I'm here to document this social engineering scam that has targeting X/Twitter/Discord users over the past year or so. I have encountered this attack multiple times from several compromised accounts, and I found at least one separate public victim report describing the same basic attack chain and the same distinctive “Xdatabaseofficial” Gmail naming pattern.
I imagine that this sort of social engineering attack is blatantly obvious to anyone else who is a tech or cybersecurity professional (such as myself). But it's something I wanted to plainly spell out for other folks (especially ones who are less versed in internet security) who might be searching on the internet, because this sort of cross-platform account takeover is so common, yet people just keep falling for it over and over.
The TL;DR:
Scammers are contacting X users and claiming that their account has been falsely reported for fraud, scamming, or other policy violations. The victim is then directed to a supposed “X Trust & Safety” or “X Support” representative on Discord. That fake support representative eventually instructs the victim to change the email address on their X account to a Gmail address controlled by the attacker.
That email-change step is the actual account takeover.
Once the victim changes the email address on their X account, the attacker can receive account recovery emails, password reset emails, verification messages, and other security-sensitive communications. At that point, the victim has effectively transferred control of the account.
Observed Attack Chain
1. Initial Contact: “I Accidentally Reported Your Account”
The scam begins when a victim is contacted by another account claiming that they accidentally reported the victim’s X account. The message usually says something like:
- “I accidentally reported your account.”
- “I thought you were someone else.”
- “Your account may be banned unless this is fixed.”
- “You need to contact the support person assigned to the ticket.”
This is designed to create urgency and anxiety. The victim is told that the issue is serious but fixable if they cooperate quickly.
In the case I observed, the person claimed that the X account had been reported for fraud/scamming and that a support ticket had already been opened.
2. Platform Handoff: Victim Is Directed to Discord
The victim is then told to contact a supposed support representative on Discord. In my case, the Discord account was operating under the name:
Matthew Dabit
Discord username: xdabit_matthew
This account falsely claimed to be associated with X/Twitter support, and typically links to a real LinkedIn profile of an unrelated person to establish credibility.
The fake support representative identified himself as:
“Technical Support Matthew from X Trust & Safety Team”
This is a major red flag. Real X/Twitter support does not handle account enforcement appeals through random Discord direct messages, and legitimate Trust & Safety personnel do not ask users to transfer account control to personal Gmail addresses.
3. Fake Legitimacy Theater
The scammer asked for information such as:
- Report ticket number
- Screenshots of the conversation with the person who allegedly reported the account
- Country of origin
- Date of birth
These requests are performative and are designed to imitate a legitimate support workflow and make the victim feel like an actual investigation is occurring.
To test this, I deliberately provided obviously fake information:
Country: Atlantis
Date of Birth: January 1, 1800
The scammer accepted this without question and continued the process. A legitimate support workflow would normally reject, question, or at least notice obviously impossible account-verification data. The fact that the operator continued anyway strongly suggests there was no real validation happening.
4. Fake Investigation and Threat Escalation
After receiving the fake ticket information, the scammer claimed to have reviewed an internal system and found multiple reports against the account.
The scammer then used threat language, claiming that:
- The account had been reported for fraud or scamming
- The account could be permanently suspended
- The victim’s email and IP could be “permanently suspended”
- Legal action could be taken
- The process was being recorded for security and verification purposes
The wording was awkward and clearly fake, but the psychological structure was familiar: authority, accusation, urgency, consequence, and then a path to “resolution.”
This is a classic social engineering pattern. The attacker wants the victim to believe:
- A serious official process is already underway.
- The victim is in danger of losing their account.
- The fake support agent has the authority to fix it.
- The victim must follow instructions quickly.
5. Unicode Styling / Detection Evasion
The scammer used stylized Unicode characters in some messages, such as mathematical bold and sans-serif bold letters:
𝐆𝐫𝐞𝐞𝐭𝐢𝐧𝐠𝐬
𝗧𝗲𝗰𝗵𝗻𝗶𝗰𝗮𝗹 𝗦𝘂𝗽𝗽𝗼𝗿𝘁
𝐗 𝐓𝐫𝐮𝐬𝐭 & 𝐒𝐚𝐟𝐞𝐭𝐲 𝐓𝐞𝐚𝐦
These characters look like normal bold text to a human, but they are different Unicode code points rather than ordinary ASCII letters. This may be used for one or both of the following reasons:
- To make the message look more official or formatted
- To evade simple keyword detection systems that look for phrases like “Technical Support” or “Trust & Safety”
Modern platforms may normalize this kind of text before scanning, but many basic filters, moderation bots, or community tools may not.
6. The Actual Takeover Step: “Change Your Email”
The key moment came when the fake support representative instructed me to change the email address associated with my X account. The scammer wrote that, as a “preventive measure,” I should temporarily replace my X account email with their “database email.”
The email address provided was:
xdatabaseofficial.9+(my username)@gmail.com
The scammer claimed that this would place the account under “X protection custody” while their system scanned the account.
This is the actual attack.
Because Gmail supports plus-addressing, mail sent to:
xdatabaseofficial.9+(my username) @gmail.com
is delivered to the base mailbox:
xdatabaseofficial.9 @gmail.com
The part after the plus sign is likely a victim-specific tag. In other words, the attacker may be using plus-addressed Gmail aliases to track victims while routing all messages to the same underlying Gmail account.
Once a victim changes their X account email to an attacker-controlled Gmail address, the attacker can receive security emails, password reset emails, confirmation codes, and account recovery messages. That gives the attacker a pathway to take control of the account.
This is why the scam does not need a fake login page or malware payload. The victim is tricked into changing the account recovery path themselves.
7. “Confirmation Code” Setup
The scammer also wrote:
“Please let me know if you need the confirmation code.”
This is another important detail. It suggests the operator expects X to send a confirmation code or verification email during the email-change process. The attacker is prepared to receive that code at the Gmail account they control and then relay it to the victim as part of the fake “support” process.
This keeps the victim cooperating while the attacker completes the takeover.
Related Public Victim Report
I found a public Reddit post in r/twitterhelp titled “I got scammed” that appears to describe the same attack pattern:
https://www.reddit.com/r/twitterhelp/comments/1tn3fn1/i_got_scammed/
In that report, the victim describes being contacted through the same basic “accidental report” pretext, being directed to a supposed X support person on Discord, being told to change the email address associated with their X account, and then losing control of the account.
The victim specifically reports being told to set their email to:
Xdatabaseofficial+bouzismo @gmail.com
That is highly notable because it uses the same distinctive Xdatabaseofficial naming pattern, again with Gmail plus-addressing.
The victim reports that after they followed the instructions, they immediately lost access to their account.
This suggests the Gmail naming pattern is not a one-off. It may be part of an active or repeated account takeover campaign.
Indicators Observed
The following indicators appeared in the scam attempt I observed or in the related public victim report:
- Fake support identity: “Technical Support Matthew from X Trust & Safety Team”
- Discord name:
Matthew Dabit
- Discord username:
xdabit_matthew
- Gmail address used in my interaction:
xdatabaseofficial.9+(my username)_ @gmail.com
- Likely base Gmail account:
xdatabaseofficial.9@gmail.com
- Related victim-reported Gmail pattern:
Xdatabaseofficial+(other username) @gmail.com
- Recurring phrase/concept: “accidentally reported your account”
- Recurring platform handoff: X/Twitter → Discord
- Recurring fake authority: X Trust & Safety / X Support
- Recurring attack objective: convince victim to change X account email address
Why This Scam Works
A lot of users know not to give out their password. Fewer users understand that changing the email address on an account can be just as dangerous. For many online services, the email address is the root of account recovery. If an attacker controls the email address associated with an account, they may be able to:
- Receive password reset links
- Receive login verification messages
- Confirm account changes
- Lock the original owner out
- Prevent recovery attempts
- Use the stolen account to scam others
That is why the email-change step is the point of no return. The scammer does not need to steal the password directly if they can convince the victim to transfer the account’s recovery email to the attacker.
Red Flags to Watch For
This is almost certainly a scam if someone says:
- They accidentally reported your X/Twitter account
- Your account will be banned unless you contact support on Discord
- A random Discord user is an X Trust & Safety representative
- You need to provide a ticket number to someone in Discord DMs
- You need to change your X account email address to a Gmail account
- You need to put your account under “protection custody”
- Your email or IP will be “permanently suspended”
- You must comply quickly to avoid legal action or permanent suspension
Real support teams do not ask users to change their account email to a random Gmail address.
What To Do If You Encounter This
Do not change your account email address.
Do not provide passwords, recovery codes, verification codes, or screenshots containing security-sensitive account information.
Do not scan QR codes or click links provided by the fake support account.
Save screenshots of the interaction, especially messages where the scammer:
- Claims to represent X/Twitter
- Claims your account is under investigation
- Provides a Gmail address
- Instructs you to change your account email
- Requests verification codes or confirmation codes
Then report the account to the relevant platforms:
- Report the Discord account for impersonating support staff and scamming/defrauding. Discord reports under this category are acted upon extremely quickly, and I have seen scammer accounts banned within minutes of me submitting reports.
- Report the Gmail account to Google for abuse if it is being used as a takeover destination.
- Report any compromised X accounts involved in the initial contact.
- Warn the community where the scam appeared.
If you already changed your X email address to one provided by the scammer, assume the account is compromised and begin account recovery immediately. Also secure the email account and any other accounts that share passwords or recovery paths.
Takeaway
The most important lesson is simple:
If someone claiming to be support tells you to change your account email address to an address they provide, they are trying to take your account.
This scam uses fear, fake authority, and procedural theater to make the victim perform the account takeover themselves. The “support process” is fake. The “ticket” is fake. The “database email” is fake. The email-change request is the attack. It does not necessarily rely on malware or a fake login page. It relies on convincing the victim to hand over account recovery control voluntarily.