ScamShield

Inspiration

Discord has become the go-to platform for crypto communities, student groups, and online clubs — which makes it a prime hunting ground for scammers. On large servers, moderators are already stretched thin managing thousands of members, and AI has made the problem dramatically worse: scam messages are now fluent, personalised, and nearly indistinguishable from legitimate conversation at a glance. The old defences — keyword blocklists, report queues, manual review — simply don't scale.

We kept seeing the same pattern: someone joins a server, posts a slick phishing link or a fake giveaway, and by the time a mod notices the damage is done. Worse, the same bad actor often operates across dozens of servers simultaneously, and each server's mod team has no visibility into what the others have already caught. We wanted to fix that — a shared intelligence layer where catching a scammer in one community automatically puts every other community on alert.

What it does

ScamShield is a Discord bot that silently monitors every message in your server. When someone starts exhibiting scam behaviour — urgency pressure, info harvesting, payment redirection — the AI analyst scores their risk in real time. Cross a threshold and the bot reacts to the message with ⚠️, posts a public warning, and mutes the user automatically. Mods get a live dashboard showing every monitored user's risk score, detected tactics, and a full forensic autopsy of each flagged incident.

The key differentiator is a shared scammer database. Every user flagged anywhere across all monitored servers is recorded centrally. When that same user shows up in a new server — even one that has never seen them before — ScamShield already knows their history and pre-loads them as a high-suspicion account. One scam attempt anywhere means a much shorter leash everywhere. This turns every server using ScamShield into a contributor to a collective defence network, where the intelligence compounds over time.

How we built it

Backend: Node.js + Express with a WebSocket broadcast layer so the dashboard updates live without polling
AI: Gemini analyzes each message against 11 distinct scam tactics, returning confidence scores and evidence quotes
Bot: Discord.js v14 with privileged Message Content intent
Frontend: React + Vite dashboard with a risk gauge, per-user monitor cards, server filter tabs, and a clickable event feed with full tactic breakdowns
Persistence: MongoDB Atlas for session history and the leaderboard
Deploy: Multi-stage Docker build serving both API and web from a single origin on port 3001

Challenges

The hardest problem was detection sensitivity. A naïve accumulation model meant a single obvious scam message might never cross the risk threshold on its own. We solved this with two mechanisms: a per-turn risk cap that forces accumulation across multiple messages, and an instant-flag path where a single detection at ≥80% confidence immediately triggers enforcement — no accumulation needed.

The second challenge was multi-server isolation. Early builds keyed all session state by userId alone, so getting flagged in Server A would silently block the user in Server B — causing "0 messages observed" on monitor cards and confusing demo behaviour. We moved to a guildId:userId compound key for per-server session tracking, while keeping a cross-server knownBadActors set that pre-loads returning bad actors with elevated risk (60% of the flag threshold) in new servers.

What we learned

Real-time AI moderation is less about the model and more about the risk model around it — thresholds, accumulation caps, and confidence gates matter as much as detection quality. We also learned that good demo UX requires the system to be just aggressive enough to trigger on a single obvious message, without being so paranoid it flags legitimate conversation.

Most importantly: the shared database idea changes the fundamental economics of scamming on Discord. Right now, scammers can hop servers freely because each community's knowledge resets to zero. With a collective intelligence layer, every ban makes the next attempt harder — the network gets smarter every time someone tries to abuse it.