Telegram Bot sometimes requires User Authentication

Question

When I access to my telegram-bot, after some time, it requires user authentication with the text:

"Stand by... Hi there! Before We Can Continue We Need To Verify That You're a REAL User"

When this message appears it seems session is closed, and the user can't receive Bot notifications, until user authenticates.

I can't understand why this authentication is required if I am storing each user telegram_id.

WARNING: To be clear to people ending up here: It is a PHISHING SCAM where somebody hijacked the bot and is trying to steal the user's accounts. It can happen after the bot's token has been leaked (for instance through the source code in github or elsewhere). — Eddy, Apr 01 '21 at 20:12

Samir Kape · Accepted Answer · 2021-08-10T10:59:06.223

4

Your bot token might have exposed on git.

You need to change the token.

Instead of hard coding it in the code, pass it as an environment variable.

edited Aug 10 '21 at 10:59

answered Jun 21 '21 at 09:14

Samir Kape

1,733
1
16
19

1

I think that makes sense – Bauroziq Jun 22 '21 at 09:45

score 3 · Answer 2 · edited Mar 17 '21 at 23:15

3

Just had the same issue!

I guess, someone scraped my bot-token from public repository and tried to steal my account. NEVER leave your bot-token in public rep!!!

Detailed description for others to find this thread:

Bot sent, what it was programmed to do and then

"Hi There! Before We Can Continue We Need To Verify That You're A REAL User"
Telegram sent me login code -> I entered it (yeah, I'm dumb)
Bot printed

"Please reply with your 2FA (Two Factor Authentication / Two Step Verification) code"

then

"Timeout has been reached , pleaase try again."

(I like the pleAAse part, where you understand it was totally fake)

Telegram said it was

Device: Android
Location: Bulgaria (IP = 185.95.157.122)

edited Mar 17 '21 at 23:15

DisappointedByUnaccountableMod

6,656
4
18
22

answered Mar 17 '21 at 23:02

Lev Vasilyev

31
3

FYI it’s scraped not scrapped – DisappointedByUnaccountableMod Mar 17 '21 at 23:15
We found basically the same fraud method today. I just wrote an article about it: https://blog.rico-j.de/telegram-account-hijacking/ – Rickyy May 03 '21 at 00:21

score 2 · Answer 3 · answered Mar 23 '21 at 13:01

I discovered what was wrong!

Lev Vasilyev answer made me think if somebody was able to get my bot_token. So, I changed it. And, the authentication message no longer appeared.

It´s important to get into telegram allowed devices, and delete not authorized accesses.

score 1 · Answer 4 · answered Mar 16 '21 at 23:40

My bot has ""Stand by... Hi there! Before We Can Continue We Need To Verify That You're a REAL User" too. When I proceed and send authentication code and sms from Telegram was received I had been authorized as Samsung Galaxy s20 5g from Seychelles ip adress which was not mine... This was very strange. If anybody had that experience please post your answer too. Maybe somebody had stolen my bot ...Sorry if my English not very correct and nice. I hope you understand.

score 0 · Answer 5 · answered Aug 10 '21 at 13:56

0

I had the same problem, changed the Token and resolved the problem. I needed set the webhook again to work.

answered Aug 10 '21 at 13:56

tiagoriosrocha

1

score 0 · Answer 6 · answered Oct 08 '21 at 07:17

All replies are correct: your token has been stolen and used by hackers, once you enter your credentials - you will see unknown sessions in your telegram.

Change token via BotFather and do not publish it in public places. If you have already put your cred's to the telegram bot - you need to change the password immediatelly.

Telegram Bot sometimes requires User Authentication

6 Answers6