Member's account posting scam links? What to do

Recognise the wave

A member who has been in your server for a year posts a scam link. Then the same link in three more channels. Then, if you share other servers with them, it shows up there too, all within a minute.

That is not a member turning bad. That is a compromised account. The attacker has their login token and is running a script that posts to every channel the account can see, in every server it belongs to.

The pattern is reliable enough to detect automatically:

• Same message or image, several channels, seconds apart
• Often at an odd hour for that member
• No reply when someone asks "is this you?"
• Frequently the message is a fake Nitro gift, a crypto giveaway, or a "look at this" link

Stop the bleeding first

If you are watching it happen:

1. Time the account out, not ban. A timeout stops the posting immediately and is reversible.
2. Delete the messages in every channel. Each one stays clickable until it is gone.
3. Tell the member through a different channel if you can. A DM on Discord may go to the attacker. A message on another platform, or a mutual friend, reaches the real person.

Do not ban yet. The member did nothing wrong, and a ban usually means they lose the server for good because nobody remembers to reverse it.

The six steps that actually recover the account

This is what the member needs to do, in order. It is the same list Frostbite sends the affected member by direct message.

1. Change the Discord password. From a device that is not compromised, if possible.
2. Turn on two-factor authentication. Settings, My Account, Enable Authenticator App.
3. Log out of all other sessions. Settings, Devices, log out everything unfamiliar. Changing the password alone does not always revoke an active token.
4. Revoke authorized apps. Settings, Authorized Apps. Remove anything you do not recognise. Fake "verification" bots live here.
5. Scan the computer for malware. Token grabbers often arrive as a game mod, a cheat, or a cracked program. Until it is removed, the new password will be stolen too.
6. Secure the email account. If the attacker has the email, they can reset the Discord password again. Change it, and enable 2FA there as well.

Step 3 is the one people skip and the one that matters most.

Handle it automatically

Frostbite watches for exactly this pattern. When the same image hits several channels within seconds, or the same account sprays images across servers, it:

• Deletes every copy at once, in every server it protects
• Sends the member the six-step recovery guide above, once, however many messages they posted
• Applies whatever consequence you chose for that detection type: nothing, timeout, kick, or ban
• If you chose kick, it can include a one-time invite so the member gets straight back in once their account is secure

You set that consequence per detection with /filter punish crosschannel, and you can attach your own appeal link to every notice with /filter setappeallink. The commands page lists all of it.

Afterwards

Once the member is back in, let them know what happened and that it was not held against them. Servers that treat hacked members as victims keep them. Servers that ban on sight lose a member and gain nothing.