Start with what is true
No Discord bot can read direct messages between two members. Not ScoutBot, not anything else. The API offers no mechanism for it, a bot cannot see friend requests or the friend graph, and Discord's AutoMod does not apply to DMs either. There is no verification level and no partner programme that changes this.
So treat any product advertising DM scanning with suspicion. The only tooling that crosses that boundary is a selfbot or a modified client, both of which violate Discord's terms — and the account banned for running one is the member's, not the vendor's.
This plugin exists because if the bot cannot see the message, the next best thing is making sure your members already know the rule that makes it fail.
The recurring reminder
ScoutBot posts a safety reminder to a channel you choose, at a frequency you set, optionally mentioning a role.
Channel
Somewhere members actually read. A general or announcements channel works better than a dedicated safety channel nobody opens.
Frequency
How often it posts. Err towards less often than feels right — a reminder that appears too frequently gets tuned out, and a tuned-out reminder is worth nothing at the moment it matters.
Alert role
Optional. Usually worth leaving off for a recurring post; a routine reminder that pings everyone is the fastest way to get the channel muted.
The join DM
Optionally, ScoutBot sends each new member a single direct message when they join. The message tells them plainly that it is the only DM ScoutBot will ever send.
That sentence is the entire point of the feature. It means every later message claiming to be from ScoutBot or from staff is a visible contradiction of something the member has already read, which is a much easier judgement than asking somebody to evaluate whether a particular message looks legitimate.
It is also why ScoutBot's DM surface is exactly one message, once, on join, and why nothing else in the product ever sends a direct message. A second DM from us would make the first one a lie.
The rule worth teaching
Whatever wording you use, the rule that works is staff never DM you first. It needs no judgement under pressure, which is the only kind of rule that survives contact with a convincing scam.
Settings worth mentioning to members alongside it:
- Turn off direct messages from server members, under Privacy & Safety. The single highest-value change a member can make.
- Set friend requests to friends-of-friends, or off. A friend request needs no mutual server, which is why it is a common route.
- Verify anyone claiming to be staff in a public channel, where other people can see the question.
Free
DM safety is free on every server.