Every team that sells on Telegram eventually asks the same question: how many messages a day can I send before something bad happens? The honest answer is that Telegram has never published a number, and anyone quoting you one is guessing. What Telegram does have is a set of signals, and once enough of them line up on your account, it acts.
This is a guide to those signals. Not to gaming them, because that road ends with a dead account, but to understanding them well enough that legitimate outreach does not look like abuse.
What a limit actually looks like
Telegram does not usually announce a restriction. You find out in one of three ways.
PEER_FLOOD. You try to write to someone you have never talked to and the send fails. Existing conversations keep working. This is the most common state, and it is reversible: it lifts on its own, usually within days, if the behaviour that caused it stops.
A hard spam block. @SpamBot tells you the account is limited and gives you a date. Sometimes you can appeal, sometimes the date is simply the date.
FLOOD_WAIT. A number of seconds you must wait before the next request. This one is not a punishment, it is rate limiting, and a well-built tool absorbs it silently instead of retrying into a wall.
The first two are reputation. The third is plumbing. Teams that panic about FLOOD_WAIT and ignore PEER_FLOOD are worrying about the wrong thing.
The signals that matter
Reports
This is the big one. Telegram’s spam handling is driven heavily by recipients pressing “Report”. A hundred messages a day to people who are glad to hear from you is safer than fifteen a day to strangers who are not. Volume is a secondary factor. Relevance is the primary one.
Which means the single most effective safety measure available to you is not pacing. It is only writing to people who have a reason to expect you.
Account age and history
A number registered last week that immediately starts writing to strangers has no history to fall back on. An account that has been in normal daily use for a year, with two-way conversations, groups it participates in, a profile photo and a real name, has a lot of margin.
New accounts should ramp. Talk to people who reply. Join the groups your market actually lives in. Give it a few weeks of ordinary use before it does anything that looks like outreach.
Reply rate
A conversation is two-sided. An account that sends four hundred first messages and receives nine replies is describing itself. If your reply rate sits under a few percent, the list is wrong, the message is wrong, or both, and Telegram will conclude the same thing before your CRM does.
Treat reply rate as a safety metric, not just a performance one.
Sameness
Identical text to a hundred people is trivially detectable. So is a burst of sends at exactly the same interval. Vary the message with real personalisation, vary the timing with jitter, and stop sending overnight in the recipient’s timezone. Human beings are irregular. Look like one.
Where the session lives
An account that logs in from Frankfurt every day for a year and then suddenly appears from three countries in one afternoon has just raised its own risk score. Keep one account on one stable IP and one consistent device fingerprint. If you use proxies, use residential ones, and do not rotate them per request. The point is consistency, not concealment.
A sane sending posture
If you want practical numbers, treat these as starting points rather than limits, and read them alongside everything above.
- Warm accounts, existing contacts. Contacts who have written to you before are the safest audience there is. Volume here is limited more by your ability to handle replies than by Telegram.
- New account. Nothing outbound for the first two to three weeks. Normal use only.
- Established account, new conversations. Start low, in the tens per day, and increase gradually while reply rate holds up. If replies drop, stop increasing.
- Any account. Spread sends across working hours, pause on the first hint of trouble, and never run two campaigns from the same account at once.
The pattern to internalise: increase slowly, decrease immediately. The cost of sending fewer messages this week is small. The cost of losing an account with two years of conversation history in it is not.
Stop conditions worth wiring in
A campaign should be able to stop itself. At minimum:
- Stop on reply. Nobody should receive step two of a sequence after answering step one. This is basic courtesy and it also removes your most annoyed potential reporters.
- Stop on error rate. If more than a small fraction of sends fail, pause the whole run rather than retrying. Failures are the earliest signal you get.
- Stop on PEER_FLOOD. One is a warning. Continuing after it is a choice.
- Stop on block. If people are blocking you, the message is the problem. More sends will not fix it.
If your tool cannot do these automatically, you are relying on someone watching a dashboard at 2am, and they are not.
What to do if you get limited
Do not create three new accounts and continue. That is how one restriction becomes a pattern across your whole workspace.
Message @SpamBot from the affected account and read what it says. If there is an appeal path, use it once, politely, in plain language. Then leave the account alone for the duration: no outbound, no new conversations, ordinary use only. Meanwhile, look at what preceded the limit. In almost every case we have seen it was one of three things: the list was scraped and cold, the message was identical for everyone, or the account was too young for what it was asked to do.
Fix that first, or the next account goes the same way. If you’re in the middle of one right now, our guide to a limited Telegram account covers how long it lasts and how the appeal works.
Where Cavyro sits on this
We built Cavyro for warm outreach: campaigns to people your team already has a relationship with, sent through your own mirrored accounts, with pacing, daily caps, quiet hours, stop-on-reply and automatic pauses when Telegram signals trouble. Every send is attributed, so you can see reply and revenue per campaign instead of guessing. There is more on how we handle accounts and data on our security page.
What we deliberately do not build is a cold blaster for scraped lists. It burns accounts, it burns domains of trust, and it does not work well enough to be worth either.
If you want the campaign side without the account risk, you can try the full plan free for 5 days. Bring the accounts you already use.