Skip to main content

How Telm detects scams and phishing in Telegram groups

How Telm catches crypto scams, phishing, fake giveaways and investment fraud in Telegram groups by scoring dozens of signals and reading intent, not keywords.

7 min read
In short

Scams follow a handful of well-known scripts — free airdrops, guaranteed profits, you-won-a-prize giveaways, ask-me-how income, advance-payment and pyramid schemes. Telm carries a pattern library for each of these across 30 languages, but no single phrase bans anyone: every signal adds to a 0-100 spam score, and only the overall picture decides. For disguised scams that avoid obvious wording, an AI layer reads the underlying intent. And the same scam blasted across many groups is recognised as a coordinated campaign and hit hardest.

Scam and phishing patterns are caught by the Anti-Spam engine.

Want to set this up? Do it right in your Telm account.

Open in your dashboard

1What counts as a scam

A scam is a message engineered to defraud: to steal money, credentials or crypto by promising something too good to be true. Unlike ordinary spam, scams often look polite and personal, which is exactly why a keyword blocklist misses them.

Telm recognises scams by the shape of the offer, not by a banned-words list. It knows the recurring playbooks and combines many weak signals into one confident decision.

2The scam playbooks we catch

These are the recurring scripts Telm has dedicated detectors for. Real scams usually combine several, which pushes the score up fast.

  • Crypto scams — free airdrops, double-your-coins giveaways, guaranteed gains, pump signals and fake token drops.
  • Phishing — shortened or disguised links leading to fake registration, login or payment pages.
  • Fake giveaways and lotteries — you won an iPhone or a prize, just click this link to claim.
  • Investment and earnings bait — passive income, financial freedom, ask me how, made this much last month.
  • Advance-payment fraud — pay a small fee now to unlock a bigger reward or job.
  • Pyramid and referral schemes — unlimited commission for inviting friends.
  • Task farms — earn by solving captchas or completing simple tasks.
  • Job scams — vague high-paying remote work with no experience needed.
  • Document and subscription scams — fake certificates, or cut-price premium accounts.

3Signals add up — no single word bans

Every detector that matches contributes points toward a spam score on a 0-to-100 scale. A word like earnings on its own is never enough; the verdict comes from the sum of signals — the offer, the link, the sender being new, the urgency, the contact request.

A very high total is removed or banned outright; a low total passes untouched. This is what lets Telm stop a scam while leaving a genuine question about the same topic alone.

The score is capped so that keywords alone can never reach a ban threshold — a deliberate guard against false positives. See how spam detection works for the full scoring pipeline.

4Reading intent, not keywords

Skilled scammers avoid obvious wording — no message says I am a scam. They write interesting topic, message me privately, I will show you how. Only something that understands meaning can tell that apart from a normal question like where can I buy this.

For genuinely borderline messages Telm escalates to an AI layer that reads the intent behind the words: an offer to sell, a lure into private messages, a disguised advert. Legitimate discussion of crypto or trading is left alone; a hidden scam is caught.

The scam pattern library and scoring run on every plan. The AI layer that reads intent is part of AI moderation, available on Pro and Business.

5Coordinated scam waves

Scammers rarely hit one group. The same, or nearly the same, message is blasted across many communities at once. Telm tracks fingerprints of messages across all protected groups: when the same content surfaces in several of them within a day, it is recognised as a coordinated campaign and given the maximum weight — an immediate ban.

Inside a single group, the same content posted by several different accounts in a short window is itself grounds to ban the senders and clean up copies that already landed.

Every scam verdict records a category — phishing, crypto, earnings, scam and so on — so you can see at a glance what your group is being targeted with in the moderation journal.
Was this article helpful?

Ready to protect your group?

Add Telm to your Telegram group and let it handle the spam.