It arrives from someone you know — or someone whose account was already taken. The ask is small: support them in a regional award, a children’s drawing contest, a “professional recognition” vote. The link is not telegram.org or t.me. Domains like onvote-r.click or lookalike “sign-in” sites do the real work.
What happens next is account theft, not democracy. The page asks you to “log in with Telegram” or enter your phone number. Attackers trigger a real login attempt against your account. Telegram sends a one-time code in the official system chat. The fake site asks for that code “to confirm the vote”. Hand it over and they own a new session — then the same voting spam goes out to your contacts. Security firms including Kaspersky have described this vote-and-contest pattern for years; the bait changes, the OTP harvest does not.
Never type a Telegram login code on a website. Never scan a QR code from a stranger’s “vote” page. Official Telegram codes arrive in the system chat named Telegram; they are not meant for contests, “double vote” bonuses or third-party forms. If you already typed one, open Settings → Devices, end unknown sessions, turn on two-step verification with a strong password, and warn friends by another channel. Voting for a mate should not require your messenger keys.
If an account takeover led to money loss or blackmail, start at Get help.
This article is for general information only. It is not legal or financial advice. Details change. If you have lost money, contact your bank or card issuer and use the routes on the help pages.