Dev.to Security πŸ” Cybersecurity πŸ‘ 0 πŸ“– 4 min read

Why a "free Telegram Stars generator" can't exist: a look at the Bot API

Search Telegram for "free Stars" and you'll find bots promising 5,000 Stars for joining a channel, generators that "add Stars to any account", and APKs that unlock "unlimited Stars". If you build on Telegram, your users

Search Telegram for "free Stars" and you'll find bots promising 5,000 Stars for joining a channel, generators that "add Stars to any account", and APKs that unlock "unlimited Stars". If you build on Telegram, your users will ask you about them, and some will lose their account to one.

The short answer is that a bot can't create Stars. The longer answer is more useful, because the Bot API tells you exactly what a bot can and can't do with Stars, and every one of these scams has to work around those limits. Once you know the limits, you can spot the trick.

Where Stars actually live

Telegram Stars are a balance on Telegram's servers, tied to an account. Users buy them inside Telegram (an in-app purchase, @PremiumBot or Fragment), and they move only when Telegram moves them. There is no client-side number to edit, no file on the phone that holds a balance, and no API that takes "add 5,000" as an argument.

So a "generator" has nowhere to write to. A modded APK can change what the screen shows, but it can't change the number Telegram's servers check when you spend.

Everything a bot can do with Stars

Here is the full picture from the Bot API, grouped by direction.

Stars coming in to the bot (the user always confirms):

  • sendInvoice / createInvoiceLink with currency: "XTR": the user sees a payment sheet and taps Pay.
  • sendPaidMedia: the user pays to unlock a photo or video.
  • Star subscriptions (createInvoiceLink with subscription_period), which the user starts and can cancel.

Stars going back out:

  • refundStarPayment: returns one specific payment to the person who made it. It can't send Stars to anyone else, and it can't send more than was paid.
  • sendGift and giftPremiumSubscription: the bot spends its own balance on a gift or Premium for a user. The docs note that a gift sent by a bot "can't be converted to Telegram Stars by the receiver".

Reading:

  • getMyStarBalance and getStarTransactions: the bot's own balance and history.

That's the complete list. No method credits Stars to a user out of nothing, and no method moves Stars from a user's balance without that user acting. A bot that says it will "send Stars to your account" after you complete tasks is promising something the API doesn't offer.

How the scams get around that

Since a bot can't take Stars on its own, every free-Stars scam needs you to do one of these four things.

1. Pay an invoice that looks like a fee

"Pay 50 Stars to unlock your 5,000." The payment sheet is a real XTR invoice, so it looks official because it is. The 50 Stars go to the scammer's bot, and nothing comes back. A refund can only come from the bot that charged you (or from Telegram support after a dispute).

Tell: any free-Stars offer that asks you to pay Stars first.

2. Hand over your login code

"Verify your account to receive Stars." The bot or a web page asks for your phone number and then the code Telegram just sent you. That code logs a new device into your account. Whoever enters it can spend your Stars, send your gifts and message your contacts as you.

Tell: anyone other than the official Telegram app asking for a login code. Telegram itself says never to share it.

3. Connect a bot to your account through Telegram Business

This one is newer and more convincing, because it uses a real Telegram feature. Telegram Business (part of Premium) lets you connect a chatbot to your personal account. When you connect it, you choose its rights, and the Bot API lists some powerful ones:

  • can_view_gifts_and_stars: see your gifts and Star balance.
  • can_convert_gifts_to_stars: turn your regular gifts into Stars.
  • can_transfer_and_upgrade_gifts: transfer your gifts to someone else.
  • can_transfer_stars: move Stars your account received into the bot's own balance (transferBusinessAccountStars).

A scam asks you to "connect our bot as your business chatbot to claim the reward". With those boxes ticked, it can empty the Stars and gifts it was given access to, and every call is legitimate.

Tell: a reward that needs a business bot connection. If you have connected one, open Settings β€šΓœΓ­ Telegram Business β€šΓœΓ­ Chatbots, and remove it or untick the gift and Star rights.

4. Install something or sign a transaction outside Telegram

A "Telegram Stars mod" APK, a browser extension, or a "claim on Fragment" page that asks you to connect a TON wallet and sign. The APK can carry malware. The wallet page asks you to sign a transfer out of your wallet, not into it.

Tell: any step that leaves the official Telegram app to "unlock" Stars.

A 30-second checklist

Before you open a free-Stars bot, or tell a user it's fine:

  1. Does it ask you to pay Stars first? Scam.
  2. Does it ask for a login code or password? Scam.
  3. Does it want a business chatbot connection? Scam.
  4. Does it want an APK, an extension or a wallet signature? Scam.
  5. Does it promise more Stars than it could possibly afford to give? Almost certainly a scam.
  6. Is the username one character away from a known app? Check it in the app's own channel.

So how do people get Stars without buying?

There are real routes, and they all go through Telegram rather than around it: a friend gifting Stars, winning a channel's Star giveaway, earning commission through a Telegram affiliate program, converting a regular gift you received, or earning as a creator from paid posts and reactions. None of them needs a login code or a payment up front. We keep a list of the real ways to get Telegram Stars, checked against what Telegram supports today, if you want somewhere to send users who ask.

If you've seen a variant that doesn't fit these four, post it in the comments. The tricks change faster than the API does.

πŸ“° Read the original article on Dev.to Security

Originally published by Dev.to Security. Aggregated on AIWithGhost for educational purposes β€” full credit and traffic to the original publisher.