How to Spot and Stop Admin Impersonators

Impersonation is the most common scam in crypto communities. A scammer copies an admin's display name and profile picture, joins the group, and waits for someone to ask for help. Then they send a private message offering support, and within minutes a member has connected their wallet to a malicious site or typed their seed phrase into a fake form.

The good news is that impersonation depends on a few predictable weaknesses. Close them and most attempts fail.

How the scam works

The pattern repeats across platforms:

1. A member posts a question or complaint in a public channel
2. A scammer with a copied name and avatar sends them a DM
3. The scammer offers help, often with urgency, such as "your wallet needs to be validated"
4. The member is sent to a site that asks them to connect a wallet, sign a transaction or enter a recovery phrase
5. Funds are drained

Variations include fake giveaways, fake airdrops, fake support tickets and fake job offers. The core trick stays the same: borrowed authority plus a private channel.

Warning signs members should know

Teach members to look for these signs:

• Anyone who DMs first claiming to be staff
• Usernames that differ from the display name, or contain extra characters
• Requests to connect a wallet to "fix", "sync" or "validate" something
• Any request for a seed phrase or private key
• Urgency, such as "within 10 minutes or your funds are at risk"
• Support offered through a Google Form, a new website or a ticket outside the server

A single rule covers most of them: real staff never DM first and never ask for keys or seed phrases.

Platform settings that help

Discord

• Disable direct messages from server members by default
• Use AutoMod or a bot to block names containing "admin", "support" or team names
• Give staff a distinctive role colour and remind members to check roles, not names
• Hide the member list in public channels where possible

Telegram

• Post the exact usernames of real admins in a pinned message
• Restrict new members from posting links
• Use a bot that flags accounts whose names match admins
• Hide the member list if your plan supports it

X

• Keep official accounts verified where possible
• List official accounts on your website
• Report impersonator accounts quickly and ask your community to report them too

Habits for the team

Settings help, but habits matter more:

• Answer support questions publicly first, then move to private tickets inside the server if needed
• Never ask users to DM you
• Use consistent usernames across platforms
• Post regular reminders about impersonators, especially during launches and airdrops
• Share screenshots of real scam attempts so members learn what they look like

When someone gets scammed

Respond with care. The person is often embarrassed and upset. Ask them to share details privately with a moderator, ban the scammer account, warn the community without naming the victim, and share any malicious domain so others can avoid it. If the scam used a new domain, report it to the registrar and browser safe-browsing services.

Avoid blaming the victim in public. It discourages others from reporting, which helps scammers.

Make the real accounts easy to verify

The best defence is making real information easy to find. Keep a single official links page on your website listing every account and username. Link it from your social bios. Use the same project name, logo and links in public listings, from directories to a Proud Globe pin, so members can check an account against several independent sources in seconds.