Popular messaging app Telegram has started offering free premium membership to users who sign up for a feature that brings potential privacy risks. If users agree to let Telegram use their phones as an SMS OTP relay, the app offers a free premium membership.
This feature was spotted by reverse engineer AssembleDebug and has been seen in several regions on Android devices. The way this works is by letting users utilize their phones as a relay for sending SMS OTPs to other Telegram users trying to log into their accounts.
Users will have to pay for their usual SMS charges and it will probably end up charging more than the value of a Telegram Premium membership. This is because Telegram plans to send a maximum of 150 SMS OTPs through user smartphones every month. Telegram will only reward Premium to those who manage to hit a certain quota of SMS texts.
This is a major cause for concern in terms of user privacy as strangers could find personal phone numbers and use them for spam or fraud. Telegram offers a feature to hide phone numbers from strangers, but using a phone as an SMS relay could expose user contact details through a Telegram account.
What’s worse is that Telegram will not be taking any responsibility for any user damage through this feature, as indicated by its terms. This would mean that Telegram will be free from any user claims of damage related to peer-to-peer login.
Here is what the terms say:
You acknowledge and agree that Telegram shall bear no liability for any costs, expenses, damages, or any other adverse or otherwise unforeseen consequences that you may incur as a direct or indirect consequence of your present or past participation in the P2PL Program.
Telegram advises users against interacting with individuals who receive an OTP code from their phone number, yet there is currently no mechanism in place to enforce this guidance.
