Why it works
Impersonation is cheap and it borrows something expensive: the trust your community has already extended to your moderators. A member who would ignore a stranger will answer someone whose name and picture match the person who welcomed them to the server. The attacker does not need to be convincing. They need to be recognisable.
The shape of it
- Join and wait. The account arrives like any other and does nothing notable. There is no volume signature here for a raid detector to catch, because there is no raid.
- Copy an identity. The display name is changed to match a moderator — often with one character swapped, a space added, or a lookalike Unicode letter substituted so that a plain text comparison fails. The avatar is downloaded and re-uploaded.
- Approach members privately. Usually about a problem with their account, a prize they have won, or a wallet that needs verifying. The pitch matters less than the name at the top of the message.
What is actually known
A caveat worth stating, because most write-ups on this skip it. The common telling is that the scammer scrapes your member list, leaves the server, and then messages people. That version is doubtful: Discord requires a mutual server or an accepted friend request to send a DM, and it applies that check when the message is sent, not when the conversation is opened. An account that genuinely left should find the message bounces. The behaviour people observe is more likely an account that never left and changed its identity afterwards, a second mutual server you are not watching, or a friend request rather than a DM.
What stops it
The account that never left is the branch a bot can do something about, and it is where ScoutBot works: the moment a member sets a name or avatar resembling a protected identity, they are flagged, and can be kicked or banned before the approach happens.
Three things make that hold up in practice. Matching is fuzzy, so a swapped character does not defeat it. Avatars are compared as images, so re-uploading defeats nothing. And protection follows your moderator roles, so it covers the whole team without anyone maintaining a list.
What no bot stops
Once a message is in a member’s DMs, it is invisible to every Discord bot — that is an API limit, not a product gap. The half of the defence that lives with your members is covered in preventing Discord DM scams.