Why scam screenshots beat most Discord filters

The scam is a picture

Most Discord moderation bots filter text. They check messages against a list of bad domains and known phrases, and they do it well. So scammers stopped posting text.

What they post now is a screenshot: a fake social media post announcing a giveaway, a casino site showing a huge balance, a Steam gift card with a "redeem here" caption. The link is written inside the image, or the image itself is the bait and the link comes in a follow-up. A text filter sees an attachment and nothing else.

The common genres right now:

The influencer giveaway. A screenshot of a post from a well-known streamer or founder, promising money to everyone who signs up on a site. The account and the post are fabricated.
The crypto casino balance. "I just made $2,500 in an hour", with a screenshot of a dashboard and a promo code.
The Steam or gift-card image. A card with a code partly hidden, "first come first served".
The fake Nitro gift embed. A screenshot of Discord's own gift UI, which is covered in its own guide.

Why "block this exact image" fails

The obvious fix is to hash the image and block it next time. Exact hashing breaks the moment anything changes: Discord recompresses uploads, phones resize them, and scammers crop a few pixels off on purpose. Each copy is a new file with a new hash, and the filter starts from zero.

Technique one: perceptual fingerprints

Instead of hashing the file, hash what the picture looks like. Frostbite reduces every image to a 256-bit fingerprint of its structure, then compares fingerprints by how many bits differ. A recompressed, resized, or lightly cropped repost lands within a few bits of the original and is caught.

Every fingerprint Frostbite confirms is published to a shared blocklist that every server running it pulls every 30 minutes. One confirmed report anywhere removes that image everywhere. The list currently holds over 16,000 fingerprints.

Technique two: read the text in the image

Fingerprints only catch images somebody has seen before. For brand-new ones, Frostbite runs OCR on the picture and matches the extracted text against known scam phrases, using fuzzy matching so spacing tricks and lookalike characters do not slip through.

"Everyone who registers gets $2,500", "enter promo code", "this post will be deleted in an hour" are the same phrases across thousands of unique images. Reading them catches a scam nobody has flagged yet. Every OCR hit also feeds the blocklist, so the next copy is caught by fingerprint instead.

Both techniques run on Frostbite's own servers. Images are not sent to a third party.

What you get in Discord

The message is deleted and one alert is posted to your log channel, with the reason
The poster receives a DM explaining what was removed and, if they were hacked, how to recover
You choose the consequence per detection type with /filter punish imagefilter
Members can report anything the filters miss by right-clicking the message and choosing Apps, Report, or with /report

Setup is /filter quicksetup. The commands page has every option.