A “Signal” to Leave? Fraudster’s Reaction to Telegram’s Policy Update
Introduction
- Back in August, we reported on fraudsters’ reactions to Telegram CEO Pavel Durov’s arrest. Fraudsters wondered whether Telegram would shut down or begin to comply with authorities.
- Following Durov’s arrest, Telegram implemented a new policy in September allowing for the disclosure of IP addresses and phone numbers to relevant law enforcement authorities.1 Pavel Durov himself commented that this “should discourage criminals.”2
- At that time, we observed spikes of Signal invite links shared on Telegram channels popular with criminals, suggesting that some Telegram users were seeking an alternative communications platforms. However, these appear to have been short- lived and closely tied to media releases rather than a true migration, and fraudsters’ activity on Telegram currently appears to be “business as usual”.
- For instance, we observed a 1,075% increase in the number of Signal invites shared amongst fraudsters over a two-day period in late September, but that spike was short-lived and declined quickly after.
- Data suggests that fraudsters continue to use Telegram despite the media frenzy, with no evidence pointing to a mass decline or migration. For example, criminal chatter in Telegram’s check fraud markets increased during both August and September, despite media attention regarding Durov’s arrest and the subsequent policy changes.
- Some fraudsters do not appear concerned and expressed their intention to continue using Telegram, with some citing their dislike for Signal. Other fraudsters commented that they will only be using Signal as a backup in case something happens to their Telegram accounts.
Telegram’s Policy Change
In our August blog post, we discussed how the arrest of Telegram CEO Pavel Durov caused some panic among fraudsters and prompted them to create Signal groups in fear that Telegram would shut down or comply with authorities. On September 23rd, 2024, following pressure by the French government, Telegram updated section 8.3. “Law Enforcement Authorities” of its privacy policy, which states that “If Telegram receives a valid order from the relevant judicial authorities that confirms you’re a suspect in a case involving criminal activities that violate the Telegram Terms of Service, we will perform a legal analysis of the request and may disclose your IP address and phone number to the relevant authorities.” 3 Following this change in policy, Pavel Durov posted a message expressing how these measures “should discourage criminals.” 4 Although many use Telegram for legitimate purposes, it has also attracted many who use it to engage in various illegal activities, which Pavel said “creates a bad image for the entire platform.”5
Fraudsters’ Reaction to the Policy Change
On September 24th , 2024, the day media outlets reported on Telegram’s policy update, we observed a spike in Signal links being shared on Telegram channels popular with fraudsters. By the second day, there was an increase of 1,075% in Signal invitation links shared on Telegram compared to the two days prior to the policy change announcement. However, this spike only lasted two days before decreasing by 65% and continuing to taper off. It appears that fraudsters’ consideration of other messaging platforms is closely tied to the media cycle, with only a short-lived panic.
While Signal appears to be the leading alternative to Telegram, many in the fraudster community do not find Signal to be comparable in features and functionality, and others believe that Signal has a similar policy regarding law enforcement cooperation as Telegram. Therefore, Signal is not taking off.
What’s Next?
As Telegram implements its new policy, it remains to be seen whether a considerable migration away from Telegram will actually materialize. Absent a competitive platform or a substantial law enforcement action leveraging Telegram’s cooperation, we suspect that Telegram will continue to be a very popular platform among fraudsters in the near term.