A Chat With My Discord Impersonator

Image: Daniel Goh (Allure Media)

I was having a relatively ordinary morning, until I got a Twitter DM. "Hey, is this you on Discord," a streamer asked.

This story originally appeared in July 2018.

Their name was Ulti, a streamer on Mixer and a member of a Discord community promoting mindfulness, healthy living and general fitness. We'd never crossed paths before, and most likely wouldn't have if this was any other day.

But someone had messaged the streamer. They said they were a writer and an "aspiring journalist", conducting a survey on how Discord communities function.

"Contributors who participate in this study will receive credit," the message read, which Ulti relayed back to me. In subsequent messages, the person described themselves as a "writer for Kotaku Australia" and, later on, that they were "very new to journalism and interviewing", were "hired last month".

Their supposed name: Alex Walker.

Image: Supplied

The rest of the morning became a mission to unpack what the hell was going on. Why was someone impersonating me, the site, and what were they after?

As Ulti quickly described, the "study" on Discord communities was really just a trap. At the end of the basic questions, all through Discord chat, the user asked them for one last detail.

"Would you be willing to provide us with your token so new users reading the article can connect to your server," the user using my identity asked. This wasn't the invite code for the server, or even a permanent invite link, but a special token ID.

This token ID, they described, was contained in local storage by Discord. It could be found through the Inspector dev tools accessible through Chrome.

"Once you provide the token, we can embed it into the syntax of the article," they wrote.

Fortunately for me, the red flags started going up for Ulti. He kept pushing back, pressing for more information, until the user said they'd written a story about the recent Steam sales. That was enough for Ulti to find me directly on Twitter.

After a slightly panicked PSA, I started thinking about what the best course of action was. Do you get HR involved? Do the lawyers get involved? Do you file a police report at some point?

That's probably one path, I thought. But that wasn't a road I wanted to walk just yet.

So I asked Ulti: did he still have this person's details, at least on Discord? Maybe I could talk to them. At least find out what the hell is going on.

They did, and so I sent a short message. Why are they doing this?

Initially it was just having a conversation with a troll. I'd ask something, they'd ask why I cared. I'd say I just wanted to understand, and surely they could appreciate that; they'd reply that they could understand why some people wanted to eat badgers.

After a bit of back and forth, they began to describe the point of all this. "The token can take control of someone's account," the user said. "And all I was going to do was transfer ownership ... to take control of a ton of servers. A couple of friends and I work together."

As far as they saw it, once control had been transferred to them they were untouchable — as far as the compromised user was concerned, anyway. I asked whether they were worried about Discord doing anything, but they said they could just ban the owner from their original server, make new Discord accounts, and start over.

"I've owned my own server and had a couple hundred people on there. But gave up on it, so I decided to do this," they said.

I'd thought it was already clear, but it wasn't until some random chat about soccer — I relayed the story about breaking my wrist last year — that my impersonator realised they were talking to the person whose identity they were stealing. "Lol you don't work for Kotaku ... wait lol, are you actually the one who wrote that article," they asked.

Apparently, they thought they were talking to the same person they tried to "troll" earlier in the day. "Bro I didn't take your name, no disrespect to you," they said. Ulti had asked for a name, so they pulled up a random article, and simply used the site and my name to keep the illusion going.

"Sorry mate, didn't think I'd actually talk to the writer."

It's probably pretty rare that someone puts their head into the lion's mouth too, so to speak. Chatting to them like a normal person doesn't really have any upsides. Imagine the worst case scenario. Lawyers get involved, conversations get read out in court.

That's not fun. That's the sort of thing that fucks up a person's life, although the flipside of looking at it is that they're doing the exact same thing to me by leveraging my identity in the first place.

It doesn't help that the person in question was also identified as a HypeSquad member. HypeSquad is described as a way for people to represent Discord — the application form asks if you run events, or could attend or help out — and in turn, Discord will "support your gaming community". Approved members get access to a special server, a t-shirt if they volunteer at conventions and other events, and an exclusive profile badge.

And that's the problem: members have that Discord-sanctioned logo on their profile. That insignia isn't worth anything monetarily, but the degree of credibility becomes incredibly useful in situations like this.

"It takes a while to get approved so there's a vetting period for it," Ulti explained. "The fact that this scammer had a HypeSquad tag isn't great."

I filed a report to Discord's Trust and Safety team, and reached out to Discord directly as well. I asked what happens if someone has had control of their account or server transferred in this way, and what Discord can and does do about the situation.

A Discord representative got back to me on Twitter, but the best they could do was recommending a report to the Trust and Safety Team (which I'd already done). I asked if there was a better contact that might be able to help, but hadn't heard back at the time of writing.

On the positive side, I couldn't see anything online indicating that anyone else had been caught out. That doesn't mean others haven't been affected, and perhaps the publication of this piece might reveal more people who have been caught out by this approach, or something similar.

Without escalating things further, there was one last thing to do. I'd been chatting to the person responsible for a couple of hours. We'd had a relatively placid conversation. They weren't trying to troll me, and even after realising they were talking to the person they were potentially impacting, they didn't seem to want to do any further damage.

So I asked: could they, possibly, stop using my name? They agreed, although I'm not sure how much I believe their answer. "It was only for one thing, didn't realise [Ulti] would actually say something," they said.

I wonder what would have happened if they didn't.


    ...how do I know this isn't the hacker posting this trying to discredit the real Alex Walker?! #trustno1

    My takeaway from this is that some people eat badgers.

    Glad you talked to them so we can all be more informed.

    That is one heck of a story. I'd be terrified to find out someone was using my identity for anything

    "...When you have to kill a man, it costs nothing to be polite."
    - Winston Churchill / @FakeAlexWalker

    The HypeSquad thing suggests they probably are on a stolen account too. And if you told me they were taking over discord servers to spread malware I would not be remotely shocked.

    Bet Discord will do nothing though.

    What a shocker. Glad you got to the bottom of it Alex. Hope that's the end of it.

    I had a person recently pretending to be me and posting my animation work to a creative platform and responding to other user comments about how and why they made it as if it were their own. Someone clued in that it wasn't me and kindly brought it to my attention. Very odd when someone is pretending to be you!

    Put trolls to the sword! Burn the heretics! The xenos! The mutants!

    The question we all should be asking is did Alex Walker even exist at all?

    I'm a cop, and let's be clear about something that Alex said in the article: He could have gotten the police involved, but that was a step he didn't want to take at that point.

    I'll say this loud and clear: Identify theft has no excuse, costs millions to people each year, and can ruin lives. It's a massive issue for law enforcement and it can't be stopped unless people step up and report it.

    I wonder who these guys impersonated after Alex?

    Last edited 26/12/18 1:01 pm

      That's the other side of it. And to be honest, at the time I didn't want to get Fairfax involved specifically (as they handled our HR side of things at that point), but police would have been probably the next step if things had gone that far.

      On top of that, once I started walking down that road, it would have - in all likelihood - prevented me from talking about it publicly, warning people as soon as possible, and this story most likely wouldn't have happened either. I leant towards letting people know as soon as possible, and if that path hopefully results in the person involved doing a 180 and their life not getting totally fucked in the process, then that's a net positive. But I'm also lucky in that the attempted identity theft here wasn't as malicious or damaging as it could have been (to me, though).

      I do still wonder what happened to the kid, though. And maybe I made the wrong call? But I'm glad everyone is able to have this conversation out in the open. That's worth something.

Join the discussion!

Trending Stories Right Now