How to Remove a Fake Telegram Bot Impersonating Your Company

Fake Telegram bots are one of the fastest-growing vectors for brand impersonation attacks in 2026. Unlike clone channels that broadcast scam messages to subscribers, impersonator bots engage victims one-on-one — making them harder to detect and significantly more dangerous.

A fake bot mimics your official support or announcement bot. It uses a nearly identical username (e.g., @YourProject_Supp0rt instead of @YourProject_Support), the same profile photo, and an automated welcome message that mirrors your real bot's tone. Once a victim interacts, the bot executes a phishing script: wallet verification, seed phrase request, or malware delivery.

How to Detect a Fake Telegram Bot

Detection requires systematic scanning of Telegram's bot namespace. The most effective methods are:

1. Username Variant Scanning — Attackers typosquat your bot's username. Common patterns:

• Character substitution: support → supp0rt (zero for o), announcements → ann0uncements
• Suffix addition: _bot → _bot1, _helpbot → _help_bot
• Underscore swapping: project_bot → projectbot

2. Display Name Clone Detection — Attackers copy the display name exactly but use a different @username. Telegram allows multiple bots with the same display name but unique usernames. Search @username variants of your brand in Telegram's global search.

3. Behavioral Analysis — A fake bot typically:

• Asks for private keys, seed phrases, or 2FA codes (legitimate bots never do this)
• Sends unsolicited DMs to group members claiming a 'security update' or 'wallet migration'
• Uses urgency language: 'Verify within 15 minutes or your account will be suspended'
• Links to external sites with domains that mimic yours (e.g., yourproject-verify.com)

The Takedown Process: Step by Step

Removing a fake Telegram bot requires a coordinated multi-vector approach. Telegram does not have an automated bot reporting pipeline — each case requires human-reviewed reports through the @Botfather and @NoToScam abuse channels.

Step 1: Evidence Collection — Before reporting, gather complete evidence:

• Screenshots of the bot's welcome message and conversation flow
• The bot's exact @username and display name
• Any external links or wallet addresses the bot promotes
• Proof that the bot is impersonating your registered brand (trademark docs help)

Step 2: Report via @Botfather — Send a detailed report to Telegram's bot management system. Include all evidence. The subject line should clearly state: 'Impersonation Bot Targeting [Brand] — Phishing Active'.

Step 3: Report via @NoToScam — Telegram's anti-scam channel processes impersonation cases. Submit the same evidence package with a concise description of the threat.

Step 4: DMCA Takedown for Hosted Content — If the bot links to phishing pages hosted on web services (GitHub Pages, Vercel, Cloudflare), file DMCA takedown notices with those providers. This disrupts the bot's infrastructure.

Step 5: Monitor for Rebound — Attackers often recreate removed bots within 24-48 hours. Continue scanning for username variants for at least 14 days post-takedown.

Why Manual Reporting Often Fails

Individual reporting to Telegram has a low success rate for three reasons:

1. Volume: Telegram receives thousands of impersonation reports daily. Individual reports compete for attention with low-priority spam.
2. Evidence Standards: Incomplete evidence packages are rejected automatically. Most victims submit insufficient proof.
3. Rebound Speed: By the time a manual report is processed (2-7 days), the attacker has already migrated to a new bot.

ZeroState addresses these failure points by maintaining pre-approved abuse reporting channels, compiling professional-grade evidence packages with chain-of-custody documentation, and deploying automated post-takedown monitoring that detects rebound bots within hours.

Prevention: Hardening Your Bot Infrastructure

The best defense is making impersonation harder from the start:

• Register username variants proactively: Pre-register common typosquat variants of your bot's username as placeholder accounts.
• Display a verification marker: Use Telegram's verification system for official bots. Verified bots show a blue checkmark.
• Educate your community: Pin a message in your group explaining that official bots never ask for private keys.
• Monitor continuously: Set up automated scanning for new bots matching your brand name pattern.

The Bottom Line

A fake Telegram bot is not just a nuisance — it's an active security incident. Every day it operates, it compromises users who trust your brand. Detection requires systematic scanning, removal requires coordinated reporting, and prevention requires continuous monitoring.

ZeroState handles the full lifecycle: detection, evidence compilation, multi-vector reporting, and post-takedown surveillance. If you suspect your brand is being impersonated by a Telegram bot, a 24-hour OSINT assessment can confirm the threat and map the full infrastructure.