Type of request

• Add new content
• Update existing content

What content are you suggesting for?

File: docs/pages/community-management/overview.mdx
an update in section https://frameworks.securityalliance.org/community-management/overview#phishing-awareness of the [community-management]

Why do you think this update or modification is needed?

Malicious actors commonly:

• mimic signals such as “never DM first”, “Official”, or “Support” to gain user trust
• exploit gaps in channel definitions by creating accounts on platforms not explicitly declared as unsupported
  I believe those who want to secure the protocol, as well as the users of it should be aware of these things and ideally act on it preemptively.

I would like to add details to both of these statements and make them more straightforward:

Clearly communicate to community members that your team will never send the first direct message to them.
This is important because attackers often impersonate team members and initiate direct messages to trick users into believing they are legitimate, thereby gaining their trust and potentially compromising their security.
+ However, users should be aware that statements such as “will never DM first” or labels like “Official,” “Support,” or platform status indicators (e.g., premium badges) must not be treated as proof of legitimacy. 
+ Users should verify identities exclusively through links to official accounts listed on the organization’s website.

- Publicly define all official communication channels used by your organization.
+ Publicly define all official communication channels and clearly state which platforms are not used. 
+ If a platform is unsupported, declare this alongside official links (e.g., “We do not operate a Telegram community”). 
+ Where possible, reserve common impersonation handles and maintain placeholder accounts that redirect users to official channels.

Can you justify your argument or provide additional resources?

I just see how scammers rely on following the same guidelines as legit organizations and believe that members and founders of any web3 organizations must be aware of these things, as they're spread across all defi and web3.
Some examples + a couple more thought on this here https://timsh.org/scam-telegram-investigation/#my-thoughts-on-how-to-protect-your-community.

Contribution intent

• I can provide/create this content myself
• I'm identifying a need for others to address