Middleman Scams: Mechanics and Countermeasures

Identity Gaps, Verification, and Escrow

Let us imagine a gamer named Sally—S for short—who plays an online game called W. Sally no longer wants to play W, so she decides to sell 10,000 gold for $100.

She finds a Discord trading server for W and posts a sales listing. Before long, she receives a DM from Fred—F for short—who says he wants to trade. Sally has heard somewhere that when selling in-game currency for real money, the seller should receive the money first and hand over the in-game currency only afterward.

Sally meets Fred’s character in the game and opens a trade window. She sends him her bank account details through Discord, confirms that the $100 has arrived, and then hands over the 10,000 gold.

Some time later, however, Sally receives a call from the police informing her that she has become involved in a low-value middleman scam.

What happened?

For the purposes of this article, a middleman scam refers to a scheme in which the scammer poses as a buyer to the genuine seller and as a seller to the genuine buyer, causing the buyer’s money and the seller’s in-game currency to be delivered to different people.

To make the structure easier to understand, let us now reconstruct the incident step by step from the scammer’s point of view.

1. Scammer F finds a seller, S, in the Discord server’s “Selling” section and sends S a DM saying that he wants to buy gold.

2. S believes that F is a genuine buyer.

3. At the same time, F finds a buyer, B, in the “Buying” section and sends B a DM saying that he wants to sell gold.

4. B believes that F is a genuine seller.

5. F asks seller S for the bank account into which the payment should be made. S gives F her account details.

6. F passes S’s account details to buyer B as though the account belonged to F and asks B to send the payment there.

7. Because B believes that F is the seller, B transfers the money into the account of S, a person with whom B has no actual relationship.

8. Seller S sees that the money has arrived and transfers the gold to F’s character, believing that F is the buyer who sent the payment.

9. As a result, scammer F obtains the in-game currency without paying anything. Seller S receives the correct amount of money for the gold but gives the gold to F, a third party, rather than to B, the person who actually sent the payment. Buyer B pays the money but receives none of the in-game currency.

That is how Sally became involved in a fraud case while believing that she had completed a perfectly legitimate transaction.

Now let us consider the matter from the game company’s point of view.

The company operating W—let us call it Company G—learns through a police investigation or user reports that a middleman scam has taken place among F, S, and B.

The company’s records may show that F’s character F1 met S’s character S1, that another character belonging to F, F2, may have met B’s character B1, and that S1 transferred 10,000 gold to F1.

Naturally, Company G does not know what was said in the Discord DMs, which person behind a Discord account was controlling which game character, or who transferred money to whom through a banking application.

The administrators of the Discord server may be able to see information such as the sales and purchase listings posted in the server, the Discord accounts that posted them, and the times at which those posts were made. They cannot, however, directly inspect the full contents of private DMs exchanged between users or determine the real-world identity behind each account.

The bank knows which accounts sent and received money, how much was transferred, and when the transfer took place. It does not know whether the payment was intended to purchase in-game currency, or whether the recipient was the actual scammer or merely an innocent seller being used by the scammer.

The movement of in-game currency, the conversations on Discord, and the movement of money through the banking system are therefore recorded by entirely separate companies and systems. No single institution possesses enough information to reconstruct the whole incident on its own.

The police would have to obtain the sales and purchase listings, Discord conversations, game login and transaction logs, and bank-transfer records, and then compare the times, accounts, characters, and financial relationships in order to identify the actual scammer.

Collecting and connecting all of that information across multiple companies and institutions naturally requires considerable time and labor. What makes the method particularly vicious is that both the seller and the buyer believe that they are participating in ordinary transactions, while the scammer exploits the informational gaps between separate platforms.

In a private transaction conducted solely through Discord DMs, an in-game trade, and an ordinary bank transfer, there is effectively no completely foolproof defense that an individual can carry out alone. From the information visible to the seller, it is extremely difficult to distinguish a genuine buyer from a scammer using a third party’s money. Any copyable authentication information—numbers, phrases, or sender-name fields—can also be relayed by the scammer between the two sides.

It may nevertheless be possible to design procedures that cause relatively little inconvenience to legitimate users while substantially increasing the cost and risk of detection for conventional middleman scams.

Countermeasure 1: From the Seller’s Perspective

1. Seller S posts a listing in the “Selling” section.

2. Scammer F messages S on Discord.

3. S asks F to come to a particular location inside the game.

4. S opens a trade window with F’s in-game character.

5. S gives F a number in the in-game trade window and instructs F to type the same number into the Discord chat immediately.

6. S asks F for the bank account from which the payment will supposedly be made.

7. S sends one cent to that account, using the sender-name or payment-reference field to send a message such as:

Seller:S1 / Receiver:F1 / Stop if this is not you

1. If necessary, S sends the message across several one-cent transfers.

2. S then tells the person on Discord:

“Check the payment reference and type the exact message into this chat.”

The fundamental problem in a middleman scam is that it is extremely difficult to verify whether the person speaking on Discord—D—the person controlling the in-game character—I—and the owner of the bank account—A—are all the same human being.

Step 5 at least allows S to rule out the possibility that I is merely an unrelated player standing somewhere in town whom the scammer has falsely identified as the trading partner.

The more serious problem is the case in which D and I are the same person, but A is someone else.

Suppose that you are scammer F and encounter seller S. The transaction would proceed as follows.

1. You see S’s listing in the “Selling” section and approach S while posing as a buyer.

2. You see B’s listing in the “Buying” section and approach B while posing as a seller.

3. In the game, you meet S’s character using F1, and meet B’s character using F2.

4. While trading with F1, S gives you a number and tells you to type the same number into the Discord chat.

5. You type the number into the Discord chat.

6. S asks you for the account from which the payment will be made.

7. You ask B for B’s account details, obtain them, and pass them to S.

8. S sends one cent to B’s account, using the payment reference:

Seller:S1 / Receiver:F1 / Stop if this is not you

1. If necessary, S sends the message across several transfers.

2. Because F does not own the account, F cannot see the payment reference directly.

3. In the transaction as B understands it, the seller’s character is F2 and the character receiving the gold is B1. The bank record, however, says that the actual seller is S1 and the actual recipient of the gold is F1. B therefore discovers that the transaction B believed was taking place is different from the transaction actually taking place.

4. The moment F relays S’s instruction and asks B to “type the one-cent payment reference exactly as it appears,” B can infer—because the character names belonging to F and S do not match—that B is being used as an intermediary in a middleman scam.

In this way, the buyer can be made aware—albeit indirectly—that:

D = I ≠ A

The method exploits the fact that scammer F cannot control the message displayed inside the actual account owner’s banking application.

This assumes, however, that scammer F behaves rationally. F may realize that the request for an account number is part of a verification procedure and provide F’s own bank account rather than obtaining B’s account details.

F may also use a third-party account under F’s control. The transfer, lending, or theft of such an account raises separate legal issues, but those issues will not be discussed in detail here because the present purpose is to explain the basic structure of the middleman scam.

If F provides F’s own account, the process would be as follows.

1. F sees S’s listing in the “Selling” section and approaches S while posing as a buyer.

2. F sees B’s listing in the “Buying” section and approaches B while posing as a seller.

3. F meets S’s character using F1 and meets B’s character using F2.

4. S gives F1 a number in the trade window and tells F to type the same number into the Discord chat.

5. F types the number into the chat.

6. S asks F for the account from which the payment will be made.

7. F gives S F’s own bank account.

8. S sends one cent to that account with the reference:

Seller:S1 / Receiver:F1 / Stop if this is not you

1. If necessary, S sends the message through several transfers.

2. Because F owns the account, F can read the message, and S is led to believe that F is the genuine buyer.

In this version of the scam, however, F must place F’s own bank account directly within the scope of a future investigation. This is considerably riskier than a conventional middleman scam. F’s Discord identity, in-game information, bank account, and chat history all become linked in one place.

If S can later determine that the account to which S sent the one-cent verification payment is different from the account from which the final payment arrived, S should stop the transaction and withhold the gold. S should then contact the bank and ask about the proper procedure for returning the suspicious transfer.

If the financial system in the relevant country does not display the sender’s originating account number to the recipient, even that comparison may be impossible. At the very least, however, the procedure still raises the cost and risk of committing the scam.

Countermeasure 2: From the Platform’s Perspective—Escrow

Just as one might deprive aerobic bacteria of oxygen, a trading platform could attempt to remove the conditions in which the scammer can operate.

To carry out a middleman scam, the scammer must attract both a buyer and a seller. If the platform removes the “Buying” section and keeps only the “Selling” section, the scammer’s job becomes considerably less convenient.

That does not, however, make the scam impossible.

The structure could still look like this:

1. Genuine seller S posts, “Selling gold.”

2. Scammer F posts a fake listing offering gold at a lower price.

3. Victim buyer B contacts F.

4. F contacts S while posing as a buyer.

5. S gives F S’s bank account details.

6. F gives those details to B, claiming that the account belongs to F.

7. B transfers money into S’s account.

8. S confirms the payment and transfers the gold to F’s character.

9. F disappears, and B receives no gold.

Thus, even without a purchase board, a selling board by itself can still sustain the entire ecology of a middleman scam. Removing the purchase board may make the scammer’s work less convenient and increase the chance of suspicion, but it does not eliminate the possibility entirely.

A stronger approach would be to allow a sales listing to be posted only after the seller has deposited the actual gold with the platform.

1. The seller deposits the gold into an account operated by the platform.

2. The platform permits the seller to list only the amount of gold that has actually been deposited.

3. The buyer pays through the platform’s payment system.

4. The platform transfers the gold to the character registered by the buyer.

5. Once the transaction is complete, the platform pays the seller.

A scammer trying to post a fake sales listing would then be unable to do so without first depositing the gold that the scammer supposedly intends to sell.

This structure, however, substantially undermines the low cost and immediacy of person-to-person transactions. The platform operator would have to store and transfer users’ gold while assuming the risks of account sanctions, disputes, incorrect deliveries, and even embezzlement by the operator itself.

The platform would cease to be a simple message board and become a custodian of in-game assets.

Fraud would become more difficult, but operating costs and the risks created by centralized trust would increase accordingly.