Impersonation and DM scams on X, Telegram and Discord

Fake founders, fake moderators, fake friends. How impersonation scams start in your DMs and replies, and simple rules that shut them down.

Last reviewed 2026-10-27 · 2 min read

On this page
  1. Common impersonation patterns
  2. Rules that shut them down
  3. Telegram-specific traps
  4. Discord-specific traps

Most crypto scams begin with a message. The sender looks like someone you trust: a project, a founder, a moderator, an influencer, or a friend whose account was hacked.

Common impersonation patterns

  • Fake project accounts with the same name, logo and banner, and a handle that differs by one character or an underscore. Paid verification badges are easy to obtain, so a checkmark does not prove identity.
  • Reply guys. Accounts that reply instantly under a real announcement with "Claim here" or "Airdrop is live".
  • Fake moderators and admins who DM you right after you post a question in a Discord or Telegram group.
  • Fake influencers offering private "investment signals", "whitelist spots" or "presale access".
  • Hacked friends. A real contact's account sends you a link to "vote for me", "test my game", or "check this airdrop".
  • Fake recruiters offering a job that requires downloading software. See fake job malware.

Rules that shut them down

  1. Do not accept unsolicited help. If you did not start the conversation, assume it is a scam.
  2. Check the handle, not the name. Display names can be anything. Compare the exact handle with the one linked from the project's official website.
  3. Verify through a second channel. If a friend sends a strange link, contact them another way before clicking.
  4. Turn off DMs from strangers where the platform allows it. On Discord, you can disable direct messages from server members per server.
  5. Never move a conversation to another app at a stranger's request.

Telegram-specific traps

  • Fake verification bots. A group asks you to "verify you are human" through a bot that then asks you to log in to Telegram or paste a code, giving the attacker your Telegram session.
  • Lookalike group links shared in replies, leading to a copy of the official group full of scam admins.
  • Fake "safeguard" or captcha portals that tell you to paste a command into your computer. Never paste commands from a chat into a terminal, Run box or browser address bar.

Discord-specific traps

  • Fake "security check" or wallet verification links posted by a hacked moderator account or a lookalike bot.
  • DMs offering a role, mint spot or support ticket. Real staff answer in the server's public support channels.
  • Screen-share and QR code requests. Scanning a QR code someone sends you can log them into your account.