Telegram takeover via a “vote for my child” message: how the scam works and how to protect yourself

Over the past three weeks, five people came to us with the same problem: their Telegram account had been hijacked. Every time it started with a harmless request from someone they knew — to vote for a child in a children's drawing contest. Here is how the scheme works, how to recognise it and what to do so it doesn't happen to you.

What the message looks like

The message comes from someone in your contacts whose account has already been taken over. It is short and personal — “Hi, could you give a 👍 for (child's name)? Thanks ✊”, sometimes with your name in the greeting. Below it is a link to an “International online children's drawing contest 2026” with a cute picture and a “semi-final” or “quarter-final” label.

The contest names change — Little Visionaries, Color Symphony, Brave Artists. But the website address always gives the fake away: a meaningless string of letters on domains such as .mom or .help, with no connection to any contest or to Telegram.

Sometimes, a few days before the link arrives, the same account asks to borrow money: “Do you have 18 thousand until this Sunday?”

How the scam works — in plain terms

To “vote”, the site asks you to confirm your identity through Telegram: enter your phone number, then the confirmation code, and your cloud password if you have one. In reality you are not giving this to Telegram but to the scammers, who immediately log in to your account from their own device.

From what we have seen, it always follows the same script:

a script tries to log in to the account every hour, making it harder for you to regain access;
the same contest link or requests for a loan go out in your name — this is how the scammers find their next victims;
your contacts trust the message because it comes from “you”, and they vote.

For a company this is more than a personal nuisance. Many people keep work chats with clients, suppliers and accounting in Telegram, and a request “from the director” there is believed faster than an email from a stranger.

Signs your account has already been hijacked

Your username or profile photo has changed.
You have been entered into suspicious contests.
You see a message sent from your account that is immediately deleted.
Friends say they are getting strange messages from you that you can't see.
You receive a login code for a new device even though you weren't logging in.

What to do today — 10 minutes

Turn on two-step verification: Settings → Privacy and Security → Two-Step Verification. Create a password, add a recovery email and confirm it with the code you receive.
Check your devices: Settings → Devices. End any sessions you don't recognise. There you can also have inactive sessions terminated automatically, for example after a week.
Never enter your phone number, code or password on third-party websites. Two-step verification only protects you while the scammers don't know the password: type it into a fake page and it won't help.
Asked to vote or lend money? Call your friend first. A one-minute call costs less than a hijacked account.
Tell your staff about this scam, especially those who run work chats with clients.

If your account has already been hijacked

If you are still logged in on any device, go straight to Settings → Devices → Terminate All Other Sessions.
Keep Telegram's built-in protection in mind: a newly connected device cannot terminate other sessions for the first 24 hours. If your only access is on a new device, contact support via Settings → Ask a Question. Replies come from volunteers, so they may take a while.
If you have no access at all, try logging in again with your phone number and a code sent by SMS.
Once you are back in, turn on two-step verification — or change the password if you typed it into a fake site — and warn your contacts that the requests didn't come from you.

If a contractor handles your company's IT

Ask them two things: do the staff who run work chats have two-step verification turned on, and is there a clear plan for a hijacked account — who to warn and how quickly to inform clients. If there's no answer, it's worth sorting out before the scam reaches you.

Already dealing with a hijacked account, or want to check how well your staff's accounts are protected? Message @NextGenITCY or write to info@nextgenit.com.cy — the first consultation is free. And you can check whether your company's email is protected against spoofing for free in 10 seconds: domain check.

Sources: Kaspersky Daily.