The attack
A scammer joins your server and does nothing for a while. Then they change their display name to match one of your moderators, set the same avatar, and start messaging members privately — usually about a problem with their account, a prize, or a wallet that needs verifying. The member checks the name against the mod list, sees a match, and answers.
Nothing about that requires sophistication. It works because your community already trusts the person being copied.
What ScoutBot checks
Every time a member joins, changes their nickname, or changes their global username or avatar, ScoutBot compares them against the identities you have chosen to protect:
- Protected names you enter by hand — useful for staff who are not in a single role, and for brand names.
- Your moderator roles. Mark a role as safe and every member holding it is protected automatically. Nobody has to be listed, and the list cannot go stale when your team changes.
- Avatar images. Compared as images, not filenames — so a re-uploaded, re-compressed or slightly cropped copy of a moderator’s picture still matches.
Matching is fuzzy on purpose. A swapped character, an added space, a lookalike Unicode letter, a trailing full stop — all of these still match, and you set how close is close enough on a five-point scale.
What happens on a match
You choose. ScoutBot can post an alert to a channel your moderators watch, optionally pinging a role, and it can kick or ban the account outright without waiting for a human.
Two safeguards apply before any of that. Members holding a safe role are never actioned, so the feature cannot turn on your own team. And individual members can be whitelisted — useful for alt accounts and for long-standing regulars whose names are genuinely similar to a moderator’s.
What it does not do
ScoutBot does not read direct messages, and it is worth being precise about why: no Discord bot can. The API provides no mechanism for a bot to observe a DM between two other users, and there is no verification level or partner programme that changes it. Any product advertising DM scanning is either mistaken about what it does or is using tooling that violates Discord’s terms and gets the user’s account banned.
So the defence is placed where it can actually work: at the moment the impersonator sets the name or the avatar, in your server, before the message goes out. More on that in preventing Discord DM scams.
Free and Pro
Impersonation alerts are free, for up to three protected names, with no card and no time limit. Pro is $49/mo or $490/yr per server and adds:
- Unlimited protected names
- Automatic coverage of every member holding a safe role — nobody to list
- Avatar image matching
- Automatic kick or ban on a match, rather than alert-only
Setup takes a few minutes from the dashboard — the setup guide walks through choosing roles, setting sensitivity and picking an alert channel.