Detecting Bought Members in a Telegram Group

Fake Telegram members arrive in a group three ways: you bought them, a previous admin or agency bought them, or someone sent them to you unrequested — as sabotage, or as the free sample in a sales pitch you never asked for.

All three matter, because the damage is the same and only one of them is your decision.

What they actually cost you

Your engagement ratio collapses. This is the real damage. Sponsors, partners and advertisers judge a channel on views and reactions relative to members. Ten thousand members with 200 views per post reads as a dead or fake channel — and to anyone evaluating you, those are indistinguishable.

Your metrics stop working. Conversion rate, churn, activity rate all get divided by a denominator that includes accounts that will never do anything. You lose the ability to tell whether your actual community is growing.

Platform risk. Telegram is taking down 80,000–140,000 channels and groups a day in its current enforcement posture. Inauthentic activity is not a safe thing to be carrying, whoever put it there.

Moderation load. Bulk accounts do not stay inert forever. Many are resold or repurposed later.

The signals

Ratio checks — do these first

Views per post against member count. The fastest test. Healthy channels vary enormously by niche, but a sharp, sustained divergence between member growth and view growth is the clearest signal available. Members up 40% and views flat means the new members are not people.

Reactions and comments against views. Fake accounts inflate membership, rarely engagement. A channel with strong views but almost no reactions may have bought the views too.

The shape of growth. Real growth is lumpy and correlated with something — a post, a mention, a campaign. Bought growth is a step function: flat, vertical, flat. Plot daily joins and the jump is visually obvious.

Join-pattern checks

The Bot API gives you the data if you record it.

Membership changes arrive as the chat_member update, carrying a ChatMemberUpdated object. You receive it only if the bot is an administrator in the chat and "chat_member" is listed explicitly in allowed_updates on setWebhook/getUpdates — it is excluded by default. The object contains:

invite_link — Optional, present only for joins through an invite link. Absent for joins via a public @username, for admin-added members, and for chat-folder invite links (which set via_chat_folder_invite_link)
via_join_request — Optional, and only True when the user sent a direct join request without an invite link. Approvals that arrived through a creates_join_request invite link are not flagged here; they carry invite_link instead, so key source tracking off invite_link
date — when
from — who performed the change. Always present; on a self-join it is the user themselves, so an admin-added member is one where from.id differs from new_chat_member.user.id

Three things to look for:

Bursts on one link. Hundreds of joins in minutes through a single invite link, with no campaign to explain it.

Uniform timing. Real joins scatter across the day and follow your audience's timezone. Bulk joins cluster unnaturally — evenly spaced, or all inside a few minutes at an hour nobody is awake.

Members added by an admin. If accounts arrive via an admin action rather than a link, that is worth knowing regardless of the explanation.

Account-level signals

Individually weak, meaningful in combination:

No username, no photo, no bio
Usernames following a pattern — a name plus random digits, repeated across many accounts
Never posts, never reacts, never reads
Bios containing links or promotional phrasing
Not Telegram Premium (weak on its own — most real users aren't either)

No single one of these means anything. Plenty of legitimate lurkers have no photo and never post. Look for clusters: fifty accounts that joined in the same four minutes, through the same link, with the same username pattern and empty bios.

Working out where they came from

The diagnosis changes what you do.

You bought them. Stop, then clean up. Nothing else will work while the supply continues.

Inherited. Common when a channel or an agency relationship changes hands. Check the join history for step functions that predate you.

Sent to you. Someone bought members for your channel — as sabotage, or as a "free trial" from a seller hoping you'll buy more. If this happens, tighten entry immediately: switch to join requests so nobody can push accounts into your group without your approval.

That last point is worth emphasising: with an open invite link, anyone can send members to your channel and you cannot prevent it. Join requests are the strongest structural defence, because entry requires your approval. Capped links (member_limit, 1–99999 simultaneous members) and expiring links (expire_date) limit the damage, and revokeChatInviteLink kills a leaking link outright — note member_limit cannot be combined with creates_join_request=True.

Cleaning up

Do it gradually. Removing 5,000 members in an hour is itself an unusual signal. Spread it over days.

Start with the highest-confidence clusters — the burst joins from one link at 3am with matching username patterns. Leave ambiguous accounts alone.

Never remove real lurkers. Someone who joined six months ago through a legitimate campaign and never posts is a normal member. Lurkers are the majority of any healthy community, and mistaking them for fakes is worse than leaving a few fakes in place.

Expect the headline number to look worse before anything looks better. Removing members with views flat improves your views-per-member immediately, but your member count drops and that is the number people see first. Do it anyway — a smaller real number is worth more than a large fake one to anyone whose opinion matters.

Record what you removed and why. You will be asked, by a sponsor or by yourself in six months.

Preventing it

Join requests instead of open links. The strongest structural control.
Alert on join bursts from any single invite link.
Separate invite links per source, so unexplained growth is traceable to a channel.
Track views-per-member weekly. A slow drift is easier to catch early than a collapse.
Never buy members. Obvious, and worth stating: the damage to your ratio outlasts any benefit, and the ratio is the thing sponsors actually look at.

The honest framing

The number that matters is not how many members you have. It is how many of them see your posts — because that is the number sponsors evaluate, the number your conversion rate depends on, and the only number that reflects a real audience.

A channel with 2,000 members and 1,400 views per post is in a far stronger position than one with 20,000 members and 900. If you are choosing between growing the first number and protecting the second, protect the second.

Daily takedown range from Check Point Research, March 2026, corroborated by Telegram's Moderation page, retrieved September 2026. API fields verified against Telegram's Bot API documentation, September 2026.