Discord and Telegram support desk scam

The support scam, sometimes called the fake helpdesk scam, is one of the most common scams you will encounter in community chats or channels on platforms like Discord and Telegram. It usually starts with automated accounts sending messages that claim to offer support.

You have probably seen a message like this, or a variation of it, in a Discord channel:

There are two main variants. They work the same way but direct you to contact different accounts.

Varient 1 - "Join this support server"

Scammers often post an invite link in a channel. Other scam accounts may react with the ✅ emoji to make the link look official.

If you join the server, you will typically see a ticket bot and be prompted to open a ticket. A scammer will then ask questions such as your wallet address (to check whether you are worth targeting) and when your issue started.

No matter what you say, they will eventually send you a malicious link claiming it will fix your problem. Visiting the link exposes you to a phishing site that asks for your recovery phrase or attempts to drain your crypto with a malicious DApp. You can read more about cryptophishing scams in this article.

They may also try and get you to download a malicious file via powershell using the iwr command which attempts to steal your crypto wallet.

Once your funds are drained, the scammer will ban you from the server.

For server moderators, this type of scam is difficult to prevent because Discord's invite link detection system is unreliable. More info: How scammers are manipulating Discord's invite link detection

Varient 2 - The mysterious friend request

Another approach is a direct friend request. After you ask a question in a channel, you might receive a request from someone named something like "admin" or "official support moderator". The scammer usually keeps a silent account in the server, then sends requests from a separate scam account whenever someone asks for help.

The scam works the same way as the server version, but everything happens privately in direct messages instead of through a fake support server.