Telegram users who sell anonymous numbers and usernames face a new scam involving fake cryptocurrencies
Security researchers and observers note a recent scheme circulating among some Telegram markets where attackers pose as buyers and push a counterfeit digital asset as payment. The mechanism begins when a scammer sends a small, seemingly harmless token to the victim as a preface to negotiations about selling a virtual number or alias. The offer appears legitimate at first glance, and the buyer and seller may agree to a larger settlement that is framed as payment for the item. In one described case, the proposed settlement was 4000 TON, a sum claimed to be equivalent to about 688 thousand rubles in the eyes of the participants, with the attacker stating the funds had already been sent to the seller’s wallet. The danger lies in the deceptive timing and framing of the transfer, which nudges the seller toward completing the sale before the actual funds are verifiably in their account.
Another sign of the scam involves the Tonkeeper app showing a transaction labeled as the receipt of 4000 TONS, yet the balance in the user’s account does not reflect this activity. After a delay, the transaction name changes from TON to 4000 SCAM, and the new token then appears in the wallet itself. Crucially, the SCAM token carries no real value and is used to create a veneer of legitimacy during the initial interaction. This manipulation of transaction labels is designed to sow confusion and to prevent immediate skepticism from the seller.
Guidance from Durov’s Code explains that once such payment information becomes visible, scammers may quickly reassure the seller that the funds will appear in their account soon. The seller is then urged to wait and to press for the transfer of the sold item before the money is truly secured. This pressure tactic is central to the scam, pushing victims to hand over control of their username or virtual number before the payment is fully realized on the blockchain ledger.
Despite the lack of transparency in these schemes, scammers often keep the narrative moving by claiming that technical issues or delays are temporary, and that the money is just about to arrive. The victim, wanting to close the deal, may proceed with the sale in a bid to avoid losing the opportunity. The underlying trick rests on the mismatch between the perceived immediacy of a transfer and the verifiable state of the funds on the blockchain, which may not align with the attacker’s assertions.
The method by which scammers rebrand the cryptocurrency within the transaction is not clearly understood and appears to rely on rapid, deceptive labeling that bypasses initial skepticism. The renaming to words like SCAM is a deliberate ploy to confuse the buyer after the fact and to obscure the true nature of the token. Observers emphasize that such tactics can escalate quickly once the seller has publicly committed to the exchange.
Telegram users who intend to buy or sell virtual numbers or aliases are advised to rely on official trading platforms or marketplaces that have verifiable reputations. The guidance to use authenticated venues helps reduce exposure to counterfeit tokens and fraudulent transfer claims. In the past, industry observers have warned that certain fraud schemes relate to the purchase of state-backed or government-linked digital assets, underscoring the importance of cautious behavior when large sums are involved. The key takeaway is to verify wallet balances, confirm transaction histories directly on the blockchain, and avoid partial payments or promises of imminent funds as a sign of a legitimate sale.