a scammer sees in your group
The free group check reads a group's public signals and shows where it is exposed. No account needed.