over the past month I have been the target of an elaborate social engineering scam that I thought was interesting to talk about, involving Discord, Community Servers, and Roblox.
Essentially, scammers have been forging videos of me sending phishing links in public discord servers to other users, sending that “evidence” to real moderators that in turn ban me, and then they pretend to be a moderator and contact me directly once the ban has occurred.
I would like to assure that my account has not actually been hacked into. I have not received any fraudelent log in attempts or 2FA notifications or any warnings that would bring legitimate alarm.
The following google doc explains the scam in full, and shows the forged evidence as well.
https://docs.google.com/document/d/1iNNtyBx9lVr-zZtxBn3W-sr457M2FnkN3Ode8y8JuuI/edit?usp=sharing
I’ll assume you’ve read the doc, or at least skimmed it. The following talks about the nature of the scam:
I think this situation, this scam, brings up some very interesting questions to my mind.
How do you, as a moderator, verify that someone’s account is truly sending other users private messages which you cannot view?
And in addition, what systems should discord have in place, or any social media site, to protect its users from social engineering scams of this nature?
I think generally speaking, most moderators are unpaid volunteers in a typically thankless job. When dealing with bots, scammers, and spam, its much easier to shoot first and ask questions later. The unfortunate thing is that the appeal process for me into the Blender Discord server is essentially non existent. I am unable to directly contact them and they have refused a middle man once.
A video, like the one I sent, appears pretty damning. I assume that most people, including myself, would assume that would be enough. Only by knowing the truth, that I didn’t send those messages, do you start thinking about questions like… maybe the video was edited really well?
Another question could come up, why would the person reporting this go through so much effort to show that the discord app appears as real as possible, and to copy the user ID as well? It seems like too much evidence, unprompted, when most users would just leave a message or a screenshot behind. Screenshots are much easier to fake of course, but I don’t think most reporters would try to make their proof so ironclad.
I think that if you are a moderator investigating this situation, and if the reporting account is new, that should immediately be suspicious and raise alarm, especially if the reported account has been in the server for many years.
From a platform side, I wish that discord had a way where you could truly send messages to other people, in a form that allows the moderator to verify that the account is truly that account themselves on their uncompromised client. They have a forwarding feature, but it strips all personal identifiers. There might be a security concern here, but I don’t see how its much more of a security concern than a screenshot or video evidence, both of which can be employed, but can also be faked. Maybe someone else here with better security knowledge could explain to me why this is a bad idea, in a way that screenshots and screen recordings don’t already violate?
I know its not discord’s policy to moderate disputes such as these on community servers, but I still feel like its their responsibility as a platform to provide those tools to the community to allow them to self moderate. I don’t know how interested they are in that, though, especially since they got rid of PID numbers.
