Skip to main content
Scam Defense is Thea’s scam-specific detection and response system. It runs through AutoMod, combines independent evidence, limits each source to a safe maximum action, and records the result for moderator review. It covers phishing links, malicious invites, suspicious attachments, QR destinations, identity impersonation, tripwire activity, and coordinated posting patterns. Optional network intelligence can warn your server about infrastructure that qualified communities have already reviewed. During staged rollout, detection and review can be active while automated scam enforcement remains observe-only. Saving an action does not override that safety gate. The gate holds back only scam-specific actions, such as blocked and community-listed scam domains, the tripwire, and scam classifications. Invite links, mass mentions, dangerous attachments, duplicate floods, the moderation screen, and non-scam AI findings always use the action you set in Settings → AutoMod.

​
Where to configure and review it

Configured and effective are not always the same. A missing permission, unavailable provider, plan limit, staged rollout, stale feed, or safety brake can keep a saved feature in observe-only mode. Check Effective scam policy in settings and Effective enforcement in the dashboard before testing an action.

​
Enable scam defense

1

Enable the shared scanning pipeline

Open Settings → AutoMod, turn on Enable AutoMod, and save. Scam controls do not process messages while AutoMod is off.
2

Choose detection layers

Keep Heuristics on for scam links, invites, attachments, and campaign behavior. QR decoding also needs Image scanning. Enable the moderation screen, name screening, or paid AI classification when you need those additional layers.
3

Set a private log channel

Choose a staff-only channel under Settings → AutoMod → Log channel. Quarantine review and incident alerts need somewhere private to land.
4

Configure scam controls

Open Settings → Scam defense. Add local blocked domains, choose a community-list mode, and configure optional tripwire and network features.
5

Start with conservative actions

Under Settings → AutoMod → Actions by severity, begin with logging or quarantine. Review real findings before increasing the response.
6

Verify effective policy

Open Settings → Scam defense and inspect Effective scam policy. Then use Effective enforcement on the Scam defense dashboard to compare each configured severity action with what the runtime may execute.

​
Default state for a new server

  • The AutoMod master switch starts off.
  • Heuristics, the moderation screen, and image scanning are preselected.
  • Name screening and AI classification start off.
  • The community list starts in Ask before each update mode and does not use a fetched version until an admin applies it.
  • The tripwire and step-up verification start off.
  • Network contribution, network use, and adaptive hardening are preselected, but they cannot process or enforce anything until AutoMod and the operator-managed network rollout are effective. Review these choices before enabling AutoMod.

​
Detection pipeline

Thea builds one scannable view from the member’s message. It can include message text, forwarded snapshots, link-preview text, embed text, attachment names, sticker names, and poll text. Edits are scanned again. Link, invite, blocklist, and flood checks always read the whole message. Settings → AutoMod → Maximum scan length limits only how much the moderation screen and AI classification read.
Attachment metadata is checked for dangerous file types, doubled extensions, and misleading names. Thea can decode QR codes from a bounded number of Discord-hosted images and pass the destination through the same scam checks. Fetches use strict size, timeout, and network-address limits.
Join and rename checks look for suspicious names that imitate staff, support, administrators, or known brands. Identity findings use hashed evidence rather than retaining the screened name.
Repeated or structurally similar content across accounts and channels adds campaign context over a 15-minute window. Three actors across two channels form a suspected campaign; five actors across three channels form a confirmed campaign. Campaign evidence alone is capped at log-only. It must be corroborated before it can raise a message action, and it never makes unrelated member activity punishable.
A regular member posting in a selected channel whose topic includes the exact [thea-tripwire] marker creates high-confidence evidence. The tripwire is capped at quarantine and cannot kick or ban by itself. See Set up a tripwire channel.
If network use is enabled and effective, Thea can compare keyed indicators with quorum-backed evidence from other participating servers. Your own contribution is removed from the lookup. See the Scam Defense Network.
Paid plans can send borderline content to the configured classifier after deterministic evidence has been collected. Provider failure does not turn into a guilty verdict. Thea continues with the evidence it already has and records the degraded state.

​
Evidence and action ceilings

Scam Defense does not add correlated signals as if they were independent votes.
  • Evidence from the same root cause is deduplicated.
  • Trust, freshness, provenance, and actor class are retained in the decision trace.
  • Each signal tier has a maximum action.
  • The configured severity action cannot raise a finding above its evidence ceiling.
  • Discord permissions and global safety limits can lower the action further.
  • Staff, bots, and webhooks cannot receive automated punishment.
The result is the strongest action allowed by the evidence, your policy, current permissions, and active safety gates. A weak or unavailable source cannot silently turn into a ban. Per-message Scam Defense recommendations are limited to allow, log, quarantine, delete, or timeout. The fusion layer never recommends a kick or ban. Those actions exist only through separate manual moderation or repeat-offender escalation.

​
Staff, bots, webhooks, and exemptions

Members with Manage Messages, Manage Server, or Moderate Members are treated as staff regardless of role name. Staff, bots, and webhooks can be assessed in observe-only mode so suspicious automation remains visible, but no automated punishment is executed against them. Configured exempt roles and channels are skipped. Use exemptions when trusted staff need to quote scam content or when a channel intentionally handles samples. The tripwire is stricter: observe-only actors do not trip it at all.

​
Threat feeds and local blocks

Under Settings → Scam defense:
  • Blocked domains adds server-specific hosts, up to 200. Their subdomains are blocked too. For broader coverage, use the community scam list.
  • Community scam list can ask before each update, update automatically, or remain off.
Ask before each update does not use a newly fetched version until an admin explicitly applies it. The community list also needs the Heuristics layer. Feed updates are validated before activation. If a refresh fails or becomes stale, Effective scam policy reports the condition and Thea continues with healthy local layers.

​
Dashboard

The Scam defense dashboard is a metadata-only operational view. Only dashboard collaborators with Admin or Owner access can open Scam Defense or run incident actions. A Discord moderator role by itself does not grant dashboard access.

Posture and metrics

Findings, containment rate, review precision, source health, and effective detection and enforcement state.

Recent detections

Severity, tier, confidence, action, related detections, member context, and review outcome without exposing stored message content.

Campaign intelligence

Qualified network campaigns that touched this server, with local match and account counts.

Incident response

Local incident timelines, retro-hunt results, containment, exposure notices, and false-positive resolution.
The member risk profile shown on a detection is a deterministic context score based on account age and this server’s own history. It is not an identity rating or a learned-model prediction.

​
Reviews and appeals

Moderator review changes future automation:
  • Approving a quarantined finding removes it from incident and retro-hunt action.
  • Upholding or escalating a finding provides explicit positive evidence.
  • False-positive incident resolution feeds back into network suppression and shadow-learning labels.
Members can use Request review from a punishment DM. Appeals return to your server’s AutoMod review flow.

​
Incidents and response playbooks

Confirmed network evidence can create a local incident when it matches your server’s recent metadata. Thea can alert staff, recheck previously logged messages, and temporarily harden new-account link checks. Moderator-authorized playbooks can delete linked messages, apply bounded one-hour timeouts, or warn exposed channels. They recheck authorization immediately before each action and never ban. See Review and contain scam incidents.

​
Troubleshooting

​
Privacy

Scam Defense processes server activity only. It does not monitor direct messages. Local AutoMod events retain bounded metadata such as event ID, severity, action, timestamps, Discord scope, content length, and a content hash. They do not retain the message body. Shared network observations use keyed indicator digests and rotating contributor pseudonyms instead of raw indicators or server, member, channel, and message IDs. Local AutoMod events are retained for up to 90 days. Shared network records use separate 14-, 90-, and 180-day limits described in the network guide. See Scam Defense Network privacy for contribution, quorum, public statistics, and retention details.

Scam Defense Network

Understand contribution, consumption, quorum, adaptive hardening, and the public Network Pulse.

Tripwire channel

Arm a decoy channel and diagnose why a test did not trigger.

Incidents and playbooks

Review campaigns, retro-hunts, containment, notices, and false positives.
Attempting to evade Scam Defense by creating new accounts or servers to bypass an active action violates Thea’s Acceptable Use Policy and may result in removal from the platform.