Are Telegram Bots and Mini Apps Safe? What They Can Reach

Is it safe to start a Telegram bot?

A bot can't open a private conversation with you. You have to press Start first, or allow it when a Mini App asks. Added to a group, a bot can post in that group, but it still can't write to you privately. It doesn't see when you were last online, and it sees your phone number only if you share it.

Two things can still reach the bot's owner without much thought on your part. Tap a link or button that leads to a website they control, and that site can log your IP. Type a bot's @username in the message field, and everything after it goes to that bot as a query. With Post Bot, for example, that's how a finished post gets sent: you type @PostBot in a chat and pick a template. The first time you use any inline bot, Telegram shows a warning about exactly this.

A bot also belongs to whoever holds its token. If the bot is sold or the token leaks, the new holder can message everyone who ever pressed Start.

Are Telegram Mini Apps safe?

Each Mini App runs as a web page on the developer's own server, so it learns your IP address as soon as it loads. Telegram doesn't run these apps or vouch for them: its Mini App terms offer the platform "as is", and refunds depend on each developer's own terms.

Telegram also hands the app a signed bundle of data: your user ID, name, username, app language, whether you have Premium, whether the bot may message you, and a link to your profile photo if your privacy settings allow it. Open it from a link and the app gets whatever code that link carries. Open it from a chat's attachment menu and it learns which chat that is, including the public profile of the person you're talking to. On Android it also sees your phone model and how powerful it is.

Most Telegram games are Mini Apps, so all of this applies to them; our page on playing games in Telegram explains how they open and how Stars purchases work.

What a Mini App has to ask you for

A few things work without a prompt. A Mini App opened from the attachment menu can read your clipboard right after you tap something inside it. Motion sensors and the app's own local storage don't ask either.

Everything else needs your tap. Each of these comes up as a Telegram popup or a permission request, and if you say no, the app simply doesn't get it:

• Your phone number: a Telegram popup asks whether to share it
• Permission for the bot to message you: a Telegram popup
• Changing your emoji status: a Telegram popup
• Location: a permission request
• Biometrics: a permission request
• Saving a file to your device: a Telegram confirmation popup

Your chats and login code stay closed

The Mini Apps API has no way to read your Telegram chats, your contact list or your login code. So when a Mini App shows its own form for your phone number and the code Telegram just sent you, it's after something no genuine app needs. You're already signed in to Telegram; a real Mini App never asks you to sign in again.

Bots that work inside your account

The widest access a bot can get comes through Telegram Business. A subscriber can connect a third-party chatbot to their own account, and Telegram's privacy policy is blunt about what follows: the bot sees all messages, media and files in the private chats you let it manage. Give it permission and it can also send messages and act for you in those chats. The chat list can be trimmed, or the bot disconnected, at any time.

It works the other way too. A shop that answers you on Telegram at 3 a.m. may well be software.

Can Telegram bots be dangerous?

Yes, and very little stands between a new bot and its first users. Kaspersky looked at phishing Mini Apps in December 2025 and called Telegram's moderation "entirely reactive", with almost no vetting before an app goes live. Telegram's own answer, given to BleepingComputer in January 2025, is that it monitors public bots and Mini Apps and removes harmful content when it finds it. On November 5 the counter on its moderation page stood at 29,461,183 groups and channels blocked in 2026. Bots aren't counted separately.

On paper, developers may not pose as Telegram, phish, ask for your password or one-time code, misrepresent what their bot does or spread malware. A bot that breaks those rules usually comes down after people report it, not before.

Telegram scams since 2024: fake verification bots

The bot was called OfficiaISafeguardBot, with a capital I where the l should be. People who joined certain crypto groups, found through fake influencer accounts on X, were told to verify themselves by running a PowerShell command, with a short countdown to hurry them. The command installed malware that stole wallet keys (Scam Sniffer, December 2024).

A month later the same trick moved into a Mini App. Fake Ross Ulbricht accounts on X sent people to a "verification" dialog that quietly copied a PowerShell command to the clipboard and asked them to paste it into the Windows Run box (BleepingComputer, January 2025).

Copies of the Portals gift market

Portals is a marketplace for collectible gifts. Its look-alikes were Mini Apps that were close to identical, promoted in English and Russian as free giveaways. They asked you to log in inside the app, and the account was taken over right after. One fake profile even linked to the real Portals channel. The bot's username was different: the real one is @portals (Kaspersky, December 2025).

A login code typed into a fake page

A message in Telegram offers a public transport voucher. The link opens a page that asks for your name, ID number and the code Telegram just sent you. Type the code in and the scammers have your account, and your contacts get the same link from you next. Singapore police warned about a fresh wave of this in August 2026.

Wallet drainers and free-token promises

Some bots promise a free token once you pass "KYC verification" inside the bot, and that verification turns out to be sending your own crypto to the scammers. On TON phishing sites the wallet prompt could show something reassuring like "5,000 USDT" in the transfer comment while the victim was actually signing their tokens away; one such drainer collected at least 22,000 TON, about $152,000, by Scam Sniffer's count (Cointelegraph, June 2024).

Another trick runs backwards. Scammers rename a bot to something like "Telegram Wallet" or "Support Bot", quietly transfer its ownership to the victim, then report it. Telegram support takes the victim for the bot's creator and deletes their account along with the bot (Kaspersky, August 2025).

What the badges tell you

The blue checkmark comes only from Telegram, and tapping it brings up Telegram's own confirmation. Since January 1, 2025, approved third-party services can add their own icon, which sits before the name; open the profile to see who vouched for the account. Telegram also tags some accounts SCAM, or FAKE when many users have reported them.

How we decide what goes in the catalog

We don't see a developer's code or servers, so a listing is not a security audit. As of November 5 the catalog has 821 listings. Ninety-one of them, casino-style bots included, sit in an 18+ section behind an age check. Search engines, our home page and site search don't show them.

When we went through Telegram's partner programs, we left out phishing, people-search and "undress" bots, leaks of private content, sellers of accounts, dead bots and anything under 100 monthly users. One of the bots we skipped had about 120,000 monthly users and a "photo by link" feature, which is a standard phishing setup. Bots with cheats and mods for a game you already play are listed, with a plain warning that using them can get you banned. A bot that handed out paid games and premium mods for free looked like piracy, and that one is on our ban list.

Four bots are on that list right now. Every listing has a Report a problem button, and those reports come straight to us.

A check before you tap

If you remember one rule from this page, make it this one: a Telegram login code goes nowhere except the Telegram app. Not to a bot, not to a Mini App, not to a website, and not to us. Real codes arrive in the verified "Telegram" chat with a blue check, or by SMS or call.

Before you open a bot or confirm anything in it:

• Compare the bot's username letter by letter with the one on the project's own website or channel.
• Look at the badge: Telegram's blue check after the name, a third-party icon before it, or a SCAM or FAKE label.
• Close any Mini App that shows its own sign-in form.
• If a "verification" ends with pasting something into your computer, stop there.
• In a wallet prompt, read what actually leaves your wallet: the asset, the amount and the recipient. The comment text and any countdown don't count.

If you typed your login code somewhere

Move fast. Kaspersky puts the window for reclaiming a hijacked account at 24 hours, after which you risk losing it for good. In this order:

• Set a two-step verification password now, and consider adding a passkey.
• In Settings > Devices, end every session you don't recognize.
• Set inactive sessions to end automatically after a week.

If you connected a bot, paid one or ran its command

A bot connected to your account through Telegram Business is disconnected in Settings > Telegram Business > Chatbots. Block it afterwards.

If someone is posing as you, write to @NoToScam.

Paid in Stars and got nothing? Send the bot /paysupport, as described in What is a Telegram bot?. Card payments are a different matter: Telegram leaves disputes to the bot developer, the payment provider and the bank, so start with the developer and then your bank.

Ran a command a "verification" bot gave you? Treat the whole computer as compromised, and scan or reinstall it before you log in to anything from it.