Telegram Impersonation Scam: Beware of Fake 48-Hour Account Deletion Warnings

Spanish consumer authorities warn of a wave of phishing scams impersonating Telegram, using urgent account deletion warnings to trick users into sharing verification codes. Once scammers obtain the code, they gain full control of the victim's account and lock them out.

How the Scam Works

This fraud uses a fake system notification mimicking Telegram's official alerts. The message warns that the account is in a "provisional state" and must be verified within 48 hours to avoid deletion or deactivation. The scammers deliberately use administrative language and technical terminology to increase credibility.

The message includes two links: one to "start verification" and another for "more information." Clicking the first link displays a screen requesting a 5-digit verification code. This is where the fraud occurs.

Why This Scam Is Effective

How scammers gain control:

The message appears to come from the system, not an unknown sender, lowering the victim's guard
The 48-hour deadline creates artificial urgency, pushing users to act without thinking
Verification codes are normally associated with legitimate security processes, causing users to trust the request
Once scammers obtain the code, they access the account and lock the victim out completely
All active Telegram users—new or experienced—are potential targets, regardless of previous data exposure

Distinguishing fake from real Telegram alerts:

Legitimate Telegram verification is completed within the app's settings, never through chat links
Official notifications do not include countdown timers or deadlines
Telegram will never request verification codes via messaging
Real alerts direct users to access the app directly, not through provided links

Prevention Steps

Never click links in such messages: Ignore all URLs in suspicious alerts
Do not share verification codes: A verification code is the final lock on your account. Never share it, even if someone claims to be Telegram
Protect personal and financial information: Never provide passwords, bank details, or personal data in response to chat messages
Always launch the app directly: Open Telegram using the phone's app icon, never through received message links
Be suspicious of urgency: Any alert demanding immediate action within a strict timeframe is a red flag

If You've Already Shared Your Code

Quick action is critical:

Report immediately: Contact Spanish law enforcement (National Police or Civil Guard)
Check your account: Review active sessions on your phone for unauthorized access
Seek help: Contact INCIBE (National Cybersecurity Institute) or local consumer protection offices for guidance on filing reports
Act fast: The sooner you report, the better the chances of recovering account control and preventing further misuse

The Evolution of Phishing

This scam represents how phishing fraud has evolved. Traditionally delivered via email, it now targets messaging apps where users feel more secure. The underlying tactic remains the same: exploit urgency to prevent victims from verifying the request. The sophistication lies in the technical framing—requesting a verification code rather than a password makes users believe they're performing a legitimate security action.

Where to Report

Spanish Consumer Association (AEC)
National Cybersecurity Institute (INCIBE)
Local consumer protection offices
Spanish National Police (CNP) or Civil Guard (Guardia Civil)