A fake Telegram account in your company's name: what to do in the first 24 hours

A fake account in a company's name is rarely found by the company first. More often a customer who has already paid finds it, and writes to you to complain. You learn about the problem later than the fraudster does, and every hour before you react is another person he may manage to deceive. In Ukraine, Georgia and much of Eastern Europe, deals routinely start in Telegram, which is why a fake manager there is believable.

Below is a plan for the first day: what you can do yourself, where to write, and where the part you can handle without outside help ends. Reporting to Telegram is one step among several, and not the first.

Make sure it is really a fake

Not every account carrying your name is fraudulent. It may be a dealer advertising your products without permission, a former employee with an old signboard, or a fan running a page about your brand. Those call for a different conversation: a letter, a demand to drop the name, an agreement. A fraud report may be out of place and may offend people you work with.

Fraud looks different. The account presents itself as your official side, asks people for money or data, writes to customers first, applies pressure ("the offer ends today") and steers them to a third-party payment. If there are no signs of fraud and the name is simply being used, that is a question of trademark rights, and the person to see is a lawyer, not the report button.

Record first, then report

The most common mistake of the first hour is to press "Report" at once and wait. If the account is removed, the evidence goes with it: what it told people, which payment details it gave, which sites it linked to. The bank, the police and your lawyer will want exactly that, and it is almost impossible to get back. So the order is: save, then report.

Where to report in Telegram

Telegram's official FAQ names the bot @NoToScam for impersonation. For illegal public content, meaning channels, groups and bots, there is a separate address, abuse@telegram.org. Copyright complaints go to dmca@telegram.org, but only from the rights holder or their representative. You can also report from the button in the account's profile.

Two limits are worth knowing in advance. Telegram says private groups and chats are private to their members and it does not process requests about them. So the moderators will not see the fraudster's correspondence with a particular victim until the victim sends it in. And second, we found no guaranteed review time in the public FAQ, so a plan should not assume "removed within a day".

How to write a report that is not dismissed after the first line

A person reads the report, and needs to grasp three things in a minute: there is an original, the account passes itself off as that original, and it harms people. "This is fake, please delete" gives them none of the three.

File in each channel separately, with the same evidence. If nothing changes after a few days, do not send the same report ten times. Add something new: new victims, new payment details, new accounts. A repeat filing with fresh material is read differently from a copy of the first.

Warn your customers while the account is live

While the report is under review the account keeps working. The cheapest protection during those days sits in your real channels: a list of the only official accounts, a reminder that managers never ask for a transfer to a private person's card in a messenger, and where a customer can check who is who. Pin the post, repeat it on the website and in the newsletter. It will not remove the clone, but fewer people will believe it, and the question of whether you warned your customers is closed.

If money has already moved

Then there are two addressees outside Telegram. The first is the bank or payment system that received the money: the sooner it gets a written notice, the better the chance of freezing the recipient's account. The second is law enforcement: your local police or cybercrime unit, and in Ukraine the Cyberpolice, which takes cybercrime reports through the form at cyberpolice.gov.ua/declare with the evidence attached.

Classification is for investigators and lawyers. As a reference point, in Ukraine fraud falls under Article 190 of the Criminal Code, and unlawful use of a trademark or company name under Article 229, which applies where it caused significant material damage. Other countries have their own equivalents. Which provision fits depends on what exactly the account copies, and that is a question for a lawyer in the relevant jurisdiction.

Why the clone comes back

You removed the account, and an hour later an identical one appears under a different username. For this type of fraud that is routine: creating an account is cheap, removing one is slow. A sensible strategy is not hunting every copy. It rests on two things: watching for new variants of your name, and watching where the money goes. Payment details, a domain or a payment link are a narrower point than accounts. Blocking those hits the operation itself, not one signboard.

What inaction costs

The mechanics are simple; the numbers are yours. Every customer who sends money to someone else's details is either a refund from your pocket to protect your reputation, or a person lost who believes you are to blame. Add the hours of support untangling complaints, and managers answering "was that you who wrote to me?" instead of working. The least pleasant part is invisible: people who saw the clone never wrote to you and simply decided the company is unreliable.

A hypothetical example. The clone runs for two weeks, ten customers contact it, three send an advance. If the average advance is 500 dollars, that is 1,500 dollars you refund or lose along with their trust. Recording the evidence and filing a report costs several times less. The figures are illustrative; substitute your own: the average advance, the number of inquiries, your managers' time.

What you can do yourself, and where separate work begins

The steps above are within reach of an owner or a marketer in a few hours. Separate work begins when there are several accounts, the clones come back, or you need to answer who is behind it: which accounts are linked, whether the payment details match, whether there are traces of advance preparation. That is open-source intelligence. We do it within reputation defense: we look at your brand through the eyes of someone preparing a fake, record the evidence so that a bank, the police and a lawyer will accept it, and watch for new clones.

We do not guarantee removal. The platform decides. We prepare what it weighs and make sure you are not left without evidence. Why a paid promise of a result should make you wary is covered in a separate article.

Frequently asked questions

Related reading: what you can and cannot buy, in fake account removal for hire; what to preserve, in evidence for a fake account complaint; and the wider case, in why reputation matters to a business.