Scammers can use the Telegram mobile messaging app to connect with a potential victim if they already have their phone number in their contact list.
In a blog post, Fidelis Cybersecurity researcher John Bambenek discusses the ease with which scammers can reach out to Telegram users:
“Here’s the deal: If a scammer signs up for Telegram and already has your phone number in their contact list, it will also notify them that you also have Telegram. So in addition to connecting you to your friends and contacts, the app will also connect scammers directly to you. Likewise, if you have scammers’ numbers in your contact list for some reason, you will get push notifications when they join Telegram…”
What’s going on here? How is this even possible?
Most of us know there are there “Do Not Call” rules that help prevent unwanted (spam) calls. These records reflect the complaints users have filed on phone number reputation sites. Mobile applications that block unwanted calls build their registries off this reputation data.
There’s just one catch. “Do Not Call” rules don’t apply to encrypted messaging apps. Those include Telegram, which has versions for Android and iOS.
Sign up to our newsletterThat’s annoying, but surely there’s a way of blocking others from seeing you have Telegram installed, right?
Wrong!
You can block specific users. You can choose who can see when you were last active on Telegram. And you can choose whether everybody or just your existing contacts can join you to group chats. But you cannot block others from seeing if you have Telegram installed if they know your mobile number.
To make matters worse, Bambenek said it would be quite easy for someone to develop a method of determining whether a user has installed Telegram on their mobile device. Criminals could use such a service to target unsuspecting users. But so too could law enforcement and intelligence agencies looking to determine “risk factors” among the general population.
So what is to be done?
Users of encrypted messaging apps like Telegram, which has seen bugs both real and bogus, need to understand that these risks are out there. As such, they should be careful when approving new contacts, even if they’re a friend. Ideally, they should use an out-of-band means of verification.
They should also review the app’s default settings and check to see if they can prevent the app from capturing their address book.
Finally, they should be careful about answering calls from unknown users. A simple “hello” tells a scammer that their number is active. As such, they’ll find no reason to not spend months or even years trying to reconnect with that user. They just need a direct means of communication.
And with apps like Telegram, they’ve got that.
Found this article interesting? Follow Graham Cluley on Twitter or Mastodon to read more of the exclusive content we post.
Yeh so? I get at least 2 friend requests from scammers on Facebook per day. I don't see how this is worse, or even worth any extra concern beyond the usual level of vigilance. Don't be a fear monger
What he's saying is that Telegram is a bit different.
If somebody has YOUR phone number in their address book and YOU join Telegram then that person will get an alert saying "Freman has joined Telegram".
Facebook is a little different to an instant messaging application. Personally I think Telegram should give the end user an option NOT to proactively alert people to the fact that they're using the platform.
You could argue that WhatsApp is very similar however their method requires you to look through your phonebook to find other WhatsApp users.
The Telegram privacy options are far superior to those in WhatsApp and they also allow you to use a username so that you can contact people (or they can contact you) without providing your phone number. That's a major benefit.
The difference is in the topology. No matter what you do on Facebook, it's a website and you communicate with their server so as your contacts, that's how they keep control. End-to-end apps talk to each other directly meaning you both know the address of each other. When you pass through a server its like having a friend A making a conference call to let you talk to friend B. You'll both see the the number of friend A. So B cannot use your number to spam you after.
It is true some scammer already use telegram and registered as famous person, like Timothy Sykes, on his Bio, it is exactly like Timothy Sykes, and he will promise you that he can turn $1400 into $5000 within few hours and ask you to sent 0.128 BTC, worth $1500 to his BTC address! never do it! after you sent the BTC to him, he will tell you he already made $7000, now want to release to you, in order to do so, the scammer ask you to sent additional 0.1 BTC, worth $1100 to his different BTC wallet! I hope FBI do the investigation to arrest this scammer! I am one of the victimes!. not sure how many victims on the telegram! watch out!
I didn't join any telegram but a scammer has a code sent to me by telegram. Could it be that my number is registered somewhere else
I am one of the victim too..I would to find justice and stop this evil doers to avoid another victims
Yes, even I am one of victim of telegram scammers. (A telegram channel named "carding ka baap" has scammed me).
How did they scam you, using which method? I was just added to one of those groups.
How do you block the person once they would have secured your telegram code and phone number?
I just got a scanm on Telegram. This person is using text only phone number from Iowa and using a person's name from New York city for a job with Morgan Stanley. I sent a message to the person in New York on Linledin and asked if this is really the same person. The scammer from Iowa not stop texting me.
I am sorry but telegram should deactivate these accounts when people complain they just continue all the time ??
HEY JERK:
You wor for twitter, facistbook or google gestapo?
Telegram is just fine
I was approached by a lad on Facebook dating he asked me to get telegram which I did two weeks of chatting he said he needed money I said no when I checked his phone number it was a scammers number from Denmark he even chatted on the phone he deleted him self after I said no to money
All these scams are awful I run global cybercrime investigations and cyber intelligence for a bit tech company. Remember you do not need to get people to invest crypto for you. The beauty of crypto is you can do it yourself. As a general rule if someone makes claims of unreasonable returns/profit the are probably a scammer. If they offer to match your funds probably a scammer.
Same thing with people claiming to be military and overseas- They will say they do some kind of securet work and then they'll say they need money because they got arrested or something and need your help.
Do not EVER give money to people you do not know a great deal about. Do not send money to strangers who claim to love you. Do not let anyone tell you that you have a computer virus and they need to upload a program to help you.
Practice good cyber hygiene and research thing before it happens. All too often someone will get ripped off and THEN do the research.
I had one trying to scam me on Telegram, he said he was Kenny Chesney, username @classifiednonpublice, his Bio was Entertainment and Business Investors, I knew he wasn't Kenny Chesney, He wanted me to give him all my banking information I refused, he wanted my credit card number, he made a payment and in three days it was returned to him. In the meantime he wanted me to get two apple 13 I-phones and two Apple laptops, wanted me to open up more bank accounts and so on, I refused He said you are my wife and I want you to do what I ask, I told him we weren't married. He also ask me for money but I wouldn't give him any. I said if you are Kenny Chesney you don't need my money.
Got a message from a Hollywood type asking to keep in touch thru a new app. The app didn't budge without adding all contacts. Facebook scammers contact all contacts with annoying things, so I didn't want a fiasco. I couldn't do anything so it felt like a scam.