Giveaways can grow your Discord, but they also attract scammers. Use this step by step security guide to run safe, transparent contests in Web3 servers.
Giveaways concentrate attention, urgency, and value, which is exactly what scammers look for. In Web3 servers the risks are higher because prizes often touch wallets or mint sites, and attackers can clone your branding, spam DMs, or post lookalike links that drain assets. Common failure modes include fake winner DMs, malicious claim links, bot farms flooding entries, partner servers going rogue, and staff accounts getting compromised during the event. Before you announce a prize, define the threat model you face, such as account takeovers, webhook abuse, role misconfigurations, and social engineering of winners. Treat every giveaway as a mini launch with its own security plan, approvals, and controls, not as a casual post with a confetti emoji.
Start with a written plan that names an owner, an approver, and a distribution lead. Document the goal, the eligibility rules, the timeline, the prize source, and the exact claim method, then get sign off before any post goes live. Vet partners and prize sponsors with a quick due diligence pass, review their Discord safety history, check their bot permissions on their server, and confirm wallet custody or mint mechanics. Use a short risk checklist that covers team access changes during the event, fallback if a bot fails, and how you will pause or cancel safely. Decide your transparency policy in advance, such as publishing a winners list, transaction links, and a post event summary, so you do not debate these points in the heat of the moment.
Create a Giveaways category with a read only announcements channel for the giveaway post and a separate claim or winners channel. On the giveaway channel set @everyone to View Channel true, Send Messages false, Add Reactions false, Use External Emojis false, Create Public Threads false, Create Private Threads false, Send Messages in Threads false, and Use Application Commands false. Grant the giveaway bot role Send Messages, Add Reactions if needed for entries, Embed Links, and Read Message History, and allow the moderator lead role Manage Messages and Manage Threads. Turn on slowmode in any discussion or claim channel to reduce spam and set mention permissions so only the giveaway role can ping, never allow @everyone or @here pings. In Server Settings enable AutoMod keyword filters for common scam phrases and domains, limit mention spam, and enforce a link allowlist that includes only your official site and verified partner domains. Finally, audit webhooks on the category and channels, remove any you do not recognize, and lock the channel after the event to freeze the record.
Pick a giveaway bot with a security track record, active maintenance, clear permissions, and an audit log integration. Install with least privilege, avoid Administrator, and restrict the bot to the Giveaways category, granting only the permissions it needs to post, react, and manage its own messages. Enable built in anti bot features such as account age minimums, server join age checks, role gating for verified members, and per user entry caps. Pair the giveaway bot with a separate verification gate, such as Discord membership screening or a captcha entry role, so burner accounts cannot flood entries. Require all winner interactions to happen in a public thread created by the bot or a mod, never by direct message, and disable or ignore any bot features that try to contact winners in DMs. Log all bot actions to a private staff channel, including giveaway creation, edits, rerolls, and winner selection, and back up the configuration before you go live.
Publish clear instructions that say the team will never DM first and that all winner steps happen in the giveaway or winners channel. Use the bot to pick winners in public, then spin up a private thread with the winner and two staff members to verify eligibility. Ask winners to confirm their Discord handle, server join date, and any stated eligibility such as a role, a snapshot of token holdings, or an allowlist entry, but never ask for a seed phrase or private key. If a wallet address is required, collect it through a safe web form hosted on your official domain with a short, unambiguous URL, and post that URL in channel with a pinned message so members can verify it. Set a claim window, for example 48 hours, then reroll unclaimed prizes in public with a visible audit trail. To reduce sybil abuse, cross check for duplicate signals such as repeated wallet addresses, identical on chain activity, same Twitter or GitHub linkage if used, and newly created Discord accounts, and document your checks inside the thread.
Separate prize custody from your main treasury. Hold giveaway assets in a dedicated wallet with a small, capped balance and use a multisig or hardware wallet for approvals. For NFTs and allowlist spots, prefer claim portals where winners mint from the official contract on your site, rather than sending links in DMs, and post the exact contract address in channel for verification. For token transfers, batch send from the prize wallet and publish the transaction links in a transparency channel so anyone can verify final delivery. If you use codes or off chain rewards, deliver them through the winners thread or a secure portal, never through unsolicited DMs that can be spoofed. Close each winner thread with a short summary that includes the address, the delivery method, the transaction link or confirmation, and the staff who approved it.
Most scams succeed through confusion, so over communicate the process. Pin a simple one page explainer in the giveaway channel that includes the official claim URL, timing, the statement that the team will never DM first, and a contact method for help such as a modmail channel. During the event, schedule two or three reminder posts that repeat the boundaries of safe behavior, for example engage only in the giveaway channel, ignore DMs from anyone claiming to be staff, and verify links against the pinned post. Use a reserved giveaway role to announce updates, and do not allow staff to ping everyone out of band, which attackers try to mimic. If you spot a fake account or malicious link, post a fast alert in the channel that names the impostor handle, states it is not affiliated, and reminds members where to find official links. After winner selection, post a final wrap that thanks participants, lists winners, and reiterates that any DMs about the event are not from your team.
Close with a lightweight audit to capture lessons. Export the giveaway bot’s logs, screenshot the channel state, and compile a timeline that notes creation, winner selection, claims, any incidents, and when channels were locked. Check Discord Audit Log events for Role Update, Webhook Create, Integration Update, and Message Delete during the event window to spot anomalies. Rotate any elevated bot tokens or API keys you used, remove temporary roles, and reset channel permissions to baseline. Track a few metrics that matter such as total entries, verified unique entries, reroll rate, claim completion time, number of reported scam DMs, and AutoMod blocks, then set goals to reduce risk next time. Turn the playbook into a repeatable standard operating procedure with your templates for the pinned explainer, the winner thread checklist, and the post event transparency post, and store it in your team workspace so the next giveaway runs safer and faster.
Master Discord giveaway security for Web3 communities. Set safe rules, lock channels, harden bots, and use clear claim workflows to stop scams.