My Experience with BotSubscription & TGMembership

What Happened to Me

My name is Zach Morris. I'm an American-Colombian citizen, content creator, and English teacher. I used TGMembership (and later BotSubscription) for 4 years to manage my Telegram-based English course memberships. It worked well — until it didn't.

The Background

For four years, I trusted TGMembership with the keys to my business. Literally. To use their service, you must provide API keys to your payment processors (Stripe, PayPal). This is standard practice — the service needs these keys to process payments and manage subscriptions automatically.

Think of it like giving someone the keys to your bank account to help manage your finances. It requires complete trust. And for four years, that trust seemed well-placed.

Building My Own Solution

In 2025, I decided to build my own membership portal at portal.profezac.com. Why? To reduce monthly costs and have more control over my business. I wanted to be resilient and nimble, especially with economic uncertainty ahead.

I successfully migrated my students to the new platform. I created instructional videos, sent communications through all my channels, and personally responded to every student who reached out. The transition went smoothly.

I stopped using TGMembership's services. My business continued operating normally with my own system.

November 1, 2025: The Attack

Three months after I stopped using their service, I woke up to a nightmare.

Using the API keys I had given them years ago, the owner of TGMembership/BotSubscription:

• Cancelled 1,600 active customer subscriptions — including subscriptions I had acquired through OTHER services (like Invite Member) and my own portal
• Processed hundreds of refunds indiscriminately — costing me $800 in refund fees
• Charged me additional Stripe fees to bring my balance back to zero
• Did this without any warning or communication

This wasn't an automated system. This was a deliberate, manual act of revenge because I stopped using their service.

The Aftermath

I lost my entire business overnight. Four years of work — gone. I'm starting from zero. I've had to reduce my personal income to below the poverty line. I don't know if my business will survive this.

I'm scared. I'm angry. But mostly, I'm heartbroken that someone could do this to another person.

Why I'm Sharing This

I'm not trying to destroy this company. The owner has a family to support. But I need to warn potential customers:

When you use TGMembership or BotSubscription, you're giving someone the keys to your entire business. And as I learned, if they decide you've wronged them — even over something as small as a $40 bill — they can and will use those keys to destroy everything you've built.

This is a massive breach of trust. It's abuse of access. And it should terrify anyone considering these services.

54.187.174.169 - [01/Nov/2025:15:04:01] "POST /api/payments/webhook/stripe" - Stripe/1.0
54.187.205.235 - [01/Nov/2025:15:04:03] "POST /api/payments/webhook/stripe" - Stripe/1.0
54.187.216.72  - [01/Nov/2025:15:04:04] "POST /api/payments/webhook/stripe" - Stripe/1.0
54.187.216.72  - [01/Nov/2025:15:04:06] "POST /api/payments/webhook/stripe" - Stripe/1.0
54.187.216.72  - [01/Nov/2025:15:04:08] "POST /api/payments/webhook/stripe" - Stripe/1.0
54.187.216.72  - [01/Nov/2025:15:04:09] "POST /api/payments/webhook/stripe" - Stripe/1.0
54.187.205.235 - [01/Nov/2025:15:04:11] "POST /api/payments/webhook/stripe" - Stripe/1.0
...
[513 total webhook calls in 17 minutes]

{
  processorSubscriptionId: 'sub_1SOE3OCoDQQZZ8KtFvtcAek7',
  paymentProcessor: 'stripe',
  cancelledAt: 2025-11-01T15:04:04.853Z,
  cancellationReason: 'Stripe deletion',
  active: false
}

{
  processorSubscriptionId: 'sub_1S2ZfTCoDQQZZ8KtHRDqmizk',
  paymentProcessor: 'stripe',
  cancelledAt: 2025-11-01T15:12:42.804Z,
  cancellationReason: 'Stripe deletion',
  active: false
}

{
  processorSubscriptionId: 'sub_1RN2HoCoDQQZZ8Kt9JQyYGQq',
  paymentProcessor: 'stripe',
  cancelledAt: 2025-11-01T15:21:08.021Z,
  cancellationReason: 'Stripe deletion',
  active: false
}

A Message About Revenge & Trust

I want to address the owner directly, and anyone else reading this:

Revenge doesn't solve anything. Negative energy is corrosive to your soul. Even if you feel someone wronged you, acting on that feeling causes more harm — to them, but especially to yourself.

I've been there. Years ago, after a bad breakup, I deleted my ex-girlfriend's Instagram out of spite. She lost all her followers. I thought it would make me feel better. It didn't. The problem wasn't her — it was me, my inability to end the relationship properly, my own weaknesses.

Ten years later, I can see that clearly. I wrote her an apology. I carry that lesson with me.

What happened to me with TGMembership/BotSubscription feels similar. Maybe the owner felt I wronged him by leaving. Maybe he liked having me as a high-profile client. Maybe my independence threatened him. I don't know.

But destroying my business didn't solve whatever problem he felt he had. It just created more suffering in the world. And we all have to live with what we do.

What concerns me most is that this wasn't just a personal dispute — this was done using TGMembership and BotSubscription as the tools of destruction. These are businesses that serve hundreds, maybe thousands of customers who trust them with the same API access I gave them. When a service provider uses that access maliciously, it's not just their personal reputation on the line — it's the reputation of TGMembership and BotSubscription as trustworthy businesses. Every current and potential customer should ask: if this happened to me over $40, what could happen to them?

To Potential Customers

Think carefully before trusting any service with your business's API keys. Make sure you:

• Understand exactly what access they'll have
• Have contracts in place protecting your data
• Can revoke access immediately if needed
• Know the person running the service has integrity

I hope this never happens to anyone else. But the fact that it's possible should give you pause.