The short answer: you protect a Telegram community from impersonation scams by making your real admin identities unmistakable, teaching one rule (admins never DM first), locking down the surface scammers use to reach members, and running detection that flags lookalike accounts the moment they appear. Impersonation is the most damaging scam class in crypto and creator communities because it borrows the trust you built.

We build an AI moderation bot for Telegram and impersonation similarity scoring is one of its core signals, so this is a pattern we watch constantly. Here is how the scam works and the layers that actually stop it.

How Telegram impersonation scams work

The crew copies your admin's display name and profile photo, sometimes swapping a single character in the username: an uppercase i for a lowercase L, an extra underscore, a doubled letter. The fake account then either DMs members who recently asked questions in the group, posts a "wallet verification" link during a busy moment, or replies to newcomers offering support. Nothing in the message text is unusual. The whole scam is the identity, which is why word filters never see it.

The targets are chosen well: new members who do not know the team yet, and anyone who just posted a problem. In crypto groups the payload is usually a seed phrase phish or a wallet drainer. In creator and gaming communities it is fake giveaways and account recovery scams.

Make your real identities unmistakable

• Pin the team list. One pinned message with the exact @usernames of every admin. Tell members to compare character by character.

• Say "admins never DM first" everywhere. In the pinned rules, in the welcome message, and again after every incident. It is the single highest value sentence a crypto community can repeat.

• Keep the admin list short. Every extra admin is another identity to clone. Remove inactive admins and review anonymous admin settings.

• Verify externally. If your project has a website, list the official handles there so members can cross check, and link it from the pinned message.

Cut off the scammer's reach

Impersonators need two things: visibility of your members and a way to contact them. Reduce both. Hide the member list where your group settings allow it. Restrict who can send links so a fake account cannot drop a payload in chat. Enable join approval during active waves so cloned accounts queue instead of entering. Our anti spam settings checklist walks through each toggle, and the broader defenses live in how to stop spam in a Telegram group.

Detect lookalikes automatically

Manual vigilance fails at scale because the difference between @TeamAdmin and @TeamAdmin_ is invisible at reading speed. This is a job for similarity scoring: compare every new account's name, username, and photo against your admin roster and flag near matches instantly. That is one of the core signals collony.ai scores in real time, alongside account age and DM behavior, so a cloned admin gets flagged on join rather than after a member loses a wallet. Rule based bots cannot do this because no keyword describes a lookalike, a gap we explained in rule based bots vs AI moderation.

When an impersonator hits anyway

Ban the account, report it to Telegram, purge its messages, and post one calm pinned warning naming the exact fake username so members who received a DM know to ignore it. Then check how it entered and close that path. If members already engaged, tell them plainly what to do: never share a seed phrase, revoke wallet approvals if a link was clicked, and report the account from their own client too.

Impersonation peaks at predictable moments. If you have a launch coming up, our token launch moderation playbook covers the whole day, and building trust in a crypto community covers the recovery when something does get through.

Frequently asked questions

How do I know if a Telegram account is impersonating an admin?

Compare the @username character by character against the pinned team list. Display names and photos are trivially copied, so the username is the only identity that matters, and even it can differ by one swapped character.

Why do impersonation scams work so well in crypto groups?

Because they borrow existing trust at the exact moment a member needs help. A stressed user with a wallet problem sees a familiar name and photo offering support and stops verifying. The scam exploits urgency, not stupidity.

Can Telegram prevent impersonation?

Not really. Display names and photos are freely copyable and usernames only need to be unique, not distinct. Protection is the community's job: pinned identity lists, the no first DM rule, and detection that scores similarity.

What should members do if they get a DM from a fake admin?

Do not reply, do not click anything, report the account to Telegram, and tell a real admin in the group. If they already clicked a link, revoke wallet approvals immediately and never enter a seed phrase anywhere.