The short answer
Screen accounts before they can post, limit what newcomers can send, hide the member list, and secure every admin account with two-step verification. Remove bots you do not use, pin a warning that admins never message first, and add a bot that reads every message, edit and picture. Then review the group weekly.
Key facts
- Most scams against group members happen in private messages, using a member list copied from the group.
- Groups with 100 or more members can hide the member list.
- A real verification bot never asks for a Telegram login code, a QR scan with your account, or a command pasted into your computer.
- A stolen admin account does more damage than any outside scammer. Two-step verification is the fix.
- A banned account is listed under Removed Users and cannot rejoin through an invite link while it stays there.
What are scammers after in a Telegram group?
Three things, in this order:
- Your members. A list of people with a shared interest, many of whom hold crypto, is worth more than any message posted in the chat.
- Your reputation. A scam that appears to come from your admins borrows the trust you built.
- Your admin accounts. One stolen admin account can post, pin, ban and add bots.
The ten steps below close those three in turn.
What do the scams look like?
| Scam | Where it happens | What stops it |
|---|---|---|
| Fake admin offering help | Private message | Hidden member list, pinned warning, removing the copycat account |
| Fake verification bot ("Safeguard" clones) | A link or button in the group | Auditing bots, knowing what real verification asks for |
| Airdrop, giveaway or "claim" link | In the chat, often from a days-old account | Newcomer limits, message screening |
| Scam inside a picture or QR code | In the chat | A bot that reads images |
| Friendly member who pitches later | In the chat, over days | A bot that judges the conversation, not single words |
| Job or "task" offer | Private message or chat | Newcomer limits, pinned warning |
The ten steps
1. Screen accounts at the door
Turn on Approve new members, or use invite links with Request admin approval. Approving by hand works for a small group. Past that, use a join challenge, or make a bot your group's Guardian so it screens every join request. Targa does this: it checks account age, profile and known-spammer lists before the account gets in. Telegram CAPTCHA bots explains what a join challenge stops and what gets past it.
2. Limit newcomers
Most scam accounts post their one message in their first hours. Block links, media and forwards for new members and lift the limits after a few days of normal behaviour. Telegram's own Permissions apply to everyone at once. Limits that apply only to newcomers need a bot.
3. Hide the member list
Groups with 100 or more members can hide it. If you do one thing on this page, do this: it removes the raw material of the private-message scam.
4. Harden your admin accounts
- Two-step verification on every admin account, with no exceptions.
- Fewer admins. Each one is an account that can be phished.
- Least rights. A moderator needs to delete and ban. Only the owner needs to add admins.
- Titles. Give each admin a title so members can recognise the real ones.
5. Audit your bots
Remove every bot you no longer use. For each one that stays, check its exact @username against the project's official site.
Fake verification bots deserve their own warning. Copies of well-known verification bots ask a "new member" to scan a QR code, enter the login code Telegram sent them, or paste a command into their computer. Each of those hands over the member's account or device. Real verification is a button, a puzzle or a question inside Telegram. It never asks for a code or a download. The fake Safeguard bot shows the most copied one in detail.
6. Pin the warning
One message, pinned, and repeated in the welcome:
Admins will never message you first. Nobody from this group will ask for your seed phrase, a login code or a payment. If someone does, report them here.
7. Give members a way to report
Members see scams before admins do. A report should take one action and should not expose the reporter. With Targa, /report calls the admins and hides the report from other members. Members can also forward a scam they received to the bot.
8. Screen every message
Settings judge accounts at the door. A bot has to judge what they post afterwards: every message, every edit, and the text inside pictures and QR codes. It should explain each action so a wrong call can be undone and a right one can be defended. What to ask of an anti-spam bot lists the six requirements, and this page describes how Targa meets them. If you already run Combot or Rose, the Combot page and the Rose page show where each one's documented protection stops.
9. Plan for a raid
Decide now who does what when a hundred accounts arrive in a minute: who closes the invite link, who turns on approval, who posts the notice. A bot should hold a sudden wave of newcomers silent for a few minutes and ask the admins whether they are expected. A real launch brings a wave of joiners too, so the decision should stay with a person.
10. Review weekly
- Read the action log. Check what was removed, and why.
- Look at who joined in batches.
- Revoke invite links you no longer use.
- Run the free group check to see what your group exposes to someone looking from outside.
What a bot cannot do
It cannot read private messages, so it cannot stop a scammer who already copied your member list. It cannot secure an admin's account for them. It cannot replace the pinned warning. Steps 3, 4 and 6 are yours whatever you install.
Common questions
What is the most common scam in Telegram groups?
The private message from a fake admin or fake support agent, sent to a member who just asked for help. It uses the group's member list, so hiding that list and pinning a warning do more than any filter.
Should I make my Telegram group private?
It helps a little and costs you growth. Invite links leak, and a private group's members can still be messaged once someone is inside. Member approval, a hidden member list and message screening protect a public group better than privacy alone.
How do I know a verification bot is real?
Check its exact @username against the project's official site, and look at what it asks for. Real verification stays inside Telegram: a button, a puzzle or a question. A bot that wants a login code, a QR scan with your account, or a command run on your computer is stealing the account.
What admin rights should I give a moderation bot?
Delete messages and ban users. That is what removing spam and restricting spammers need. Never give a bot the right to add new admins, and do not let it remain anonymous.
How often should I review my group's security?
Weekly for the action log and new-member batches, and after every raid or scam report. Revoke unused invite links and recheck the admin and bot lists monthly.
See what a scammer sees in your group
The free group check reads a group's public signals and shows where it is exposed. No account needed.