Are Telegram Bots Safe? What a Bot Can and Can't See

Updated: October 2026 · By the TeleCrow team · Facts checked 16 October 2026

Most Telegram bots are safe to use. A bot sees your public profile and whatever you send it, but it can't read your other chats, can't see your phone number unless you share it, and can't message you until you start it. The real risk is the person behind a bot: fake "verify" bots that ask for your login code, "earn money" bots that never pay, and sellers who move payment outside Telegram. Telegram's own advice is to treat bots like strangers.

What a Telegram bot can see

A bot is an account run by a program on its owner's server. Here is what that program receives, based on Telegram's Bot API (checked 16 October 2026).

• Your public profile: your numeric Telegram ID, first name, last name and username if you have them, your app language, and whether you have Telegram Premium. Bots can also ask Telegram for a user's profile pictures.
• Everything you send the bot: messages, photos, files, voice notes, and your location or contact card if you choose to share them.
• In groups, only part of the chat by default. Bots run in privacy mode in groups: they get commands meant for them, replies to their own messages and service messages (such as someone joining). A bot that is a group admin, or has privacy mode turned off, gets all messages except those from other bots (Telegram bot FAQ).
• In channels, every post in a channel it has been added to.

Chats with bots are normal cloud chats, not end-to-end encrypted secret chats. The bot's owner can keep what you send to it. So don't send a bot anything you wouldn't send to a company you don't know.

What a bot cannot see or do

• It can't see your phone number unless you share it. Telegram's user data for bots has no phone field. A bot can ask with a "share contact" button, and you decide whether to tap it.
• It can't read your other chats, your contacts list or your saved messages.
• It can't message you first. "Bots can't start conversations with users. A user must either add them to a group or send them a message first" (Telegram).
• It can't see when you're online. The user data Telegram gives bots has no "last seen" or online status.
• It can't charge you on its own. A payment in Telegram needs you to confirm it on the payment screen. The one exception is a Stars subscription you already agreed to: it renews each month until you cancel it in Telegram's settings.
• It can't log in to your account, unless you give it your login code and password. That is exactly what phishing bots try to get.

The real risks: fake bots, phishing and "earn money" bots

The technology is rarely the problem. These are the patterns that cost people accounts and money:

• "Verify your account" bots. A bot or a "support" account asks for your phone number and then the code Telegram sends you, sometimes your Two-Step Verification password too. With those, someone can log in to your account. The message that brings your login code tells you not to give it to anyone, even someone who says they are from Telegram.
• "Earn money" and task bots. They pay small amounts for clicks or tasks, then ask for a deposit or "activation fee" before you can withdraw. The withdrawal never comes.
• Investment and "double your crypto" bots. Guaranteed returns are a scam, whatever the screenshots show.
• Fake brand and support bots. Lookalike usernames copy real services. A real company's support bot will not ask for your password or login code.
• Payment outside Telegram. A bot that sends you to a private chat or a wallet address to pay leaves you with no record. See how to check a Telegram seller.
• Harmful files and links. Programs (APK, EXE) sent instead of the document you expected, or links to fake Telegram login pages.

Telegram's FAQ puts it simply: treat bots as strangers, and don't give them your passwords, Telegram codes or bank account numbers.

How to check a bot before you use or pay it

1. Get the link from the source. Open the bot from the brand's own website or long-running channel, not from a DM or a comment.
2. Read the @username letter by letter. Watch for extra underscores, swapped letters and words like "official" or "support" added on.
3. Look at what it asks for. A bot that wants your login code, password, card PIN or seed phrase is not legitimate, whatever it says.
4. For bots that take payments, send /paysupport. Telegram requires bots that sell for Stars to answer it and handle payment issues (developer terms, section 6.2.1).
5. Start small. Use the free features first, and make your first purchase the cheapest one.
6. Open files only from sources you trust, and don't install apps that a bot sends you.

If a bot asked for your login code

If you didn't send it: block the bot, report it from its profile, and delete the chat.

If you did send it, act now:

1. Open Telegram › Settings › Devices and end every session you don't recognise ("Terminate all other sessions").
2. Go to Settings › Privacy and Security › Two-Step Verification. Turn it on, or change the password if it was on, and set a recovery email you control.
3. Check your username, name and profile photo for changes, and look for messages sent from your account that you didn't write.
4. Warn your contacts that messages from your account in that time may not be from you.

For bot owners: handling people's data responsibly

If you run a bot, the people using it are trusting you with what they send. A few habits go a long way:

• Collect only what the bot needs. If you sell files, you don't need anyone's phone number.
• Say what you keep and why in the bot's description or /help, in plain words.
• Keep your bot token secret. Anyone with the token controls the bot and everything it receives. Our guide on bot token security explains how to store and rotate it.
• Limit who sees the data. Order history, support tickets and member lists belong only to the people who need them to help users.
• Answer payment problems. If you sell, respond to /paysupport and refund when an item doesn't arrive.
• Don't spam. Message people only about what they signed up for, and make it easy to stop.

If you are new to bots, our explainer what is a Telegram bot covers the basics, and Mini Apps vs bots explains how the two differ.

Build a bot people can trust

TeleCrow hosts your bot for you and masks the token in the dashboard unless you choose to show it. Shop bots send receipts and answer /paysupport when Stars is on, and support bots keep tickets in one place. Browse the bot types or start free.

Frequently asked questions

Are Telegram bots safe?

Most are. A bot only sees your public profile and what you send it, and can't read your other chats or message you first. The danger comes from bots built to trick you: ones that ask for your login code, ask for money upfront, or move payment outside Telegram.

Are Telegram bots real or fake?

Bots are real Telegram accounts run by programs, and many are useful. Some are fake copies of real brands with lookalike usernames. Open a bot only from the brand's own website or channel and compare the @username letter by letter.

Can a Telegram bot see my phone number?

No, not unless you share it. Telegram doesn't give bots your phone number. A bot can show a button asking you to share your contact, and only tapping it sends your number.

Can a Telegram bot hack my account?

Not by itself. A bot can't log in to your account. Phishing bots try to trick you into sending your login code and Two-Step Verification password; if you never share them, the bot can't get in.

Do Telegram "earn money" bots really pay?

Be very careful. A common pattern is to pay small amounts at first and then ask for a deposit or fee before a larger withdrawal, which never arrives. Never pay to unlock earnings.