Are Telegram bots safe? What they can see and the scams to avoid

What a bot can see about you

When you tap Start in a bot, it receives your public Telegram profile details: your name, your username if you have one, a numeric account ID, and your app's language setting. That's how a bot can greet you by name and reply in your language.

After that, the bot sees what you send it: messages, photos, files, voice notes and button taps. That's all.

What a bot can't see

• Your phone number. A bot only gets it if you share it yourself, usually by tapping a "Share contact" button. Nothing is sent until you tap it.
• Your other chats. A bot has no access to your private messages, other groups or contacts.
• Your location, unless you send it.
• Your password or login code, unless you type them into the chat. Never do that.

In groups

Bots run in privacy mode by default. In a group, a bot in privacy mode only gets commands meant for it, replies to its own messages, messages sent through it, and service messages like someone joining. A bot that's a group admin, or that has privacy mode turned off, gets every message except those from other bots. So if you're in a group with an admin bot, assume it can read what you write there.

It can't message you first

A bot can only write to people who started it or wrote to it, and it can't message you after you block it. If an unknown bot appears in your chat list, you opened it at some point, maybe through a link.

The person behind the bot sees what you send

This is the part people forget. A bot is a program, and someone runs it. Everything you send to a bot reaches its owner's program, and the owner can store it, read it or use it.

Most bot owners have no interest in your messages. But you should treat a bot like any website: send it only what you'd be comfortable sending to a stranger who runs a service.

• A file converter bot sees the file you converted. Don't send it your passport scan unless you trust who runs it.
• An AI chat bot sees your questions. Don't paste private work documents into a bot you found yesterday.
• A support bot for a shop sees your order details. That's expected, as long as it's the real shop's bot.

The same applies to Mini Apps, the web pages that open inside Telegram. A Mini App is a website, so whatever you type into it goes to whoever runs that website.

Common Telegram bot scams

Bots themselves aren't dangerous, but they're a cheap tool for scammers. These are the ones worth knowing.

Fake support bots

A bot or account called something like "Telegram Support" or "Wallet Help" contacts you, or appears when you search for help. It says your account has a problem and asks you to "verify" it. Real Telegram support doesn't contact you through a random bot. When something goes wrong with a service, find its official bot from the service's own website or channel, not from search results or a stranger's link.

Bots asking for your login code or password

This is the most damaging scam. When someone tries to log in to your Telegram account, Telegram sends a login code, usually to the Telegram app you're already logged in to. If a bot or person convinces you to send them that code, they can take over your account, read your chats and message your contacts. No real bot, giveaway or "verification" ever needs your login code or your two-step verification password. If anything asks for them, stop and block it.

Fake BotFather lookalikes

@BotFather is Telegram's official bot for creating bots. The real one has a verified badge next to its name and the exact username @BotFather. Fakes use names like "BotFather Official" or usernames with extra letters or underscores, and they ask for your bot token or your account login. Always open BotFather by typing the exact username or using the link t.me/BotFather.

"Earn money" bots

These promise money for simple tasks: watching videos, liking posts, inviting friends or "investing" a small amount. Some pay a little at first to build trust. Then they ask you to deposit money to "release" a withdrawal, or to pay a fee you'll never get back. If a bot promises easy income and wants money from you first, it's a scam.

Phishing Mini Apps

Mini Apps are popular. Telegram says more than 500 million of its 950 million users interact with them every month, and scammers have noticed. A phishing Mini App looks like a wallet, an airdrop or a login page, and asks you to enter a recovery phrase, a password or card details. Because it opens inside Telegram, it can feel official when it isn't. Treat a Mini App like a website you've never visited.

How to tell a real bot from a fake

A few checks catch most fakes:

• Check the username, not the name. Anyone can name a bot "Telegram Support". The username, the part after @, is unique. Compare it with the one listed on the service's official website or channel.
• Look for the verified badge on big official services like @BotFather. Its absence on a bot claiming to be Telegram is a red flag.
• Read the bot's profile. Real bots usually have a clear description and about text. An empty profile on a bot claiming to be a big brand is suspicious.
• Notice urgency. "Your account will be deleted in 24 hours" is a pressure tactic. Real services rarely work that way.
• Think about how you found it. A link from a stranger, a comment reply or a "you won" message is a much worse sign than a link on an official website.

If you already sent something you shouldn't have

Act fast. The order matters:

1. Sent your login code? Open Telegram's settings, go to your devices or active sessions, and end every session you don't recognize.
2. Turn on two-step verification in Privacy and Security settings if you haven't already. It adds a password that's needed on top of the login code.
3. Sent a bot token? Revoke it in @BotFather straight away. See what to do if your bot token leaks.
4. Entered card details or a wallet phrase? Contact your bank, or move your funds to a new wallet. A Telegram setting can't undo that.
5. Block and report the bot from its profile, so Telegram can review it.

If you run a bot: keep your users safe

If you own a bot, your users are trusting you with what they send. A few habits protect them and you:

• Ask only for the data your bot needs. A downloader doesn't need anyone's phone number.
• Say in the bot's description what it does, so users know what to expect. See how to set a bot's description.
• Keep your bot token private, because whoever has it can read messages sent to your bot. See how to get and reset a bot token.
• Tell users clearly that you'll never ask for login codes or payments outside the bot.

If you create bots with Echo Maker, you stay the owner in @BotFather, and revoking the token disconnects the bot from Echo Maker instantly. The admin panel also has content protection, which stops users from forwarding or saving what the bot sends. For a support inbox where users never see your personal account, the Contact Bot template replies through the bot.

A quick safety checklist

• Never send your login code or two-step password to any bot or person.
• Open official bots by their exact username, and look for the verified badge on @BotFather.
• Assume the bot's owner can see everything you send it.
• Don't share your phone number or location unless the bot clearly needs it.
• Never pay to receive a prize or to withdraw "earnings".
• Don't enter passwords, card details or wallet phrases in a Mini App you don't know.
• Turn on two-step verification and check your active sessions now and then.
• Block and report bots that try any of the above.