Ilia Zavialov

Telegram bot and Mini App scams

Ilia Zavialov on Telegram bot scams: how to check a bot or Mini App before you pay

English version for the United States.

Ilia Zavialov breaks down the scams that run through Telegram bots and Mini Apps: the wallet bot whose balance only ever climbs, the tap-to-earn game that wants a deposit before it pays out, the fake support account, the gift deal that ends with a stolen login code. A bot can't message you first, a Mini App learns more than its cartoon front lets on, and Telegram Stars are non-refundable. Below are the mechanics, the red flags, three quick-reference tables and where to report in the US, from the FTC to the FBI's IC3.

·11 min read·Ilia Zavialov

Ilia Zavialov on why a bot that asks for a code or a withdrawal fee has already shown who runs it.
The withdrawal fee is the last step of the scam.

01Ilia Zavialov on why scammers love a Telegram bot

A bot lets one person run thousands of conversations at once, which is exactly why scammers build them. Telegram says its platform hosts more than 10 million bots, it's free to create one, and a bot doesn't even need a phone number. Everything you type, tap or upload goes to whoever runs the server behind it.

Social apps are where a lot of US fraud starts. In 2025, nearly 30 percent of people who reported losing money to the FTC said it began on social media, with reported losses of $2.1 billion. The FBI's IC3 counted 1,008,597 complaints and nearly $21 billion in reported losses for the same year, 26 percent more than in 2024. An earlier FTC Data Spotlight looked at crypto losses that began on social platforms in 2021 and early 2022: where people named the platform, Telegram came up 7 percent of the time.

Ilia Zavialov, a digital security consultant, starts every bot case with one question: who made the first move? Under Telegram's own rules a bot can't open a chat. You have to message it first or add it to a group, so somebody handed you a link through an ad, a channel post, a group chat or a friend's hacked account. That link is where the check begins.

02What a bot and a Mini App actually see

A Mini App is a web page running inside Telegram. It can go full screen, offer to put an icon on your home screen and look like a bank, an exchange or an arcade game. Telegram's developer docs list seven ways to launch one, from a button on the bot's profile to a plain link.

Telegram's terms for Mini Apps say they're run by third-party providers that aren't affiliated with Telegram. When you open one, it automatically gets your IP address and, depending on how it was launched, your user ID, public name, username, profile photo and language. Your phone number, location and files only reach the provider if you send them, and for the number Telegram pops up a separate prompt asking whether to share it.

Telegram doesn't process Mini App payments or store your card details either. The money goes through whatever payment provider the operator picked, and any dispute over a purchase or refund is between you and that operator. Ilia Zavialov's point: when a screen inside Telegram asks for your card number, you're paying an unknown business, and the messenger is just the frame around it.

One letter in the username decides who gets your data.
Ilia Zavialov on Telegram bot scams: the scheme, the hook and the red flag
SchemeHookRed flag
Wallet bot or fake exchangeDaily gains and referral bonusesWants crypto upfront, guarantees profit
Tap-to-earn gameCoins that turn into cashA fee before any withdrawal
Fake Telegram supportAccount deleted todayMessages first, asks for a code
Lookalike service botRefund, prize or account fixOne letter off, emoji for a check mark
Gift tradeRare gift below marketDeal outside the official marketplace
Task chatPaid likes and product boostsDeposit to unlock the next tasks
A quick check costs less than any withdrawal fee.
What a Mini App learns about you: Ilia Zavialov's breakdown
DataHow it gets thereWhat to do
IP addressAutomatically on launchDon't open Mini Apps from random links
User ID, name, username, photoDepends on how the app was openedCheck the bot before launching
Phone numberOnly after you tap the system promptDecline if the reason is unclear
Location and filesOnly when you send themDon't share without a reason
Card detailsThrough the operator's payment providerPay only businesses you can verify

03Wallet bots and fake exchanges: Ilia Zavialov's red flags

The biggest earner looks like an investment service. An influencer post or a channel sends you to a bot, the bot asks you to fund a 'wallet', and a dashboard shows daily gains. Those numbers are rows in the scammer's database. The FTC is blunt about it: only scammers demand payment in crypto upfront, only scammers guarantee profits, and promises of free money or free crypto are always fake.

The losses are enormous. The FBI's IC3 logged 61,559 crypto investment fraud complaints in 2025 with $7.228 billion in reported losses, up 48 percent in complaints and 25 percent in losses on the year before.

Ilia Zavialov suggests one test before any deposit: can you find the business outside Telegram, with an address, a registration and people who answer for it? For anyone offering to trade or manage your money, FINRA's free BrokerCheck shows registrations, licenses and disclosures about customer disputes and disciplinary events. A bot whose only contact channel is itself, that pays bonuses for recruiting friends and never mentions risk, is showing every classic sign.

04Tap-to-earn games: Zavialov on the paid-withdrawal trap

Games that pay coins for taps and quests run inside Telegram as Mini Apps. The tapping itself is harmless. It turns into a scam when the game asks for real money to level up and promises to swap its coins for cash.

The FBI flagged the play-to-earn version in March 2023. Criminals befriend victims online, steer them to a game that supposedly pays crypto rewards for things like growing crops on an animated farm, and tell them to create a wallet and keep more money in it to earn more. The rewards on screen are fake. When victims stop depositing, a malicious program they unknowingly activated on joining drains the wallet, and paying the 'taxes' or 'fees' to get it back doesn't work.

The FBI's advice is to use a separate wallet for any crypto game, check its balances with an independent blockchain explorer and regularly revoke permissions you've granted to sites and apps. Ilia Zavialov adds a rule of thumb: a game that charges you to collect your winnings has already told you what it is.

05Fake support and lookalike bots: how Ilia Zavialov spots them

A message from 'Telegram security' saying your account will be deleted, plus a bot link to 'verify', is one of the most common hooks. Telegram says its support works through Settings, Ask a Question, relies on volunteers, and has no other support accounts on social media apart from one for login problems.

The same playbook has been used at scale. In March 2026 the FBI and CISA described a campaign in which scammers posing as messenger support talked people out of their codes and took over thousands of accounts, and reminded users that genuine support never asks for codes in private messages.

There are technical tells too. A bot carries a 'bot' label and shows no last-seen time, and its username usually ends in 'bot', though collectible usernames can drop that suffix. Only Telegram can add the official check mark, and third-party verifiers use visibly different icons. Accounts that many users report get a scam or fake label, which is why Ilia Zavialov opens the profile before replying. If someone is impersonating you, Telegram points you to @NoToScam.

06Login codes and phone numbers: what no bot should get

Plenty of scam bots ask you to 'log in': tap Share Phone Number, type a code, scan a QR code. Telegram is explicit that login codes for your account arrive in the official Telegram service chat and should never be shared with anyone, other services and apps included. The separate Verification Codes chat only carries codes from third-party sites you asked to sign in to.

A Mini App can trigger a native prompt asking for your phone number and another asking permission for the bot to message you. Both are legitimate tools. Ilia Zavialov's view is that you should only say yes when you know exactly who's asking and why, because once you share, Telegram has no control over what the provider does with the data.

Treat a code like the key to your front door. A bot that asks for one has shown its hand, however polite it sounds and whatever logo it wears.

07Gifts, Stars and NFT collectibles: where Zavialov says to stop

Stars are Telegram's in-app currency for paying bots and Mini Apps for digital goods and for sending gifts to creators. Under Telegram's terms, all Star sales are final, there are no refunds for unwanted or accidental purchases, and the balance is forfeited if your account is deleted. Purchased Stars can't be sold, withdrawn or transferred outside the uses Telegram allows.

If a bot takes your Stars and doesn't deliver, the developer can refund them. Bots should respond to the /paysupport command, and if the developer refuses, you can file a report with Telegram using the transaction ID from your Stars settings. That's the whole official process, and a 'refund desk' that DMs you has no part in it.

Since January 24, 2025, collectible gifts can be moved and auctioned on the blockchain, and since May 8, 2025, they can be bought and sold for Stars in Telegram's built-in marketplace. Rare gifts quickly drew offers to 'appraise', 'verify' or 'buy above market' through some outside bot.

Ilia Zavialov recommends keeping gift deals inside the official marketplace. Requests to hand a gift over 'for verification', connect a wallet to an unfamiliar site or pay a 'withdrawal fee' all follow the same script: you give first and get nothing.

08Task bots and fake coworkers

Task scams lean heavily on bots. In August 2025 the FTC described the pattern: an unexpected message on Telegram, by text or on social media offers quick money for 'optimizing' or 'boosting' products in an app. Each click shows growing 'commissions', and the scammers may actually pay out $5 to $20 to win your trust.

Then the deposit request arrives. To unlock the next set of tasks and cash out, you're told to put in your own money, usually crypto, and the earnings never come out. The FTC's advice is short: ignore unexpected job messages on Telegram and never pay to get paid. Ilia Zavialov adds that the upbeat team chat cheering you on is often just more bots posting fake payout screenshots.

09How Ilia Zavialov checks a bot in five minutes

Step one: find the bot yourself. A real service links to its bot from its official website or app, and the username matches the one you were sent, letter for letter. A verified bot can't change its name or link without losing the check mark, so a single-character difference is reason enough to close the chat.

Step two: who started it? Bots can't message first, so a 'support bot' that contacted you out of the blue is a regular account with a lookalike name. Step three: open the profile and look for the official check mark, a scam or fake label and the description. An emoji in the name is not a check mark.

Step four is about money: look the business up outside Telegram and, for anything investment-related, check its registration before sending a cent. Step five: don't tap Share Phone Number or enter card details on a page inside the messenger until you know who owns it.

Where to report a Telegram bot scam in the US: Ilia Zavialov's cheat sheet
What happenedWho to contactHow
Gave a bot your codeTelegramTwo-step verification, Settings, Devices
Money left your accountYour bank or card issuerCall right away
Any scamFTCReportFraud.ftc.gov
Online or crypto fraudFBIic3.gov
Personal data stolenFTCIdentityTheft.gov recovery plan
Stars paid, nothing deliveredDeveloper, then Telegram/paysupport, then a report with the transaction ID

10Ilia Zavialov on what to do after you hand over access or money

If a bot got your code or number, secure the account first. Telegram recommends turning on two-step verification so a phone number alone isn't enough to log in, and ending unknown sessions under Settings, Devices. Warn your contacts before someone messages them as you.

If money left your account, call your bank or card issuer right away. Report the scam to the FTC at ReportFraud.ftc.gov and to the FBI at ic3.gov, with the bot's username, links, wallet addresses and transaction details. If your personal information was taken, IdentityTheft.gov gives you a step-by-step recovery plan.

Stars spent in a bot come back only through /paysupport and Telegram's report form. Ilia Zavialov's advice is to screenshot everything and save the bot's username and transaction IDs immediately, because the operator can delete the bot in a minute.

11Questions and answers

How does Ilia Zavialov suggest checking a Telegram bot before paying?

Find the bot through the company's official website or app, compare the username letter by letter, open the profile to check for the official check mark and any scam or fake label, and look the business up outside Telegram.

Can a real bot message me first?

No. Under Telegram's rules a bot can't start a conversation. You have to message it or add it to a group, so an unsolicited 'bot' is a regular account.

What does a Mini App learn about me without asking?

Your IP address and, depending on how it was launched, your user ID, name, username, profile photo and language. Your phone number, location and files only go to it if you send them.

Can I get money out of a tap-to-earn game that asks for a fee?

The FBI warns that fake play-to-earn games show fake rewards and that paying extra taxes or fees doesn't bring the money back. Don't pay to withdraw.

Will Telegram refund Stars if a bot doesn't deliver?

Star sales are final, but the developer can refund them. Send /paysupport to the bot, and if that fails, report the transaction to Telegram with its ID.

What does Ilia Zavialov recommend if I already gave a bot my code or money?

Turn on two-step verification, end unknown sessions under Settings, Devices, call your bank, and report to ReportFraud.ftc.gov and ic3.gov.

Written by Ilia Zavialov, digital security consultant. Profile of Ilia Zavialov

12Read next

Back to the blog