A Support Bot Asked for a Verification Code. Check the Official Entry Point.

Signals to watch

• A similar avatar triggers identity review; a refund promise followed by a code or wallet request creates the sensitive action chain
• The official Bot list tests the entry-point relationship, while username similarity cannot identify the operator

When the brand-security lead in Telegram-native ecosystem receives a report about a “support Bot,” its avatar and name justify an identity check. The stronger basis for priority is what the conversation asks the user to do. The exchange below is composite material used to demonstrate action-chain review. It is not an actual customer conversation or a live product-operation record.

Circle the verbs before judging the avatar

Read the contact as a sequence of actions: it promises to process a refund, then asks for a verification code or directs the user to connect a wallet. Avatars, display names, and lookalike usernames can all be copied. “Send,” “connect,” and “open” preserve the requested behavior.

An incomplete exchange might read:

“I can process the refund for you.”

“Send the verification code, or connect your wallet to confirm.”

That does not identify the Bot operator or show that the user complied. It is enough to preserve the full conversation, Bot link, username differences, and requested actions, and to place the report ahead of an avatar-only imitation with no sensitive request.

Use the official list to test the entry point

Reach the official Bot list through the brand’s own site, app, or previously verified announcement, not through a “verification” link supplied by the disputed account. A match can establish an authorized entry-point relationship. No match creates a reason for further security investigation; it does not reveal the operator.

Preserve the complete username because underscores, repeated letters, and similar characters can disappear in a cropped screenshot. Keep the Bot link, conversation time, and sensitive request attached to the same material so the review does not end with an untraceable avatar.

Keep the conversation chain separate from the propagation chain

The same chat screenshot forwarded through different Telegram groups adds distribution nodes, not another Bot or affected user. In a monitoring task covering groups that a user actively connects and is authorized to access, TOP Prospect can gather support-account, refund, code, and wallet discussions, deduplicate same-source reposts, and retain the original message, source, time, Bot link, and adjacent conversation with a candidate Signal (a risk item awaiting human review). Priority sets review order; it does not automatically verify identity or loss, and the product does not contact reporters.

Human review then separates independent reports: a different original conversation, a new username or link, or a newly observed action. Seeing the same screenshot in another group cannot support an affected-user count.

Preserve the material before the link or account changes

Bot usernames, links, and conversation content can change. Once a sensitive request appears, preserve the original exchange and compare the official entry point promptly. If the list confirms the Bot, the issue moves to internal support and security review. If no authorized entry exists and the action chain is clear, security can decide on a bounded warning, platform report, or blocking coordination.

Any external statement should remain with observed facts: which account requested which action and whether an official-list match exists. The operator, affected-user count, and actual loss still require investigation and cannot be inferred from report volume.

PRODUCT SCOPE

Market and risk discussion is supporting evidence

Top Prospect is primarily a Telegram lead-generation product. Market and risk discussion can add context to a candidate lead, but it does not become a verified incident, trend, or sales opportunity automatically.

Review the product workflow and boundaries →