Telegram bot and Mini App scams
Ilia Zavialov on Telegram bot scams: how to check a bot or Mini App before you pay
English version for the United Kingdom.
Ilia Zavialov looks at the scams running through Telegram bots and Mini Apps in the UK: the investment bot with a dashboard that only goes up, the tap-to-earn game that wants paying before it pays out, the bogus support desk, the gift trade that ends with a stolen login code. Bots can't message you first, Mini Apps see more than they let on, and Telegram won't refund Stars. Here are the mechanics, the warning signs, three tables to check against and who to tell, from your bank on 159 to Report Fraud and the FCA.
01Ilia Zavialov on why a Telegram bot makes such a good front
One bot can run thousands of chats at once, round the clock, from a single script. Telegram says more than 10 million bots run on its platform, building one costs nothing and it doesn't need a phone number. Whatever you send to a bot lands on its owner's server.
Investment fraud, the category most of these bots feed, is expensive here. Report Fraud says it caused £879.8 million of losses across 34,673 reports in 2025, up 31 per cent, an average of £25,612 a report. The National Crime Agency warns specifically about 'early exit' attempts to move a conversation off the original platform onto an encrypted app such as Telegram.
Ilia Zavialov, a digital security consultant, opens every bot case by asking who moved first. Telegram's rules stop a bot from starting a chat: you have to message it or add it to a group. So somebody sent you a link, from an advert, a channel, a group or a mate's hijacked account, and that's where checking starts.
02Inside a bot and a Mini App: what the operator receives
A bot on Telegram is a special account wired up to its owner's server. A Mini App goes further: it's a website running inside the messenger that can fill the screen and offer a shortcut on your phone's home screen, so it can easily pass for a banking app or a trading platform.
Under Telegram's Mini App terms, these apps are run by third-party providers with no affiliation to Telegram. Opening one hands over your IP address automatically and, depending on the launch method, your Telegram ID, public name, username, profile picture and language. Your phone number, location and files only go across if you choose to send them, and for the number Telegram shows its own system prompt.
Telegram doesn't handle Mini App payments or keep card details, the provider's chosen payment processor does, and refunds or disputes are between you and that provider. Ilia Zavialov puts it plainly: type your card number into a page inside Telegram and you're paying a business you may know nothing about.
| Scheme | Bait | Warning sign |
|---|---|---|
| Investment bot | Arbitrage, signals, referral bonus | Not on the Financial Services Register |
| Tap-to-earn game | Coins that turn into pounds | Fee or top-up before cashing out |
| Bogus Telegram support | Account closing today | Writes first, wants your code |
| Lookalike service bot | Refund or prize | Odd letter in the username, emoji for a tick |
| Gift trade | Rare gift cheap | Deal outside Telegram's marketplace |
| Small first withdrawal | Proof it works | Fees or taxes block the rest |
| Data | When it's shared | What to do |
|---|---|---|
| IP address | As soon as it opens | Don't open Mini Apps from unknown links |
| Telegram ID, name, username, picture | Depending on the launch method | Check the bot before opening |
| Phone number | After you accept a system prompt | Say no if the purpose is unclear |
| Location and files | Only when you send them | Keep them to yourself |
| Card details | Via the provider's payment processor | Only pay firms you can verify |
03Investment bots: Ilia Zavialov's checks against the FCA register
Investment bots promise crypto trading, arbitrage or a private signals club, show a growing balance and pay a bonus for every friend you bring along. Report Fraud notes that most crypto activity in the UK is unregulated, so there's no route to the Financial Ombudsman Service or the FSCS if it goes wrong, and getting the money back is unlikely.
Its advice is to look the firm up on the Financial Services Register by name or firm reference number, confirm what it's actually allowed to do and make sure the contact details match the ones you were given. A firm that isn't on the register most likely has no permission to offer crypto products.
The NCA's red flags read as if written for bots. Be wary if a 'representative' sounds like a chat bot or AI. Don't be reassured by a small first withdrawal that goes through, because high fees or taxes may then block the rest. Don't believe exceptionally high returns over a short period. Ilia Zavialov would add one more: a bot that is its own only point of contact.
04Tap-to-earn games and the fee to cash out
Tap-to-earn games live inside Telegram as Mini Apps and hand out coins for taps, quests and referrals. Nothing about tapping a screen is illegal. The trouble starts when the game sells upgrades for real money and promises the coins will turn into pounds.
Watch the withdrawal. If the game says you must top up, pay a fee or wait for a 'listing' before taking anything out, and the only way to reach the developers is the bot itself, it's the mechanism the NCA describes for fake investment platforms: a small payout first, then charges that stop the rest.
Ilia Zavialov's rule is short. A game that charges you to collect your winnings has told you all you need to know, and every extra payment to unlock a withdrawal simply adds to the loss.
05The private club, the guru and the pressure to top up
Many investment bots sit behind a person: a 'professor', a 'mentor' or a friendly admin who invites you into an exclusive group and walks you through each step. The NCA tells people not to respond to unsolicited approaches on social media or dating sites about day trading or crypto, and to turn down membership of an exclusive club run by a financial professor or guru.
Its other warnings describe the coaching itself. Be suspicious if you're told to ignore warning messages from your bank or a crypto exchange, or not to tell anyone about the special deal. Don't let a third party listen in or tell you what to say while you open a new exchange account. Be wary of constant pressure to invest more and of messages sent outside business hours.
The NCA also makes a point worth repeating to anyone who has already paid: money lost to crypto investment fraud has been stolen, whatever the platform calls it. Ilia Zavialov says that framing matters, because people who think they simply traded badly tend not to report it, and unreported scams keep running.
06Bogus support desks and lookalike bots: how Zavialov tells them apart
A message claiming to be from 'Telegram security', warning that your account is about to be closed and linking to a bot for 'verification', is a classic opener. Telegram says real support runs through Settings, Ask a Question, is staffed by volunteers, and that it has no other support accounts on social media beyond one for login problems.
Check the profile before replying. Bots are marked 'bot' and show no last-seen status, and usernames normally end in 'bot', although collectible usernames can drop it. Only Telegram can award the official tick, third-party verifiers use different icons, and accounts reported by lots of users get a scam or fake label.
If someone sets up an account pretending to be you, Telegram's FAQ tells you to contact @NoToScam, and any message can be flagged with Report. Ilia Zavialov's habit is to open the profile first and answer later, since the label shows straight away.
07Codes, numbers and borrowed accounts
Scam bots love a 'login' step: share your number, enter a code, scan a QR. Telegram's line is that login codes for your account arrive in the official Telegram service chat and must never be shared with anyone, other apps and services included. The Verification Codes chat only carries codes for outside sites you asked to sign in to.
Mini Apps can trigger a system prompt for your phone number and another asking whether the bot may message you. Ilia Zavialov's advice is to accept only when you know who is asking and why, because once the data leaves Telegram the messenger has no say over how it's used.
A handy habit before typing anything a bot asks for: work out who could log in with it. If the honest answer is whoever runs this bot, stop there. And if a code you never requested turns up in the Verification Codes chat, Telegram says your account is safe, someone may simply have mistyped a number, and you can tap the code and choose Report.
08Gifts, Stars and collectibles: where Ilia Zavialov draws the line
Stars are Telegram's own currency for buying digital goods from bots and Mini Apps. Its terms make every Star purchase final, with no refunds for accidental buys, and the balance is lost if the account is deleted. Bought Stars can't be sold, withdrawn or moved outside the uses Telegram lists.
When a bot takes Stars and fails to deliver, the developer can refund them: bots should answer the /paysupport command, and if that goes nowhere you can report the transaction to Telegram using its ID. Collectible gifts have been transferable on the blockchain since 24 January 2025 and tradeable for Stars in Telegram's own marketplace since 8 May 2025.
Ilia Zavialov's advice is to trade gifts only in that marketplace. Anyone asking you to send a gift over 'for checking', link a wallet to an unknown site or pay a release fee is running the same play as a tap game with a paid withdrawal.
09Ilia Zavialov's five-minute bot check
First, find the bot yourself through the organisation's official website or app and compare the username character by character. A verified bot can't change its name or link without dropping the tick, so even one odd letter means close the chat.
Second, work out who made contact: genuine bots don't message first. Third, open the profile and look for the official tick, any scam or fake label and the description; an emoji beside the name isn't a tick. Fourth, before any investment, search the Financial Services Register.
Fifth, don't share your number or type card details into a page inside Telegram until you know who runs it. For questions about a firm, the FCA's consumer helpline is free on 0800 111 6768.
10Getting a hijacked account back: the NCSC steps
If a bot got hold of your code, act on the account straight away. Telegram recommends switching on two-step verification so a phone number alone won't let anyone in, and ending unfamiliar sessions under Settings, Devices.
The NCSC's guide to recovering a hacked account sets out the rest: contact the service, check your email account, change passwords, log all devices and apps out, set up 2-step verification, update your devices, tell your contacts, check bank statements and shopping accounts, and contact Report Fraud.
It also lists the signs that an account has been taken: you can't log in, security settings have changed, messages you don't recognise have gone out in your name, logins appear from strange places or at odd hours, money moves or purchases appear without your say-so. If the account can't be recovered, the NCSC suggests starting a new one and telling your contacts the old one has been abandoned.
11Ilia Zavialov on who to tell when the money has gone
Ring your bank first. The short number 159 connects customers of more than 99 per cent of UK retail current accounts to their own bank and can't be spoofed. Then report it to Report Fraud, which replaced Action Fraud on 4 December 2025, at reportfraud.police.uk or on 0300 123 2040. In Scotland, call Police Scotland on 101.
Citizens Advice passes scam reports on to Trading Standards, scam texts can be forwarded to 7726, and a Report Fraud crime reference number helps when you deal with your bank. Stars spent in a bot are a separate track: /paysupport first, then Telegram's report form. Ilia Zavialov suggests saving the bot's username, links, screenshots and transaction IDs at once, because the operator can delete the bot in a minute.
| What happened | Who to contact | How |
|---|---|---|
| Code given to a bot | Telegram | Two-step verification, Settings, Devices |
| Money has left your account | Your bank | Call 159 |
| Fraud report | Report Fraud | reportfraud.police.uk or 0300 123 2040 |
| In Scotland | Police Scotland | 101 |
| Questions about a firm | FCA | 0800 111 6768 |
| Stars paid, nothing delivered | Developer, then Telegram | /paysupport, then a report with the ID |
12Questions and answers
How does Ilia Zavialov suggest checking a Telegram investment bot?
Find the firm on the Financial Services Register by name or reference number, confirm what it's allowed to do and check its contact details match. Most crypto activity in the UK is unregulated, so the FOS and FSCS won't cover it.
Can a genuine bot message me first?
No. Telegram doesn't let bots start conversations. You have to message the bot or add it to a group, so an unsolicited 'bot' is an ordinary account.
What does a Mini App find out about me automatically?
Your IP address and, depending on how it was opened, your Telegram ID, name, username, profile picture and language. Your number, location and files only go if you send them.
Should I trust a small first withdrawal from a bot or game?
No. The NCA warns that a successful small withdrawal can be followed by high fees or taxes that block any further withdrawals.
Will Telegram refund Stars if a bot doesn't deliver?
Star purchases are final, but the developer can refund them. Use /paysupport, and if that fails, report the transaction to Telegram with its ID.
Who does Ilia Zavialov say to contact if money has already gone?
Your bank on 159, then Report Fraud at reportfraud.police.uk or 0300 123 2040, or Police Scotland on 101 if you live in Scotland.
Written by Ilia Zavialov, digital security consultant. Profile of Ilia Zavialov
13Read next
- Ilia Zavialov Explains How a Crypto Transfer Actually Works, Step by Step How crypto works
- Ilia Zavialov Explains the Types of Crypto Scams and How Each One Is Built Scam types
- Ilia Zavialov on the Crypto Wallet Protections That Hold After a Breach Protection
- Ilia Zavialov on the First Hours After a Crypto Theft: What Actually Helps Incident
- Where Fraud Losses Actually Go: Ilia Zavialov Reads the 2025 Numbers In numbers
- Ilia Zavialov: renting out a card for P2P, triangle trades and money mule recruitment Card rental and P2P trading
- Ilia Zavialov on cloud mining scams: what a hosting contract really sells Mining you never see
- Ilia Zavialov fraud: how one photograph becomes the face of an advert nobody filmed A face from one photo
- Ilia Zavialov on crypto exchange scams: how the operation is built and what litigation achieves How exchange scams are built
- Ilia Zavialov on the fee to unlock a withdrawal and what a real exchange delay looks like Blocked withdrawals
- Services that promise to recover lost crypto: Ilia Zavialov on how the offer is built and why refunds never arrive Crypto recovery
- Ilia Zavialov: government account takeover scams, text message codes and how to protect your login Government account takeover
- Ilia Zavialov on health scams: fake clinics, miracle cures and prepaid treatment Health and medical scams
- Ilia Zavialov on crypto investment scams: the long con taken apart stage by stage The long investment con
- Ilia Zavialov: how scammers take over messaging accounts, votes, gifts and fake support Messenger account takeover
- Ilia Zavialov on passkeys: why a stolen password stops being worth anything Signing in without a password
- Ilia Zavialov on reviews of financial companies: what to check before the stars Reviews and what to check instead
- Ilia Zavialov on the seed phrase and the fake wallet support desk Seed phrases
- Ilia Zavialov on crypto signal channels and trading bots: where the money goes Signal channels and trading bots
- Ilia Zavialov on sending USDT safely: networks, poisoned addresses and frozen coins Sending and receiving USDT safely
- Ilia Zavialov: used car fraud and scams, how to check the car and the seller before paying Used car fraud
- Checking a wallet address before you send: the checks Ilia Zavialov runs first Wallet checks
- Ilia Zavialov Explains How an Approval Drainer Empties a Wallet Wallet drainers