A Telegram bot wants your login code. Group access is not an account sign-in
Separate community verification from authentication to your Telegram account, including the less obvious risk of sharing a screenshot containing a code.
A group has rules. A bot welcomes you, asks you to verify and says you cannot see the discussion until you finish. That may sound ordinary, especially if you have used legitimate moderation bots before. But when the bot asks for a Telegram login code, the request has crossed into something different.
Access to a group is not permission to sign in to your personal account. A bot’s name, profile picture or helpful tone does not give it a right to your authentication secrets. Read the purpose of a code in the service message that delivered it, not in the bot’s explanation of why it wants it.
Start with the distinction the interface can blur
Telegram contains conversations with people, conversations with bots and service notifications in one application. That shared environment can make a third-party bot feel like part of Telegram’s own account-management system.
Telegram’s FAQ about bots and account codes draws a useful boundary: bots are third-party programs, and Telegram account login codes should not be shared. The current FAQ also distinguishes Telegram’s own login notifications from codes delivered for other services. Do not assume every message containing a code serves the same purpose.
You may encounter legitimate bot interactions that do not involve handing over account access. The safe rule is not “all bots are malicious.” It is to keep a community task within its proper scope. A group can ask you to read rules or answer a moderation question. That does not make your personal sign-in code a community credential.
Group task
Prove you read a rule or complete a clearly explained community step.
Account task
Authorize access to your personal Telegram account.
The boundary
Do not let the first task become an unexplained reason to perform the second.
The code can leave in a screenshot, not just a reply
People are often told never to type a code into a chat. That advice misses a less obvious disclosure: a screenshot of the conversation list or a search result can contain a code too.
In a 2023 joint advisory, Singapore’s police described impersonation attempts involving fake customer-service bots and requests for screenshots that exposed login codes. This is historical documentation of a mechanism, not evidence that a particular current message comes from the same people.
Before sending any screenshot, ask what information it contains and why the recipient needs it. A person claiming to help locate a contact does not need an unrestricted view of your service messages. A community moderator does not need a picture of your recovery information.
If you cannot remove sensitive information confidently, do not send the image. Describe the non-sensitive problem instead. You can say that a code arrived without revealing its value, the recovery link or the surrounding private messages.
Five requests that deserve a stop
| Request | Why the explanation is insufficient | Safer route |
|---|---|---|
| “Send the Telegram code to unlock the group” | A group task does not justify personal account access | Ask a verified moderator for a non-secret process |
| “Help recover my account with your code” | Your authentication secret does not establish their ownership | Let them use their own recovery route |
| “Screenshot your chats so I can find the error” | The image may expose codes and private conversations | Share a narrow description without secrets |
| “Verify here before the free membership expires” | A deadline does not establish who receives access | Check the offer independently |
| “Turn off the extra password temporarily” | This weakens account protection for an unverified request | Stop and inspect through your own settings |
The names and incentives can change. The recurring problem is a request to move a secret or weaken a control for a task that does not require it.
A friend sent the bot. Does that change anything?
It changes how emotionally persuasive the request feels, not what the bot should be allowed to receive. Your friend may have forwarded the link casually. Someone else may control the friend’s account. You do not need to decide which explanation is correct before refusing to disclose a code.
Contact the friend through an established second route if the request seems important. State exactly what the bot asked for. “Did you send a group invite?” and “Did you mean to ask me to disclose a personal account login code?” are very different questions.
If the person becomes impatient, keep the boundary about the action: “I don’t share sign-in codes with bots or people.” Avoid a long argument about whether the group is genuine. A genuine group can still contain a compromised moderator, a malicious impersonator or an unsafe process.
If you have not supplied anything
Close the bot interaction, avoid further links and use Telegram’s available reporting and blocking controls. If a community has an independently verified moderator, report the suspicious request there without forwarding secrets.
Do not deliberately generate another code to test the bot. Do not send made-up personal information as a prank. The goal is to leave a process you cannot verify, not to establish a dialogue with whoever runs it.
If a code arrived unexpectedly, read which service it concerns. An unsolicited code is a reason to avoid sharing it and check relevant account activity; it does not by itself prove that somebody already has access. Be careful not to confuse a third-party verification message with a login notification for Telegram itself.
If you sent the code or a revealing screenshot
Use a trusted, already signed-in device if you still have one. Review account access through Telegram’s own settings and follow the current recovery instructions in its official help. Check the account’s security configuration and recovery details, not just whether you can still send a message.
Tell support what was disclosed and when. If the screenshot included additional secrets, treat those separately. A picture can contain an email recovery link, another service’s code or a private conversation that has nothing to do with Telegram authentication.
Warn contacts through another route if the account may be sending messages in your name. A useful warning describes the request they should ignore. It does not need to share the full suspicious link or publish personal information about the account.
Do not log out of your last working session casually while trying random fixes. Recovery procedures and waiting periods can vary. Follow the service’s current instructions instead of advice from someone who promises an immediate unlock for payment.
For group owners: make verification explain itself
A safe community onboarding message should say who operates the bot, what it checks and what it will never request. Members should be able to reach a moderator without using a support contact supplied by a suspicious direct message.
Keep the steps proportionate. If joining a discussion requires unexplained permissions, personal identity documents or account secrets, members have good reason to stop. Reduce that ambiguity instead of telling cautious users to disable their doubts.
Our guide to messaging-app linked-device QR phishing covers a different way to authorize unwanted access without typing a password. The article on fake Discord administrators shows how an invented support process can turn a community problem into an account handover.
You can participate in a community without giving its bot the keys to the account you use to join it. A reasonable verification process should preserve that distinction.