How to Stop Spam Tickets and Ticket Scams in Discord

The four problems, which need different fixes

They get lumped together as "spam" and they are not the same:

Defence 1: blacklist, by user and by role

The obvious one, with a less obvious capability. On AI Ticket Bot the blacklist works by user or by role. Blocking a role blocks every member holding it.

Role blacklisting is the one that scales. If you have a "muted" or "restricted" role that moderation already applies, blacklisting that role means every moderation action automatically stops ticket abuse too, with no second step and nothing to remember.

Three details worth knowing. The blacklist scopes the ticket-opening privilege: a blacklisted member can still see a ticket channel they already have open until it closes, so it is not a server mute. Blocking an entire guild is an owner-level global action, not something a server admin does. And blocking somebody is its own staff permission, so a moderator can do it without holding Manage Server, which matters because the people who catch spam first are rarely the people you want administering the server.

The AI can also add someone to the blacklist itself, but the rules on that are deliberately narrow: two clear warnings and continued behaviour, and only for spam, repeated profanity at staff, prompt injection, scams or coordinated flooding. Never for disagreement, impatience, a single rude message, or a low-effort ticket.

Defence 2: anti-sniping protection

This one deserves explaining because the attack is not obvious.

When a ticket channel is created, that event is visible. A scam self-bot watching your server can correlate "channel created" with "which member just became able to see it" and work out who opened a support ticket. It then DMs that person, pretending to be staff, while they are actively waiting for help. That is the moment people are most likely to fall for it.

The defence is to break the correlation. AI Ticket Bot has an anti-DM setting: the ticket channel is created without the opener's view permission, then the opener is added a few seconds later, randomised. The event a scam bot is watching no longer identifies anybody.

Defence 3: a form before the ticket opens

Requiring a short form does two things. It filters low-effort spam, because bots and drive-by advertisers do not fill in forms. And it improves the tickets you do get, because you have the information before the first reply.

Keep it to two or three fields. A long form deters legitimate members with a real problem, which is a worse outcome than the spam you stopped.

Modal forms at ticket open are a paid feature. If you have not paid, publishing your first panel starts 14 days of Premium with no payment method, which is enough to find out whether a form actually changes your spam rate before deciding.

Defence 4: make impersonation obvious

The most effective anti-scam measure costs nothing: publish that your staff never DM first, and then never DM first.

Once members know the rule, an unsolicited DM is self-evidently a scam regardless of how convincing the profile looks. This works better than any technical control because it does not depend on catching the scammer. It removes their opening move.

What about rate limits?

Per-user throttles exist and help against the crude version of ticket spam. Set them loosely.

The reason: a member with a genuine urgent problem who accidentally closes their ticket and cannot open another is now a support problem you created. Closed tickets cannot be reopened, so a rate limit interacts badly with that. Rate limiting is a backstop, not a primary defence.

Defences ranked

What does not work

If spam is a real share of your volume

Then it is a volume problem as well as a safety problem, and it belongs in the wider plan. Our guide to reducing ticket volume treats spam as one of eight levers rather than the whole picture, which is usually the right frame.