Telegram Captcha Types Compared: What Still Stops Bots in 2026

Spam is the moderation problem group admins complain about most, and the standard answer has been a captcha on join.

That answer is now half-obsolete, for a reason worth understanding before you pick a captcha type: the dominant attack no longer fails a captcha.

What you are actually defending against

Attacks fall into three groups, and they are not equally hard.

Automated joins. A script joins and immediately posts a link. Captcha stops this completely. It is also the least common attack now, because it is the easiest to stop.

Coordinated join raids. Waves of fresh accounts from cheap bot farms. They join, wait a random interval, then start dripping links. Often the captcha is solved — by a human in the farm, or by software.

Invite bombing. Users added to groups they never joined, then exposed to coordinated manipulation by accounts posing as ordinary members.

Read the second one again. The delay is the whole point. A captcha is a gate at the moment of entry; an account that solves it and then goes quiet for three days has walked through your gate legitimately. Your captcha reports success.

For context on scale: Scam Sniffer recorded a ~2,000% rise in Telegram-based crypto malware between November 2024 and January 2025, and Bitsight observed about 1,800 Telegram bots carrying roughly 5 million infostealer logs, with timestamps going back to 2020 and clustering from 2022 onwards (Bitsight, Exfiltration over Telegram Bots: Skidding Infostealer Logs, October 2024). Telegram itself is now taking down 80,000–140,000 channels and groups a day, up from a historical baseline of roughly 10,000–30,000, with peaks above 500,000 in a single day (Check Point Research, March 2026).

This is an industrialised problem, and a maths puzzle at the door is not a proportionate response to it.

The captcha types

Button captcha. "Tap here to confirm." Lowest friction, and stops only the crudest scripts — a single tap is trivial to automate. Reasonable for low-value public groups where friction costs more than spam does.

Maths captcha. "What is 7 + 3?" Marginally harder to script, and genuinely annoying for humans. Poor trade: it filters almost nothing extra while adding real friction.

Image captcha. Distorted characters. Stops naive automation. Modern solving services handle these cheaply, and they are hardest for exactly the users you want — mobile, small screens, bad connections, visual impairments.

Poll or quiz captcha. A question with several options, often topic-specific. The interesting property: it can test whether the person belongs here, not whether they are human. "What is this group about?" filters bot farms that join thousands of unrelated groups.

Timed challenge. Any of the above with a deadline; fail to respond and you are removed. The removal is doing more work than the challenge.

Bio and metadata checks. Not a captcha at all, and increasingly the most useful. More below.

The comparison

Type	Stops scripts	Stops bot farms	User friction	Verdict
Button	Partly	No	Very low	Fine as a baseline
Maths	Yes	No	Medium	Poor trade
Image	Yes	Rarely	High	Accessibility problems
Poll / quiz	Yes	Partly	Medium	Best captcha, if topical
Timed	Yes	No	Medium	Removal is the real feature
Bio checks	n/a	Yes	Very low	Do this regardless

Only two things in that table meaningfully affect bot farms, and one of them is not a captcha.

The check worth more than any captcha

When someone requests to join via a link created with creates_join_request=True, your bot receives a ChatJoinRequest, which carries the user's bio when they have one — the field is Optional and simply absent for users with an empty bio.

You get to read their profile bio before deciding whether to admit them, with no puzzle for the user to solve. The friction is not zero — a join request means waiting for approval instead of joining instantly, so approve fast — but it is friction the user never has to do anything about.

Bot farm accounts are astonishingly consistent here, because the bio is their advertising:

Links in the bio, especially to channels, wallets or "signals"
Phrases like crypto signals, investment, trading, forex, earn daily
Contact handles inviting a DM
Empty bio combined with no username and no photo — weak on its own, meaningful in combination

Score it, don't ban on it. A link in a bio is suspicious, not proof. Combine two or three signals before auto-declining, and route borderline cases to a human.

This is the single highest-value anti-spam measure available on Telegram, and it costs your real users almost nothing.

What to actually deploy

A layered setup, in order of value:

Join requests instead of open links. You approve entry rather than gating it. See auto-approve join requests.
Bio and metadata scoring on the join request. Free, invisible, effective.
A light button captcha for anything that passes but looks marginal.
New-member restrictions — restrictChatMember with a reduced ChatPermissions set, for a window longer than the dwell time you actually observe rather than a default 24 hours. You can switch off media (can_send_photos, can_send_videos, can_send_documents, can_send_audios, can_send_video_notes, can_send_voice_notes), stickers and inline bots (can_send_other_messages) and link previews (can_add_web_page_previews). There is no link permission and no forward permission: stopping a plain URL means can_send_messages=False, which blocks all text, or deleting link-bearing messages with your own filter. This is what blunts the delayed-drip attack, provided the restriction outlasts the wait.
Content filtering on first messages from accounts under a week old.

Step 4 is the one people skip and it is the one that matches the modern attack. Captcha defends the door; restriction defends the room, and the attack you face now walks in politely and waits.

What to stop doing

Don't rely on captcha alone. It addresses the attack that was common three years ago.

Don't use image captchas unless you have a specific reason. They cost you real members and stop few farms.

Don't set aggressive auto-bans on single signals. A user with a link in their bio is very often a legitimate creator. Score, don't execute.

Don't leave verification as your only control. Everything above assumes the account gets in eventually. Plan for what it can do afterwards.

The honest summary

Captcha is now a baseline hygiene measure, not a defence. It stops the crude automation and nothing else.

The two things that work against the current threat are checking the bio before admission and restricting what new accounts can do until they have been present longer than the attacker is willing to wait. Neither is a captcha, both are invisible to legitimate users, and together they address the delayed-drip attack that captcha structurally cannot.

Threat figures are sourced inline above. API capabilities verified against Telegram's Bot API documentation, September 2026.