A fake admin DM is a message from an account dressed up to look like it has authority it doesn't: the right profile photo, the right name, sometimes even a "verified" badge lifted from a screenshot of someone else's channel. The part most teams get wrong isn't spotting the fake. It's assuming the line "we never DM first" is a policy, when for most communities it's just a sentence buried in a pinned message nobody has read since launch week.
That gap between having a rule and actually running it is where impersonators make their money. A lot of crypto marketing teams reading this already run tighter controls on their crypto community management than on who's allowed to DM a member first. This piece is the build: the contact rules you publish, the support path you pin, the triage steps you run in the first ten minutes after a report, and the account hygiene that stops your own team becoming the next entry point.
Why Fake-admin DMs Work
They work because three things land on a member at once: urgency, borrowed authority, and genuine confusion about where real support lives. Strip out any one of those and the scam mostly falls apart on its own.
Urgency does the heavy lifting. "Your wallet will be suspended," "claim closes in ten minutes," "verify now or lose your allocation" — none of it is subtle, but panic shortens the gap between seeing a message and acting on it. A member refreshing their phone mid-launch isn't the person who checks a username character by character.
Authority mimicry is the second lever, and it needs no hacking at all. Telegram lets anyone contact you if they already know your number, if they message you first, if you share a group with them, or if you've set a public username, which describes the daily reality of any open crypto community with more than a few hundred members. The impersonator doesn't breach anything. They just dress as the role they're copying, in a channel where that role already has reach.
The third factor is the one teams almost never fix: nobody actually knows where official support lives. If there's no single, obvious answer to "which handle is real," every DM becomes a coin flip, and a scammer only has to win once per member.
The scale behind this is not a rounding error. People reported losing $3.5 billion to imposter scams in 2025 alone, part of total reported fraud losses the FTC calls the highest on record. Cryptocurrency investment fraud was the single costliest category the FBI tracked that same year, with $7.2 billion in reported losses, and the Bureau's own case notes describe scammers routinely moving the conversation from a public platform to a private message once they've got a target's attention — a pattern the FBI has flagged in its own IC3 impersonation warnings too.
None of those figures is a Telegram-specific number. Nobody publishes a clean breakdown of losses from admin-impersonation DMs as their own category, separate from imposter scams or crypto fraud generally, and that gap in the data is worth saying outright rather than glossing over. What the totals tell you is the size of the machine aimed at your members, not the size of your particular problem, and that's reason enough to stop treating this as a one-line warning in a pinned post.
Publish Non-negotiable Contact Rules
Write down, in public, exactly who is allowed to DM a member first and what they will never ask for. If that sentence doesn't exist in a pinned message right now, you don't have a policy, you have a hope.
Name the handles authorized to initiate contact, if any exist at all. For most communities the honest answer is none. Support is request-only, through a specific form or ticket channel, and staff only reply inside tickets a member opened themselves.
Say that plainly rather than leaving members to guess whether "the team sometimes reaches out" is ever true. Then publish the never-list where it can't be missed, in the group description and the pinned post, not three scrolls deep in a FAQ:
- Staff will never ask for your seed phrase, private key, or wallet password
- Staff will never ask you to send funds to "verify" a wallet or claim an airdrop
- Staff will never DM you first about a giveaway, refund, or urgent account issue
- Staff will never ask you to install remote-access software or share your screen
This works because it changes the question a member asks. Instead of "does this look official," they're checking a message against a rule they've already seen in writing. That's a far easier test to pass under pressure than trying to eyeball a username at 2am.
Create an Official Support Path
One verified route, pinned, with the exact same name across every platform you operate on. If a member has to stop and think which link is real, the path has already failed.
Pin the real support link at the top of every channel, not just the main group. Keep the handle identical across Telegram, Discord, and X so a lookalike stands out by comparison, not by close inspection.
Publish a help page on your own domain listing every official account and channel by name, so a member can check a DM against a page you control rather than a screenshot someone sent them. Add an in-group reporting instruction too, something low-friction: a pinned command, a dedicated topic, or a bot that lets any member flag a suspicious account without leaving the group or DMing a stranger to ask if it's safe. The lower that bar, the faster a pattern surfaces, often from the second or third member rather than the fortieth.
Triage a Suspected Impersonation
Treat it like a small incident, not a customer service ticket, because that's what it is. The member comes first, the investigation second.
Ask directly whether they clicked a link, connected a wallet, or shared anything sensitive. If they have, tell them to secure what can still be secured right away: a new wallet, revoked token approvals, whatever applies, before anything else happens. A reassuring tone matters here, but speed matters more.
Once the member is safe, collect evidence while it still exists, because a scammer who senses a report coming can delete the account fast. Screenshot the full conversation including timestamps, the impersonator's display name, and their numeric user ID, not just the name that can be changed on a whim. Save any link they sent as plain text rather than clicking it again.
Here's an example of what that evidence log should capture:
| Field | What to record |
| Timestamp | When contact started and ended |
| Display name | Exact spelling shown in the DM |
| Numeric user ID | The permanent ID behind the account |
| Message content | Full screenshot, not a paraphrase |
| Links shared | Copied as text, never clicked again |
| Member impact | Clicked, connected wallet, or no action taken |
Report and block through the platform itself, using Telegram's in-app report function on both the account and the message, so the evidence attaches to a record Telegram can act on, not just to a folder on your own drive.
One DM to one member is a nuisance you handle quietly. The same handle messaging several members, or a near-identical account turning up twice, is the trigger for a group-wide alert, because by that point silence is costing you more members than a warning ever would.
Communicate Without Amplifying the Scam
Say what happened and stop there. A short, factual post beats a long one, and it beats silence by a wide margin.
State the facts plainly: an account impersonating the team DMed members, it's been reported and blocked, and the real support path is the one already pinned. Don't repost the scam link, even with a warning label on it, because a malicious link posted to a few thousand people is still a malicious link in a few thousand clipboards.
Describe what it claimed rather than reproducing exactly how it looked, and never name the account again once it's dead; you're not writing its obituary.
Never promise fund recovery. If a member has already lost funds, say clearly that the team cannot guarantee recovery, and point them to the platform's own reporting channels rather than implying there's a process for getting money back. That's a hard line to hold when someone is upset in your general chat, but a false promise now is a second betrayal later, and it's the one your community will actually remember.
Harden the Team Account Model
Every admin account is a potential entry point for exactly the impersonation you're trying to stop, so account hygiene isn't a side project, it's the other half of this job. Two-factor authentication on every staff account is the floor, not a nice-to-have.
Separate capabilities by role instead of handing every moderator the same keys: who can post as the official channel, who can ban, who can edit pinned messages, who can add new admins. Review who holds which permission on a fixed schedule, quarterly is reasonable, rather than only after something has already gone sideways, because permission creep is invisible right up until someone exploits it.
Audit profile details on the same schedule. A former moderator's account still carrying an old staff title in its bio, or a departed team member who kept admin rights out of nobody's deliberate choice, is a live impersonation risk even if nobody involved means any harm.
Conclusion
A zero-trust DM protocol doesn't stop every scam attempt from landing in an inbox. What it does is make the real path unmistakable and the fake one fast to report, so an impersonator's window to do damage shrinks from days to minutes.
Run this checklist the next time a suspected impersonation surfaces:
- Confirm the official contact rule is pinned and current
- Check whether the member clicked anything or shared sensitive information
- Screenshot the conversation, including username and numeric ID
- Report and block through the platform's own tools
- Decide whether this is isolated or part of a pattern
- Post a factual, link-free update if the pattern warrants one
- Log the incident and review admin permissions if a staff account was involved
Go and check tonight whether your own pinned message actually names a handle, or just says "beware of scammers" and leaves the rest to luck. Scam prevention works when official routes are unmistakable and reports are handled quickly, and that's the gap Coinpresso's community-strategy work is built to close: defining the operating model, the moderation workflows, and the role structure before a scammer finds the one you never wrote down.
Contact Coinpresso to build a Telegram zero-trust DM protocol around your community's actual structure, not a generic template.
FAQs
Do real Telegram admins DM users first?
Almost never. Telegram's own FAQ confirms accounts can only be contacted by someone who already has their number, messages first, shares a group, or finds a public username, which is exactly the access an impersonator exploits without needing to breach anything. Treat any unsolicited DM claiming to be staff as false until verified against your pinned support handle.
What should a user do after receiving a fake-admin DM?
Don't click, reply, or share anything, and report the account through Telegram's in-app tools. Then check the claim against your project's official help page rather than anything stated inside the DM itself, since a scammer's message is not a source you can verify against itself.
What evidence should be saved before a scammer deletes a chat?
A full screenshot of the conversation with timestamps, the display name used, and the account's numeric user ID, since the display name alone can be changed at will. Save any link as plain text rather than clicking it again, and do this immediately, since an account under suspicion can disappear within minutes.
Should a project post every scam report publicly?
No. A single isolated DM to one member is usually handled quietly through direct support; a pattern hitting multiple members is what earns a group-wide, factual alert. Our crypto community management work includes setting that threshold in advance, so a team isn't deciding it mid-incident.
Can a community promise fund recovery?
No, and it should never be implied even informally in chat. State plainly that recovery cannot be guaranteed, and direct the affected member to the platform's own reporting channels rather than suggesting the team has a process for getting funds back.
