Bot type
The scam is a direct message from someone who looks like your admin
A Telegram anti-scam bot detects admin impersonation, screens links against known phishing infrastructure, and warns members about the fake-support pattern. It reduces losses inside your group. It cannot see or stop direct messages between members, which is where most crypto scams actually happen.
Anti-scam bots: price, timeline and limits
- Fixed price
- $6,700 USD
- Delivery
- 28 calendar days from kickoff
- Direct messages
- A bot cannot see or intercept DMs between two users
- Deletion window
- 48 hours from posting
- Display names
- Free text, not unique, and may mix scripts
- Phishing domains
- Typically registered hours before use
As of 2025-10-01, Telegram Bot API 13.4
The problem this solves
The scam that costs crypto communities the most money is not spam in the group. It is a direct message. Someone copies your admin's display name and photograph, waits for a member to post a support question publicly, and messages them privately within seconds offering help. The member, who just asked for help, receives it — from an account whose name matches the one they trust.
This is worth stating plainly because it constrains what any bot can do. Telegram gives a bot no visibility into direct messages between two other users. The impersonation itself is invisible to you. What a bot can do is narrower and still valuable: detect accounts in your group whose display name or photograph mimics an admin, warn a member at the moment they post the kind of question that attracts the pattern, and screen links posted publicly before anyone clicks them.
The honest framing matters because vendors sell this category dishonestly. A bot that claims to stop DM scams is claiming a capability the API does not provide. What reduces losses is a combination of detection inside the group, a consistent and well-known rule that admins never DM first, and warnings delivered at the exact moment of vulnerability. That combination works. A claim to intercept private messages does not, and should end the conversation with whoever made it.
How the build runs
Every joining account is compared against the admin list
Display name edit distance, username similarity and perceptual hash of the profile photo. An account calling itself the same as your lead admin with the same picture is flagged before it posts anything.
chat-member-updatesLinks posted publicly are screened and unfurled
Shorteners are resolved, destinations checked against phishing feeds, and lookalike domains flagged. Members are warned in the group rather than silently having their message deleted, so the pattern is visible to everyone watching.
webhookVulnerable questions trigger a warning to the asker
A member posting a wallet problem or a support question gets a short private reminder that admins never message first. This is the single highest-value intervention, because it arrives seconds before the scammer does.
commandsAnyone can verify an admin instantly
One command returns the canonical admin list with numeric user ids, which cannot be spoofed the way a display name can. A member who checks before trusting is a member who does not lose funds.
commandsReports capture evidence, not just a complaint
A reported message or account is recorded with its content, ids and timestamps. Telegram's own reporting is a black box; keeping your own record is what lets you see a pattern across incidents.
forum-topicsDetected impersonators are removed and published
Removal plus a short notice in the group. Publishing the pattern trains the community far more effectively than a silent ban, because next time they recognise it themselves.
chat-member-updates
What Telegram will and will not let you do
A bot cannot see or intercept direct messages between two users.
The DM scam itself is invisible. Everything this build does is prevention inside the group and warning at the moment of exposure. Any product claiming otherwise is describing a capability the API does not have.
Telegram display names are free text and are not unique.
Impersonation by name is trivially easy and impossible to prevent. Detection is similarity-based and probabilistic, and the durable defence is a verified list keyed on numeric user id.
Profile photographs can be fetched by a bot only for users it shares a chat with.
Perceptual hashing works for members of your group. An impersonator who never joins cannot be compared, which is another reason the DM path stays outside coverage.
Phishing domains are typically registered hours before use.
Feed-based screening always trails. Heuristics — lookalike domains, freshly registered TLDs, shortener chains — catch what the feeds have not seen yet, and neither alone is sufficient.
Messages can only be deleted by a bot within 48 hours of posting.
A phishing link that survives two days is permanent in the history. Screening at post time is the only reliable point of intervention.
When not to build this
- You expect it to stop direct-message scams. It cannot see them, and buying it under that impression will produce a false sense of safety that makes losses more likely, not less.
- Your community is small enough that members recognise every admin personally. Impersonation depends on members not knowing who is real.
- You are unwilling to publish a never-DM-first rule and enforce it yourself. The technical controls only work alongside a norm the community actually knows.
- You want silent enforcement. Publishing detected impersonations is most of the educational value, and a bot that removes them quietly teaches nobody anything.
What it runs on
| Component | Version | Why |
|---|---|---|
| grammY | 1.45 | Bot framework, with member and message handlers. |
| Cloudflare Workers | current | Runtime, link unfurling and feed checks. |
| Cloudflare D1 | current | Admin registry, impersonation history, reports and evidence. |
| Cloudflare Workers AI | current | Perceptual hashing of profile photographs for similarity. |
| TypeScript | 5.9 | Strict mode throughout. |
Questions people ask before committing
Can it stop someone DMing our members pretending to be an admin?
No. Telegram gives a bot no visibility into direct messages between other users, so the message itself is invisible. What it can do is detect the impersonating account inside your group, warn members at the moment they post something that attracts the pattern, and make the real admin list verifiable.
What actually reduces losses, then?
A published rule that admins never message first, a one-command way to verify who is real, and a warning delivered seconds after a member posts a vulnerable question. The technical detection supports that norm; it does not substitute for it.
How reliable is impersonation detection?
Good on obvious cases — same name, same photograph — and weaker against subtle variations. It is similarity-based and probabilistic by nature, which is precisely why the verified list keyed on numeric user id exists as the fallback that cannot be spoofed.
Do you block links or just warn about them?
Known-bad links are removed. Suspicious ones are warned about in the group rather than deleted, because the warning teaches the community what to look for and a silent deletion teaches nothing.
Will it catch a phishing site registered an hour ago?
Feeds will not have it. Heuristics might — lookalike domain, brand-new registration, a chain of shorteners. Neither approach alone is enough, which is why both run and why the honest answer is "usually, not always".
Should we publish when we catch an impersonator?
Yes. It is the most effective training your community will get, because it shows the pattern in a live example. Silent removal protects that one member and leaves everyone else exactly as vulnerable as before.