Fake Admin and Impersonation Detection for Telegram

1The scam it stops

A scammer joins your group, copies the display name, username and avatar of a real admin, then privately messages members pretending to be support. They ask for money, seed phrases, wallet keys or login codes, trading on the trust members place in a familiar name.

Victims trust the name they recognize, and because the message arrives in a private chat, no other member sees it happen or can warn them. Impersonation detection catches the copycat account inside the group before it can start reaching out.

2How detection works

The bot keeps a reference set of your real admins: their display names, their usernames and a fingerprint of their avatar. Every newcomer is compared against that reference the moment they join.

Matching is fuzzy, so it catches look-alike tricks such as swapped or accented characters, invisible spacing and near-identical photos, not just exact copies. That matters because attackers deliberately pick characters that look the same to a person but are technically different.

3Avatar matching

Beyond names and usernames, the bot can compare profile photos with a visual fingerprint. It stays similar even if the scammer crops, resizes or lightly edits the admin's avatar, so a near-identical photo is still caught.

Avatar checking can be turned off if you prefer to match on name and username only, for example if your admins change photos often or use very generic images that could overlap.

4What happens on a match

When a member is confirmed impersonating an admin, Telm applies the action you choose: mute, the default, ban, or notify only. In notify mode nothing is enforced automatically; you just get an alert to review.

The owner can be notified on every detection so your team stays aware even when the action is automatic. That way an automatic mute or ban is never silent, and you can always double-check a borderline case.

• mute: stop the impersonator from posting. A safe default that halts harm without a permanent decision.
• ban: remove them and delete their messages. Best once you trust the detection in your group.
• notify: take no action, just alert you. Ideal for the first few days of watching.

5Rolling it out safely

Because impersonation matching is fuzzy by design, it is smart to start gently and tighten up once you have seen it work on your real membership.

Begin in notify mode for a few days and watch what it flags. Add any genuine look-alikes to the whitelist, and once you are confident the matches are all real impersonators, switch the action to mute or ban.

6Whitelisting legitimate look-alikes

Sometimes a real, trusted member genuinely shares a name with an admin, or a long-standing regular happens to use a similar avatar. The whitelist marks specific users as exempt so they are never flagged.

Use it sparingly and only for people you know. The whitelist is the right tool for a handful of known exceptions, not a way to switch detection off for large groups of members.

7Best practices

Impersonation detection works best as part of a broader anti-scam posture, combined with clear community norms.

• Start in notify mode, tune the whitelist, then move to mute or ban.
• Keep owner alerts on so every automatic action is visible to your team.
• Remind members in your welcome message that admins never DM first asking for money or keys.
• Keep your admin list current, since the detector compares against whoever your real admins are right now.

8Common mistakes

A few habits reduce the accuracy or usefulness of the detector.

• Jumping straight to ban before watching a few days in notify mode, which risks acting on a rare false match.
• Over-using the whitelist, which can create a gap an attacker copies deliberately.
• Turning avatar matching off without reason, which drops one of the strongest signals against photo copycats.
• Assuming detection stops DMs. It flags the impersonator inside your group; it cannot reach into private chats, so pairing it with member awareness matters.

9How to enable

Open your group in the dashboard and go to the Fake admins section. Turn on detection, choose the action, decide whether to check avatars and add any users to the whitelist, then Save.

For which plans include this and other protections, see what is in each plan.