The Telegram link that "gets you banned": what tg://msg_url really does

On 24 October, posts began spreading in Telegram channels about a link that starts with tg://msg_url. They say that opening it sends a pre-written phishing message from your account, and that Telegram then suspends you for spam. The posts attribute the warning to Telegram, but we found no statement from Telegram itself. The posts themselves say the information is not confirmed.

What is this link?

It is not a new vulnerability. tg://msg_url is Telegram's standard share link, described in the Telegram API documentation. It has two parts: a link and an optional text. When you open it, the app shows a list of your chats. After you pick one, it places the link and the text in the message field.

In the sample circulating on 24 October, that text advertises a collectible gift (a link to t.me/nft/…) for 1500 stars, a typical gift scam.

Does it send the message by itself?

According to Telegram's documentation, no. You have to choose a chat, and the message only goes out when you press Send. We have not tested every app version, so we cannot rule out that one behaves differently.

The real risk is a tired or hurried tap: you pick a chat, the text is already there, and you send it. People who receive a scam from you report it, and Telegram's moderators limit accounts that are reported for spam, as its spam FAQ explains. Repeat cases lead to longer limits.

How to stay safe

• Do not open links that start with tg://msg_url, t.me/share or t.me/msg/url from people you do not know.
• If a list of chats opens unexpectedly, close it. Never press Send on text you did not write.
• Be wary of offers of gifts, NFTs or stars. Real gifts arrive in Telegram itself, not through a link.
• Turn on two-step verification and check Settings, Devices for sessions you do not recognise.
• If your account was limited by mistake, write to @SpamBot, as Telegram advises.

What we do not know

We could not find the original source of the warning or any confirmed case of a message being sent without the user pressing Send. We will update this article if Telegram comments.