How Telegram Contact Confirmation Works: First-Time DM Warnings, Registration Dates & Anti-Scam Audits
When somebody who is not in your contacts writes to you for the first time, a small card appears above the conversation. It says when the account was made, which country the number belongs to, and how many groups you share.
Three facts, shown before you reply. Against the impersonation scams that work on this platform, they are usually enough.
What you will be able to do
- check_circle Read each line on the card and say what it means.
- check_circle Recognise a cloned account in seconds.
- check_circle Know what the card cannot tell you.
- check_circle Act on it without a conversation.
The card sits above the first message, with add, block and report beside it.
badge The scam this was built against
The attack is simple and it works on careful people. Somebody copies a name and a photograph — a colleague, a moderator, a family member — and writes to you from a new account. There is no hacking involved. Everything they used was visible on the real person's profile, and the only thing that differs is the account underneath.
What follows is always urgent and always small: a code they need, a payment that cannot wait, a link to open quickly. Urgency is the mechanism, because a person given thirty seconds to think checks, and a person given none does not.
The card interrupts exactly there. Before the first message can do its work you are shown, without asking, that this account was created three days ago and shares no groups with you — which is not a suspicion but a fact, and one that no amount of convincing writing can talk you out of.
A message arrives from your manager's name and photograph. The card says the account was created two days ago. What is that?
Somebody you have known for years does not have a two-day-old account, and the one thing an impersonator cannot copy is the history of the account they are pretending to be. This single line settles the majority of these cases, and it settles them before any conversation has started — which is exactly when you are most able to act on it.
The card shows zero groups in common with somebody claiming to be a colleague. How much does that tell you?
People who genuinely work or spend time with you have usually accumulated at least one shared group, and an account with none has no history connecting it to your life. It is weaker evidence than the registration date — a new colleague really might share nothing — but combined with a recent account it is close to conclusive.
The number is registered in a country neither of you has any connection to. What does that prove?
People travel, emigrate, keep old numbers and deliberately use anonymous ones for perfectly good reasons. An unexpected country belongs in the picture alongside the other two lines rather than deciding anything by itself. The card works as a whole — a long-standing account with shared groups and a surprising country is far less worrying than a new one with neither.
The card looks reassuring: an old account, several groups in common. Is the message safe?
The card describes the account, never the intention. An established account can be bought, borrowed, or taken over from somebody whose real friends will receive the next round of requests. What it rules out is the cheap clone; what it cannot rule out is a person you have no reason to trust, or a real friend whose account is no longer theirs.
task_alt
shield What to do with the buttons
The card comes with actions attached, and using them is better than replying. Blocking ends it immediately and is entirely under your control; reporting is slower and uncertain but is what removes the account from other people's inboxes as well as yours.
For anything that was actually aimed at you rather than at everybody, do both — block first, so it stops, then report so it is recorded. Neither requires you to have proved anything, and neither tells the sender what you concluded.
The one thing not to do is argue. Replying confirms that a person reads this account, which is the most valuable piece of information a bulk operation collects, and it changes nothing about what happens next.
settings Reading the card
- Check the registration date first It settles most cases alone.
- Then the shared groups Zero, from a colleague, is telling.
- Treat the country as context Not as a verdict.
- Notice any urgency Money, codes, approvals, speed.
- Verify on a channel you already had If it claims to be somebody you know.
- Block, then report — do not reply A reply is the information they wanted.
This page reads a card about somebody else. The curriculum step is the other side: protecting your own account from the takeover that makes these clones convincing, and what an attacker needs from you to finish one.
The first-message card at a glance
What each line means, which one settles most cases, why a reassuring card is not a safe message, and what to do instead of replying, on one page. Tap to open it at full resolution.
