diff --git a/application/config.json.template b/application/config.json.template
index 0c0989ba96..d1ec6559f3 100644
--- a/application/config.json.template
+++ b/application/config.json.template
@@ -47,7 +47,8 @@
             "freenitro",
             "^earn$",
             "^earning",
-            ".exe$"
+            ".exe$",
+            "mrbeast"
         ],
         "hostWhitelist": [
             "discord.com",
diff --git a/application/src/main/java/org/togetherjava/tjbot/features/moderation/scam/ScamDetector.java b/application/src/main/java/org/togetherjava/tjbot/features/moderation/scam/ScamDetector.java
index 3240530f50..4898316d19 100644
--- a/application/src/main/java/org/togetherjava/tjbot/features/moderation/scam/ScamDetector.java
+++ b/application/src/main/java/org/togetherjava/tjbot/features/moderation/scam/ScamDetector.java
@@ -53,7 +53,7 @@ public ScamDetector(Config config) {
     public boolean isScam(Message message) {
         Member author = message.getMember();
         boolean isTrustedUser = author != null
-                && author.getRoles().stream().map(Role::getName).noneMatch(hasTrustedRole);
+                && author.getRoles().stream().map(Role::getName).anyMatch(hasTrustedRole);
         if (isTrustedUser) {
             return false;
         }
diff --git a/application/src/test/java/org/togetherjava/tjbot/features/moderation/scam/ScamDetectorTest.java b/application/src/test/java/org/togetherjava/tjbot/features/moderation/scam/ScamDetectorTest.java
index 609e4beeb4..f197cc7708 100644
--- a/application/src/test/java/org/togetherjava/tjbot/features/moderation/scam/ScamDetectorTest.java
+++ b/application/src/test/java/org/togetherjava/tjbot/features/moderation/scam/ScamDetectorTest.java
@@ -37,7 +37,7 @@ void setUp() {
         when(scamConfig.getSuspiciousKeywords()).thenReturn(Set.of("nitro", "boob", "sexy", "sexi",
                 "esex", "steam", "gift", "onlyfans", "bitcoin", "btc", "promo", "trader", "trading",
                 "whatsapp", "crypto", "^claim", "teen", "adobe", "hack", "steamcommunity",
-                "freenitro", "^earn$", "^earning", ".exe$"));
+                "freenitro", "^earn$", "^earning", ".exe$", "mrbeast"));
         when(scamConfig.getHostWhitelist()).thenReturn(Set.of("discord.com", "discord.media",
                 "discordapp.com", "discordapp.net", "discordstatus.com", "thehackernews.com",
                 "gradle.org", "help.gradle.org", "youtube.com", "www.youtube.com"));
@@ -223,7 +223,7 @@ void ignoreTrustedUser() {
         boolean isScamResult = scamDetector.isScam(message);
 
         // THEN flags it as harmless
-        assertTrue(isScamResult);
+        assertFalse(isScamResult);
     }
 
     private static Message createMessageMock(String content, List<Message.Attachment> attachments) {
@@ -400,7 +400,8 @@ B2CWorkflow Builder (React Flow)
                         Ready to unlock your earning potential in the digital market? you can start earning $100,000 and even more
                         as a beginner from the digital market, DM me for expert guidance or contact me directly on telegram and start building your financial future.
                         Telegram username @JohnSmith123""",
-                "Grab it before it's deleted (available for Windows and macOS): https://www.reddit.com/r/TVBaFreeHub/comments/12345t/ninaatradercrackedfullpowertradingfreefor123/");
+                "Grab it before it's deleted (available for Windows and macOS): https://www.reddit.com/r/TVBaFreeHub/comments/12345t/ninaatradercrackedfullpowertradingfreefor123/",
+                "Bro, claim 0.1 BTC now! Use promo code \"mrbeast\" at expmcoins.com screen @everyone");
     }
 
     private static List<String> provideRealFalsePositiveMessages() {