Hypothetically: I'm a moderator on a site. Through some form of trickery a user (Henry) finds a way to make himself look like a moderator - through HTML injection, profile image trickery, what have you.
Henry is now using this to passively intimidate users into doing his will ("I'd really like you to xyz", "Sure, because you're a moderator" type things). What should I, as a real moderator, do?
If you, as a moderator, have the ability to change the user's display name / profile picture, simply do so.
Otherwise, you should contact/notify Henry in some way, and try to tell him to stop the unwanted behavior, just like any other moderation issue. If this fails, then simply handle it as if the issue was the same as any other - give him some kind of warning / punishment / suspension / {insert generic negative thing here}. It doesn't seem like this needs to be handled in any special way, really.
You might also want to contact the users involved and reassure them that Henry was not, in fact, a real moderator.
Tell, don't ask, them to stop. If they refuse remove them from the community for a period of time. I'd consider this abuse of a security flaw in your community software and usually that is against terms of use/community standards. If that isn't, I'd assume that the intimidation violates something, right?)
I would also explain to the community what is happening (perhaps leaving out technical details so it isn't exploited by others). Assure them that you are looking into the issue and will install appropriate patches when they are available.
If/when that leads to questions about compromised data, answer truthfully.
Personally, I would immediately suspend someone from the community for this. It is a serious violation of the community and not one that someone does by accident. I might consider giving a warning if it was otherwise a valuable member of the community who was just using it to fool around/pull another member's leg, but this is a very serious type of issue.
I would also try to determine who they had been interacting with if possible and contact them to make sure accounts are secure and that he didn't get any user's passwords or anything from the time spent pretending to be a moderator.
It is a very serious security breach for someone to be acting as if they are a moderator or admin when they are not. The social engineering potential is quite significant and in many cases, it is possible it may even actually be a criminal use of the system.
If investigation reveals that they were using it to compromise account details of other users, I might also refer it to the owner of the site for possible legal action against the user. They could take that information and try it against those user's other possible accounts and could use it as the basis of launching various cybercrimes.
Ban them.
I wouldn't even give them an option of lifting the ban on good behaviour.
There's clear malice, and one needs to set an example of what's unsuitable behaviour. This sort of thing undermines the positional authority of the moderator team, and needs to be handled swiftly and with as much force as can be mustered.
Yeah, I'm being hardnosed here, but misrepresenting yourself as a moderator, even implicitly is a clear sign that the user is a bit of a sociopath.
Note if he can do this, through some HTML injection or other tricks, then your first order of activity should be fixing the system loophole that allows him to do that. If he's able to change the appearance of his profile, it's more than likely that he, or someone else, can inject malicious HTML into your page, and e.g. steal users' passwords. It's a serious security vulnerability and it should be addressed first.
...once that happens, the problem will resolve itself, by breaking the functionality that allowed him that in the first place.
It's one thing for a user to pretend/act like a moderator, which should be simply against the site rules and dealt like any normal violation. It's another if they can genuinely change their post/profile appearance in ways that allow them to appear as one. It's a relatively harmless use of a very serious vulnerability, and dealing with Henry, and not with the bug will come to bite your back sooner or later (...even with disgruntled Henry returning with more malicious variant of the hack...)
through HTML injection
This kind of falls under hacking the site, doesn't it?
I would assume that there is a EULA somewhere on the site that every user (by participation) agrees to, this should have clauses in it similar to
So if a user is doing such things they should be banned, but allowed to state their discontent through a single Email to the authorities of the site, in the case there was an error.
My thoughts are that someone caught hacking the site should not be given the opportunity to hack it further, take immediate action if this is the case, better safe than sorry.
Tell them to stop, and remove their profile image and change their username if you can. If they don't stop afterward, ban them and tell higher-ups that this happened, since this could also be a potential security issue.
It would be helpful also to tell the community what to watch out for (Moderators will never ask you for your password, etc) and tell them to report the post or message to the moderators to take a look at it.
Edit: It also helps to make sure posts made by a moderator can be distinguished from those made by a regular user (maybe by changing the background color of the post or what have you).
The statute should definitely contain an entry about impersonating staff.
If other users see Henry's posts, with avatar with a small red box "Ban: 3 days; impersonating staff of the site" they shouldn't have any doubts about validity of Henry's claims. Of course removing the offending code is a prerequisite to lifting the ban.
Suspend him/her, for people can't follow a suspended moderator. You should also explain to the community the facts, but do so after suspending him so your speech carries more weight.
