Last month, this series described fake support: accounts that find people asking for help and ask them for a seed phrase. This entry is about where those accounts come from. Most are not created. They come from people who never set a second password on their messenger or still receive login codes by text. Published for Cybersecurity Awareness Month 2026.

In short: Impersonators mostly use hijacked accounts. On Telegram, a “vote for me,” a “free Premium” gift, or a mini-app giveaway leads to a fake login page or a QR code that logs the attacker in; without two-step verification, a phone number and one code are enough. A SIM swap moves your number to the attacker’s SIM, so SMS codes reach them instead. Two settings stop both.

The scale is current, and so are the methods

On September 3, 2026, Kaspersky published its 2025 review of Telegram fraud, and its numbers describe an industry rather than a nuisance: victim logs across roughly 1,800 malicious Telegram bots held more than five million entries over 2024 and 2025. The techniques it catalogs are the ones in use now. Fake Premium gift subscriptions sent from a friend’s already-hijacked account lead to a phishing page that steals your account. Bots renamed “Telegram Wallet” or “Support Bot” to imitate official channels. In one variant, attackers transfer a bot’s ownership to the victim’s account without their knowledge, then report it, and Telegram support deletes the bot and the account.

In December 2025, Kaspersky documented a newer delivery method that needs no external link: a giveaway of collectible gifts runs inside a Telegram Mini App, so the login form appears within the app itself. Fill it in, and the account is gone immediately.

A message from a friend’s account, with the friend not there

The classic version still works the same way. A contact writes: vote for my niece in a contest, I sent you a Telegram Premium gift, try this free trial, sign this petition. Kaspersky described the scheme in February 2023 and has updated the piece since. The link opens a page styled as the vote or the gift, then a Telegram login screen that asks for your phone number and the code Telegram sends you, or shows a QR code to scan. Scan it, and the attacker logs into your account on their device. Without two-step verification, they only need your number and the code.

What they do with it is the second half of the scam. Kaspersky lists the obvious use first: send the same link to all your contacts. Then come the sob stories asking friends for money, and, in crypto groups, the quiet switch to posing as an admin or a support agent. This is how the fake-support accounts described in last month’s entry gain a real history, real mutual contacts, and a join date nobody questions.

How a session is stolen without a single click

Telegram sends a login code to every active session and, on request, by SMS. Group-IB documented attacks in which criminals trigger the SMS, intercept it, and then log in with the code. The firm also noted a defensive detail worth knowing: a newly logged-in session cannot terminate older sessions for 24 hours, so a user who spots a strange device in time can kick it out first. Telegram added Active Sessions and Two-Step Verification in April 2015. The password is optional, and it stays off until you set it.

How a SIM swap works, and what it still costs

A SIM swap moves your phone number to a SIM card the criminal controls, so your calls, texts, and login codes arrive on their device. The FBI’s Internet Crime Complaint Center says criminals get there by social engineering, insiders, or phishing aimed at carrier staff.

Reported totals are falling, but the method keeps working. IC3’s 2025 Internet Crime Report, published in April 2026, logged 971 SIM-swap complaints and $17.4 million in losses, down from 982 complaints and $26.0 million in 2024 and from a 2022 peak of 2,026 complaints and $72.7 million. Those figures count only what victims filed under that label; the eventual theft is usually recorded as something else, which is why SIM swapping still ranked among the top threats reported to IC3 in 2025 despite the shrinking dollar line.

The courts keep producing cases. On October 8, 2026, a 25-year-old was sentenced to two and a half years at Inner London Crown Court for stealing about £200,000, roughly $265,000, in cryptocurrency through SIM swapping; police said the hijacked numbers delivered the one-time codes that opened the accounts. The best-known case did not target a wallet at all. On January 9, 2024, the SEC’s X account announced that bitcoin ETFs had been approved. It had not. According to the Justice Department, the price rose by more than $1,000 and then fell by more than $2,000 after the correction. The conspirators had gotten in through a SIM swap: Eric Council Jr. used a fake ID at a carrier’s store to obtain a SIM for the number of a person with access to the account, put it in a new phone, received the two-factor reset codes, and passed them on, as The Register reported from court documents. He was sentenced to 14 months in May 2025. The thing stolen was a second factor.

What gives it away

A contact’s request that arrives with a link and a deadline. A login page that opens outside the Telegram app, or a login form inside a mini-app giveaway. A QR code you are asked to scan “to vote” or “to claim.” A phone that loses signal for no reason, followed by texts and calls that never arrive. A support account that joined yesterday, or an admin who suddenly goes online at odd hours to offer help in private.

The check: five settings and one habit

• Telegram: Settings > Privacy and Security > Two-Step Verification. Set a password you use nowhere else. If you add a recovery email, protect that mailbox with app-based authentication, since Group-IB warns email recovery often falls back to SMS.

• Review Settings> Devices every month. Terminate anything you do not recognize, and turn on automatic termination of inactive sessions.

• Never enter a Telegram login code anywhere except the Telegram app, never scan a login QR code that arrived in a message, and treat a login form inside a mini app the same way.

• Move every account that holds value, email first, off SMS codes. CISA’s December 2024 guidance states plainly: do not use SMS as a second factor. When offered, use an authenticator app, passkeys, or FIDO security keys; CISA’s fact sheet on phishing-resistant MFA explains why hardware is the strongest option.

• Ask your carrier for a port-out PIN or a SIM-change lock, and remove your phone number as a recovery method wherever the account allows another route.

• The habit: a friend who asks for money, votes, codes, or a quick favor gets a call on a channel you already trust, not a reply in the thread.

What the check does not prove

Two-step verification blocks the login path; it doesn’t evict a device already inside, which is what the Devices list is for. Dropping SMS protects your codes from a SIM swap; it does not stop a phishing page that relays an authenticator code in real time, which is why CISA ranks FIDO keys above apps. And the 24-hour rule helps only if you look.

Where this meets your swap

Most people scammed through an impersonated account are never asked for a password. They are asked to send crypto or to share a phrase. SimpleSwap support never messages first on Telegram, X, email, or anywhere else; the channels are the live chat on simpleswap.io and the email address on that page, and nobody at SimpleSwap needs your seed phrase. If an account offers to “release” or “verify” a swap for you in a direct message, close the chat and open simpleswap.io yourself. A swap aggregator moving funds wallet-to-wallet has no reason to contact you first. Our only official domain is simpleswap.io.

FAQ

How do scammers take over a Telegram account?
Usually through a link from a contact whose account was already hijacked, leading to a fake vote, gift, or petition page that asks you to log in or scan a QR code. Newer versions put the login form inside a Telegram Mini App, so no external link is needed. If two-step verification is off, your phone number and the login code are enough.

Does Telegram two-step verification protect against SIM swapping?
It protects the Telegram login: even with your SMS code, the attacker still needs the password. It does not protect other accounts tied to your number, which is why email and exchange logins should move off SMS codes entirely.

What is a SIM swap, and how would I notice one?
A SIM swap moves your phone number to a SIM the criminal controls, so they receive your texts and calls. The first sign is often a phone that suddenly loses service, followed by password-reset emails you didn’t request. The FBI’s IC3 recorded 971 SIM-swap complaints and about $17.4 million in losses in 2025, and courts sentenced SIM-swap crypto thieves as recently as October 2026.

Does SimpleSwap support contact users on Telegram?
No. SimpleSwap support never messages first and never asks for a seed phrase or private key. Official channels include live chat on simpleswap.io and the email address listed on its contacts page.

This article is for educational purposes only and is not financial or investment advice. Products and tools named here are examples rather than endorsements, and none of them replaces your own judgment. SimpleSwap’s only official domain is simpleswap.io.