How to keep a crypto wallet that signs in with Telegram safe: PIN and biometrics, account protection, checking the bot and links, common scams and what to do if something looks wrong.
What “custodial wallet” means
TeleCard is a custodial wallet: the service holds the keys to the addresses, not you. Deposit addresses are derived from the service's keys, and a separate, isolated service signs the transfers under its own limits. The main servers keep only public keys. That lowers the risk but doesn't remove it: trusting the service is part of the model.
Your PIN protects access and money actions in the app. It is not the private key of a blockchain wallet. When you decide how much crypto to keep on a balance, keep this model in mind.
PIN and biometrics: how sign-in is protected
- The app opens only with your passcode or biometrics (Face ID, fingerprint): on every launch and after 5 minutes of inactivity.
- After 5 wrong attempts the PIN is locked: for 15 minutes the first time and longer after that, and your sessions are ended.
- Payments and withdrawals ask for your PIN or biometrics again, even when the app is already open.
These measures restrict access on your device, but they don't check the recipient or the details for you. Before you confirm, read the recipient, the amount, the asset and the network. Never type your PIN into a third-party form, and never tell it to anyone, even someone who says they work for the service.
Protect your Telegram account
You sign in to TeleCard with your Telegram account, so protecting that account is part of protecting the wallet.
- Turn on two-step verification: a separate cloud password for Telegram.
- Open the list of active sessions and end any you don't recognise.
- Set a passcode lock on Telegram itself on your device.
- Don't hand over a login code from an SMS or from Telegram to anyone who claims to work for a wallet: that code gives access to your account.
- If an unexpected sign-in message arrives, check your sessions in Telegram settings rather than following a link from the message.
How to tell the real TeleCard from a fake
Open the Mini App only from the bot @itelecard_bot, and the browser version only at https://app.telecard.top. Don't pick a service by a similar name in search: fake bots often differ from the real one by a single letter. The links on this site lead to the real bot.
Take deposit details only from the app, for the asset and network you selected. An address from a forwarded message or an unfamiliar website hasn't been verified, even if the page carries a familiar logo.
Common scams and how to react
| Scheme | How it works | What to do |
|---|---|---|
| Fake support | Someone writes first, claims to be staff and asks for your Telegram code or PIN. It is an attempt to take over your account, and support never needs either. | Don't reply, and open support from the app yourself. |
| The “cancel” trick | You are told to confirm a new operation to cancel the previous one. Every confirmation starts a new operation. | Never confirm something you don't understand. |
| Remote access | You are asked to install a remote-access app “so we can help”. It lets someone see and confirm everything on your device. | Don't install apps at a stranger's request. |
| Look-alike bot | A link for an “urgent fix” leads to a fake bot or a phishing page with a name close to the real one. | Go only to @itelecard_bot and app.telecard.top. |
Everyday habits that protect you
A few simple habits cover the main risks. They work for any wallet, and especially for a custodial one, because access to your account is access to your balance.
- Choose a PIN nobody can guess: not a birthday, not 1234 and not your bank card's code.
- Lock your phone's screen and keep Telegram and your operating system up to date, so known vulnerabilities get fixed.
- Don't open the app on someone else's device, and don't leave your phone unattended with Telegram open.
- Avoid screenshots of codes and details that may end up in a cloud backup or a chat.
- Before each confirmation ask yourself: do I understand who I'm sending this to, and how much?
If you use Telegram on several devices, check the list of sessions every few weeks. A device you don't recognise is a reason to end that session and change your cloud password.
Notifications and checking operations
Alerts about a sign-in from a new device, a PIN change or a withdrawal to a new address help you spot actions you didn't take. But a bot message doesn't replace the operation's record in your history: if a notification looks unexpected, open the app the usual way and compare the details.
Withdrawals up to 500 USDT (equivalent) are approved automatically, larger ones go through a review, and the daily withdrawal limit is 5,000 USDT by default. Check the address and the network yourself before you withdraw: our guide to choosing a USDT network covers it.
What to do if something looks wrong
- End unfamiliar sessions in Telegram and change your cloud password.
- Open TeleCard and review your operation history.
- Save the times, screenshots and operation or message IDs.
- Write to support from the app (in your profile) or to the bot @itelecard_bot.
Support needs the details of an operation, not access to your account. If someone messages you first claiming to be staff, don't reply or follow their links: open support from the app yourself. More on protection is on the Security page, and the procedure for contacting support is in how to verify a QR payment and contact support.
Frequently asked questions
Is biometrics enough for a safe payment?
Biometrics protect the confirmation on your device. You still check the recipient, the amount, the network and the terms of the operation yourself.
Which Telegram bot is the official TeleCard bot?
@itelecard_bot (https://t.me/itelecard_bot). The links on this site lead to it, and bots with similar names have nothing to do with TeleCard.
Who holds the keys to my funds?
The service does. TeleCard is a custodial wallet: an isolated signing service holds the keys to the addresses, and you access your balance in the app with a PIN or biometrics.
What should I do if I lose my phone?
End the Telegram sessions on the lost device and sign in to your account on a new one. The app opens only with a PIN or biometrics. If you need to, contact support.
