The short answer: you remove crypto scammers from a Telegram group by banning and reporting the account, purging its message history, warning your members about the specific scam, and then closing the door it came through with tighter permissions and behavior based detection. The removal takes a minute. The prevention is where admins win or lose.

We build an AI moderation bot for Telegram and crypto communities are our heaviest users, so we watch these crews work every day. Here is how they operate and how to beat them.

How crypto scammers actually operate

Crypto scam crews are organized and patient. The same playbook appears in almost every attacked group:

• Fake support. An account named like your admin or a "Support Team" DMs members who asked a question in the group, offering to fix a wallet issue. The fix requires a seed phrase.

• The sleeper. Accounts join quietly, stay silent for a week to look established, then post a fake giveaway or airdrop link the moment a real announcement drops.

• Drainer links. A friendly message wraps a wallet drainer on a domain registered days ago, so no blocklist has seen it yet.

• DM bait. A harmless looking message whose only job is to make members open the sender's profile, where the scam link sits in the bio.

How to spot them before members do

Individual scam messages are designed to look clean, so spot the behavior instead of the words. The reliable signals: an account created days ago that is already DMing members, a username or photo one character away from an admin's, the same message appearing across multiple groups, links to domains younger than a week, and sudden activity from an account that lurked silently for days. None of these trip a keyword filter, which is exactly why crews rely on them. We broke down why blocklists structurally miss this in rule based bots vs AI moderation.

Remove them the right way

When you catch one, order matters:

• Ban, do not just delete. Deleting the message leaves the account free to repost. Ban the account first.

• Report to Telegram. Reports feed Telegram's own anti spam systems and make the account's next group harder to enter.

• Purge the history. Remove everything the account posted, including old innocent looking messages that may hold bio bait.

• Warn the group once. One pinned line like "we banned a fake support account, admins never DM first" turns an incident into a vaccination.

Close the door they came through

Every removal should end with one question: how did this account get in and act? The fixes are layered. Lock new member permissions so fresh accounts cannot post links, which kills most drive by attempts, and our anti spam settings checklist covers every toggle. Add a join gate if waves come through scraped invite links. And for the crews that pass every permission check by behaving normally until they strike, add behavior based detection: collony.ai's web3 moderation scores account age, join timing, impersonation similarity, and link reputation in real time, so the sleeper and the fake support account get removed on their first move, not after a victim reports them.

If your scam waves time themselves to token events, that is its own pattern with its own playbook, covered in the token launch moderation playbook.

Frequently asked questions

How do I identify a crypto scammer in my Telegram group?

Check behavior, not message content. New account age, DMing members shortly after joining, username or photo similar to an admin, links to freshly registered domains, and long silence followed by a sudden giveaway post are the five strongest signals.

Why do scammers DM my members instead of posting in the group?

DMs bypass group moderation completely. Crews scrape member lists from active crypto groups and go direct with fake support offers. Teach one rule relentlessly: admins never DM first.

Can Telegram's built in tools stop crypto scammers?

They stop the lazy ones. Permissions, slow mode, and Aggressive Anti-Spam remove drive by spam, but organized crews pass those checks by using aged accounts and clean wording. Catching them requires scoring behavior, which is a bot layer, not a setting.

Should I delete scam messages or ban the account?

Ban first, then purge. Deleting a message while the account stays in the group just invites a repost minutes later. Ban, report to Telegram, then remove the message history.