Are bots safe?
Yes, in the sense that matters technically: a bot sees no more about you than any stranger in a group does. What it can see is your public name, your username, your profile photos, and the messages you send to it. That is the whole list.
What a bot cannot see
- Your phone number, unless you deliberately share it.
- Your last seen status.
- Your other chats, with anyone.
- Group conversations, unless privacy mode is off, which the members list states plainly.
The real risk is social, not technical
A bot is software written by a stranger, so treat it as you would a stranger. The danger is almost never that a bot extracts something from your account. It is that a bot asks you for something and you provide it. Telegram's permission model holds; the person is the part that gets talked into something.
Never give a bot
- Your Telegram login code. It logs somebody into your account.
- Your two-step verification password.
- A wallet recovery phrase or private key.
- Card details, unless you are using Telegram's own payment flow with a merchant you chose.
No legitimate bot needs any of these. A request for one is not a warning sign of a scam, it is the scam.
A bot that messaged you first is worth extra suspicion, because bots normally cannot start conversations. Report it from its profile menu rather than engaging. The bot directory lists established bots with their purpose and developer, which is a safer place to start than search results.