In short
- Anonymous does not mean untraceable: platforms, phone operators and internet providers keep data that the authorities can request.
- Since 2024 Telegram hands over IP address and phone number to authorities that present a valid order. The requests fulfilled for Italy have gone from a handful to hundreds per quarter.
- Only the judicial authority obtains this data, and only if someone files a report.
- Identifying an offender can take from a few months to a few years, and it is not guaranteed.
- Investigating on your own usually makes things worse.
If you are being harassed, threatened or put in the pillory by anonymous accounts, you feel powerless: fake names, foreign numbers, profiles that disappear and come back. The temptation is to investigate on your own. This article explains who can really trace an identity, what has changed on Telegram and why doing it yourself usually makes things worse.
Anonymous does not mean untraceable
Every account leaves traces that remain with whoever provides the service:
- Platforms keep technical data about accounts, such as the phone number used to register and the IP addresses of logins.
- Phone operators know who a SIM card is registered to: in Italy, activating one requires an identity document.
- Internet providers can link an IP address to a contract at a given moment.
- Payments leave traces: whoever buys a service, a number or a subscription pays somehow.
But only the judicial authority obtains this data, with a formal request. It is not given to you, to a private investigator or to an association.
What has changed with Telegram since 2024
For years Telegram answered the authorities very little. In 2024 the Paris prosecutor’s office, opening an investigation into the founder, pointed precisely to the “almost total absence of response” to the judges’ requests.
Since 23 September 2024 Telegram’s privacy policy provides that, if it receives a valid order from a judicial authority identifying a person as a suspect in crimes, the platform may disclose IP address and phone number. Not the content of chats.
Telegram publishes how many requests it has fulfilled, country by country, through a transparency bot inside the app. According to this data, collected by an independent archive:
| Period | Italy | Switzerland |
|---|---|---|
| January–September 2024 | 6 requests, 18 users | 0 |
| October–December 2024 | 152 requests, 401 users | 32 requests, 77 users |
| January–March 2025 | 272 requests, 1,324 users | 100 requests, 199 users |
| January–March 2026 | 267 requests, 569 users | 55 requests, 116 users |
| April–June 2026 | 407 requests, 861 users | not available |
The figures only concern requests that were fulfilled: they do not say how many were rejected or for which crimes. But they show that the route exists today.
How offenders who thought they were anonymous were identified
In the cases documented in Italy and abroad, a few elements recur. We describe them in general terms, without the details of investigative techniques:
- several victims reporting the same pattern, or a point in common between them;
- reports from abroad and cooperation between police forces, through Europol and Interpol;
- undercover officers and the phone seized from one member, which leads to the others;
- payment traces and actions in the physical world;
- since the end of 2024, the data provided by Telegram.
It takes a long time: in the best-known cases, between roughly 8 months and 3 years passed between the first reports and the arrest, and then more time until the conviction.
Why it is not worth investigating on your own
- Whoever organises these campaigns often uses other people’s names, sometimes those of a previous victim. If you publish or report the wrong name, you hit an innocent person and risk being reported yourself for defamation.
- Evidence gathered with tricks (trap links, fake profiles, data search services) rarely counts in court and may itself be unlawful.
- Replying and provoking gives them new material and can make it look like a quarrel between two sides.
What you can do
- Report it, even against unknown persons. Only a report allows the authorities to request the data. In Italy and in Switzerland many of these crimes are prosecuted only if the victim files a criminal complaint.
- Give investigators the right identifiers. On Telegram the numeric ID of the account is worth more than the name or username, which can be changed. You find it in the chat export (here we explain how).
- List all accounts and numbers, even if you think they belong to the same person. Leave it to investigators to link them.
- Act early. Some technical data is kept only for a limited period, and the criminal complaint has a deadline.
- Look for the other victims. More reports with the same pattern make the case more serious and easier to link. Tell us about your case: that is exactly what we need it for.
And if the investigation leads nowhere?
It can happen: some offenders use foreign services, virtual numbers and networks that hide the IP address, and cooperation between countries is slow. Even so, the report is useful. It stays on file and is linked to future reports. And if new elements emerge, a closed case can be reopened.
To learn more about VPNs and virtual numbers: VPNs and virtual numbers: why whoever attacks you is not really invisible.
What to do now
- Save the evidence and the account IDs.
- Report early, even against unknown persons.
- Do not publish names and do not investigate on your own.
- Look for support: Who can help you.
Updated 14 October 2026. General information, not legal advice.