Telegram CAPTCHA bots: how they work and what gets past them

What is a Telegram CAPTCHA bot?

It is a bot that stands at the door of a group and asks each newcomer to prove someone is there. Until the newcomer answers, they cannot post.

Telegram has no CAPTCHA of its own for groups. The check is always done by a bot that the group's admins added and gave admin rights. Two facts about Telegram shape how every such bot works:

• A bot can restrict or remove members only as an admin. Telegram's bot documentation requires the bot to be an administrator with the appropriate rights. Restricting a member, which is what a mute is, is documented for supergroups.
• A bot cannot start a private conversation. Telegram's documentation says a user must message the bot first or add it to a group. So a challenge cannot simply arrive in the newcomer's private chat. It starts with a button in the group that the newcomer presses.

How does a CAPTCHA bot work, step by step?

1. An account joins. The bot sees the join.
2. The bot mutes it. The account is in the group and can read, but cannot send.
3. The bot shows a challenge. Usually a welcome message with a button. The challenge is solved in the group, or the button opens a private chat with the bot or a mini app.
4. The account answers. If the answer is right, the bot lifts the mute.
5. Or it does not. After a time the admins set, the bot removes the account. Telegram lets a bot remove a member in a way that allows them to join again, so a real person who missed the message can come back and try once more.

The challenges come in four common kinds.

Challenge	What the newcomer does	What it asks of a script
Button	Presses one button under the welcome message	To notice the button and press it
Math	Solves a simple sum and picks the answer	To read the question and work it out
Text or picture	Picks the text, or the characters, shown in a picture	To read text out of an image
Web or mini app	Opens a page inside Telegram and completes a check there	Whatever that page tests

As one example, Rose's documentation, read in October 2026, describes four modes: a button, which is the default, a text mode, a math mode, and a harder text mode where the newcomer picks single characters from a picture. In the last three, the button leads to a private chat with the bot. A newcomer who gives wrong answers is temporarily banned. Removing accounts that never answer is a setting you switch on, with a default of five minutes. Each member solves the challenge once per group. That is what the documentation says on that date. A feature it does not describe may still exist.

What does a CAPTCHA stop?

It stops the script that does not react. The cheapest kind of group spam works like this: a program joins with a bought account and posts a link at once. It does not read the chat, and it does not press buttons. Muted on arrival and removed a few minutes later, it never sends a message.

A CAPTCHA gives you three more things:

• A quieter chat. A wave of crude accounts is muted the moment it joins.
• A cleaner member list, if you turn on removal for accounts that never answer. Without it, the muted accounts stay in the group.
• A place for the rules. Some bots show the group's rules as part of the challenge, so every member has seen them once.

These are real gains, and a button costs a real member one tap. If crude spam is your whole problem, a CAPTCHA may be all you need.

What gets past a CAPTCHA?

A CAPTCHA asks one question: is something on the other side able to answer? It does not ask what the account plans to do. Everything that gets past follows from that.

What happens	Why the CAPTCHA does not stop it
A person runs the account	A person solves the challenge the way your members do
A script is written to answer	A button asks for one press, and a program that controls an account can press it
The account passes, waits, then posts	The check ran once, on the day it joined
The account passes and never posts	It reads the member list and writes to your members privately
The account edits a clean message later	The CAPTCHA does not read messages at all
A fake bot imitates your CAPTCHA elsewhere	It happens outside your group, where your bot is not present

Three of these deserve a closer look.

The patient account. An account that waits a week before posting was verified long ago. A harder challenge does not change that. Only something that reads messages when they are posted, and again when they are edited, sees the scam arrive.

The silent account. A muted account is still a member. While it sits in the group it sees what members see, which includes the member list unless you have hidden it. An account that came for the list does not need to pass anything. Removal on timeout shortens the visit. Member approval prevents it. See how join requests work.

The harder challenge. A sum or a picture asks more of a script than a button does. It also asks more of your members, and some real people will give up or miss the message. No challenge that a person can solve in seconds is closed to a person paid to solve it.

Why are fake verification bots dangerous?

Because the CAPTCHA has taught people to trust a "Verify" button. Members of crypto groups pass a check so often that one more looks routine. Scammers use that habit.

The fake bot copies the name and picture of a real verification bot and stands at the door of a fake group. Its "verification" asks for your phone number and the login code Telegram just sent you, or it tells you to paste a command into your computer. The first gives away the Telegram account. The second installs malware. The fake Safeguard bot scam explains both forms and what to do if you fell for one.

The rule is short. A real check asks you to press a button, solve a puzzle or wait. It never asks for a phone number, a login code, a two-step password, a QR scan with your account, or a command run on your computer.

If you run a CAPTCHA, this is your responsibility too:

1. Publish your bot's exact username in a pinned message. Say that it will never ask for a code or a command.
2. Keep the check inside Telegram. A challenge that sends members to an outside website trains them to follow the next link that says "verify".
3. Check the bot you add. A CAPTCHA bot holds admin rights in your group. Add it by the username on its own site, and give it only the rights it needs. See admin permissions.

Is a CAPTCHA enough for my group?

It depends on what arrives at your door.

What you see in your group	Is a CAPTCHA enough?
New accounts that post a link the second they join	Often yes. Add removal on timeout.
Scam messages from accounts that joined days ago	No. The check was passed long before.
Members receiving private messages from a copy of an admin	No. Hide the member list and turn on member approval.
Scams in pictures, QR codes or edited messages	No. That takes a bot that reads messages.
Hundreds of joins in a minute	Partly. See what to do in a raid.

A setup that covers more, in the order to do it:

1. Turn on member approval. The account is checked while it is still outside, so it cannot read the chat or the list. Since June 2026 a group can assign a Guardian bot that answers each request, and that bot can show the applicant a mini app first.
2. Keep a challenge, and keep it simple. One tap is enough to stop scripts that do not react.
3. Remove accounts that never answer. Do not lift the mute automatically after a while. That lets in exactly the accounts the check was meant to hold.
4. Use Telegram's own settings. How to stop spam bots lists six that cost nothing.
5. Add a bot that reads every message and every edit. This is the layer that deals with accounts that passed.

Targa has a join CAPTCHA: new members pass a quick human check before they can post. It also works as a Guardian bot and screens join requests before an account gets in. The rest of what it does starts where the CAPTCHA ends. It is AI-powered and reads every message and every edit, reads text and QR codes inside pictures, and compares names, photos and bot handles against your admins. If you want to watch it first, shadow mode removes nothing and logs what it would have done. Targa is in private beta, so access is by request.

If you already run a CAPTCHA in another bot, keep it. Two moderation bots can share a group. Leave the join CAPTCHA on in one of them only, so new members are not asked twice.

One limit holds for every bot, Targa included: none can see the fake verification page a member meets outside your group. The pinned message with your bot's exact username is the defence there.