No Campaign Was Scheduled. Why Was a Brand-Named Bot Asking Users to Fill a Form?
Separate user reports can describe an old automation, an internal mistake, or an impersonator. This composite incident workflow shows how a brand-security lead can join observable bot, link, wording, and source evidence before choosing a response.
Signal anatomy · Representative workflowThis page documents a representative operating model for this type of work. It does not describe a named customer, live product-operation record, testimonial, contract, revenue result, or verified conversion.
Signals to watch
- Users in separate authorized groups report a bot using the brand name and directing them to the same nonofficial form or domain
- Bot username, destination link, requested action, wording, and observation time can be compared without inferring the operator
- The internal campaign calendar and connected-tool records contain no matching approved activity
- A day of delay can allow links or account details to change and leave more users without an official clarification
The first report reaches the brand-security lead through an official user group:
Is this your promo bot? It says fill the form to keep the trial.
The screenshot shows the brand display name and part of a link. It does not show the full bot username, the source group, or whether the reporter interacted with it.
A regional community later contains a similar question:
Got the same thing. Link isn’t on your site, right?
The company campaign calendar shows no matching promotion.
Composite incident: These reports are illustrative. They do not represent a real user, private conversation, bot, data event, customer, or security finding.
The brand-security lead has to decide what to do before knowing who controls the bot. Waiting a day can make the investigation harder because account details and destinations may change, and users may remain without an official clarification. Acting immediately on one screenshot can also misfire if the message came from an approved regional partner or an old automation that was never disabled.
The old workflow separates reports that belong together
Support forwards one screenshot into a ticket. A community manager posts another in an internal chat. A partner admin sends a cropped image without the source message. Each team asks, “Is this ours?”
The brand-security lead manually compares what is visible, searches the campaign calendar, and asks tool owners whether any scheduled message matches. By the time the pieces meet, the bot username or landing page may have changed.
The screenshots create another problem: reposts look like independent exposure. One user’s image can travel across several groups. Counting appearances would exaggerate the evidence, while ignoring every repeat could hide a genuine cross-group pattern.
The required unit of work is one candidate incident with a traceable report list, not a folder of images.
Five observable artifacts come before an attribution
The team can compare what the public reports actually contain:
- Bot username: display names are easy to copy; the complete username is a more useful identifier.
- Destination: record the full domain and path visible in the source, not only the button label.
- Requested action: note whether the message asks for contact details, credentials, payment, or another step.
- Wording and brand elements: compare the claim, offer, support language, and reused visual identity.
- Source and time: retain which authorized group contained the report and when it was observed.
Matching artifacts can connect reports. They still do not identify the operator, prove compromise, establish how many recipients saw the message, or show whether anyone submitted information.
Internal absence is evidence, but not yet attribution
The next check stays inside the company. The brand-security lead compares the reports with the approved campaign calendar, bot inventory, connected marketing tools, partner permissions, and recent configuration changes.
No matching campaign raises concern. It does not prove an external impersonator. A former agency account, a regional partner, an expired workflow, or a tool with old credentials may still explain the outreach.
The investigation therefore records two separate statements:
- no approved campaign currently matches the reported message;
- control of the reported bot and destination remains unknown.
Keeping those sentences separate prevents the public response from outrunning the evidence.
Group reports become one candidate risk event
The provider connects only the Telegram user communities, support groups, regional communities, and partner-admin groups it is authorized to access. A monitoring rule looks for the brand name or close identity match combined with an unexpected promotion, verification request, or off-domain form.
TOP Prospect can classify and deduplicate matching group messages, retain original text, source, time, context, AI summary, ranking reason, and cross-group corroboration, and organize related material into a candidate risk Signal. The candidate helps a person review artifacts together. It does not read users’ private messages, inspect the bot owner, declare impersonation, contact recipients, or disable an account.
Priority can rise when independent sources share the same username, domain, and request. A forwarded copy remains one source chain rather than extra confirmation.
The response depends on what the human check finds
The brand-security lead can now choose a proportionate state.
Approved or legacy activity found. Stop the external-attack assumption, identify the internal owner, and correct the configuration or approval record through the company’s own process.
Control still unknown, user-facing risk visible. Preserve the URLs and source reports, notify the internal incident owner, and consider an official clarification that states only what is known. Any account-access change or platform report is performed by an authorized person.
Evidence conflicts. Keep the event under review. A similar display name with a different username or destination may represent an unrelated message, not the same incident.
No candidate state confirms data loss, affected-user count, or malicious intent. Those require evidence outside the group reports.
The right first answer is precise, not dramatic
The opening question was “Is this your promo bot?” A responsible first answer does not need to identify an attacker. It can say that the message does not match an approved campaign, name the official channels users should trust, and ask for the complete username and link through the company’s reporting process.
Behind that response, the team has one record tying each report to its source and showing which artifacts match. If the event is internal, the record helps end a false alarm. If the pattern continues across independent groups, it supports escalation without inflating copied screenshots into separate incidents.
Brand protection begins by proving which messages belong to the same event and which approved activity does not explain them. Attribution comes later.
Market and risk discussion is supporting evidence
Top Prospect is primarily a Telegram lead-generation product. Market and risk discussion can add context to a candidate lead, but it does not become a verified incident, trend, or sales opportunity automatically.