Fake Verification Bots: How Scammers Clone Captcha and "Safeguard" Bots to Steal Telegram Accounts

Many Telegram groups and channels ask new members to "verify" before they can chat. Scammers copy this pattern. They set up a fake verification step that looks routine but actually steals the member's Telegram session, login code or computer. This page explains how the scam works, how to recognise it, and how admins can protect members.

How a real verification step works

A legitimate anti-spam or captcha bot in a group:

works inside the group (a button on the welcome message, a simple question or a captcha),
never asks for your phone number, login code, password or 2FA password,
never asks you to install software, run commands or paste anything into your computer,
never sends you to an external site that asks you to "log in to Telegram".

Anything outside that pattern is a red flag.

How the fake versions work

1. The cloned channel with a "verify" bot

Scammers create a channel that copies a popular project, often in crypto or trading. Its pinned post says "Verify you are human to join the group" and links to a bot with a name like ProjectName Safeguard or GuardianVerifyBot.

The bot opens a page or mini app that looks like Telegram Web or a captcha. It asks for the phone number and then the login code Telegram just sent you. Whoever enters that code gives the attacker a full session: they can read chats, message contacts and join groups as that user. If two-step verification is off, the account is effectively lost.

3. The "paste this to verify" trick

A newer variant shows a fake captcha that says "Press Win+R, paste and press Enter to verify." The page has already copied a command to the clipboard. Running it downloads malware that steals browser passwords, crypto wallets and Telegram Desktop data.

4. Stolen accounts used for the next wave

Hijacked accounts then post the same "verify" link in other groups. Because the messages come from real, older accounts, members trust them more.

How admins can protect members

Name your real verification bot in the pinned message, with its exact @username, and say: "Our verification happens only inside this group. We will never ask for your phone number, login code or to run anything on your computer."
Never move verification outside the group. Keep captcha and join questions in-group, so any external "verify" link is clearly fake.
Restrict links for new members. Fake verification links usually arrive in a new member's first messages or in replies to newcomers.
Hide the member list, so scammers can't DM "please verify" messages to everyone.
Watch for compromised regulars. If a long-time member suddenly posts a verification or giveaway link, mute them and contact them some other way. Their account may be hijacked.
Teach the two-step setting. Encourage members to turn on Settings → Privacy and Security → Two-Step Verification and check Devices for sessions they don't recognise.

If a member was caught

Ask them to open Settings → Devices and terminate all other sessions.
Turn on, or change, the two-step verification password.
If they ran a pasted command on a computer, treat that computer as infected: scan it, change passwords from a clean device, and move any crypto funds to a new wallet.
Ban the scam account and delete its messages in your group.

Automatic filtering

Fake verification links spread fast once one account is compromised. An anti-ad bot removes links and scam messages from new or suspicious accounts before members click them, and catches copy-paste waves across a busy group.

虾宝 (Xiabao) is an anti-ad bot for Telegram groups that is free for group owners. Add @xiabaotg_bot as an admin with permission to delete messages and ban users, and it filters ad and scam messages automatically. It works inside the group and never asks members for codes or logins. See the Xiabao setup guide for group owners for the steps.

Summary checklist

Real verification bot named in the pinned message
Verification only inside the group
Links restricted for new members
Member list hidden
Members reminded about two-step verification and the Devices list
Recovery steps written down
Anti-spam bot running

Disclosure: written by the 虾宝 (Xiabao) team, which maintains the bot mentioned above.