Discord's dark side · Part 3 of 5
Scams and stolen accounts
Nearly every scam on Discord has the same goal: to take over the account. A stolen account is then used to rob the owner's friends. This part catalogues the tricks, explains why they get past passwords and two-step verification, and sets out what stops them.
In plain terms
A Discord account is worth stealing even if it has no money in it. It has a friends list, and friends trust messages from friends. Scammers take one account, use it to message everyone it knows, take some of those accounts, and repeat.
Almost all of the tricks below come down to one of three things: getting you to log in on a fake page, getting you to scan a code, or getting you to run a file. The five rules at the end cover all three.
Key facts
- Scanning a login QR code sent by someone else hands them your account. Discord itself warns that this bypasses your password and two-step verification.
- Offers of free Nitro, Discord's paid subscription, are the most common bait.
- "Can you try a game I made?" is a documented malware campaign. The file steals saved passwords and login sessions.
- Most scam messages come from a real friend's account that has already been stolen.
- Changing your password logs out every device, including the thief's.
How solid is this?
The labels are explained on the Start here page.
| Claim | Status | Basis |
|---|---|---|
| A scanned QR code gives the sender full access, past password and two-step verification | Documented | Discord's own security guidance |
| Free Nitro offers are the most common route to account takeover | Documented | A security firm's write-up. Seen as a search summary |
| The "try my game" campaign installs information-stealing malware | Documented | Malwarebytes, January 2025. Seen as a search summary |
| The "I accidentally reported you" scam | Documented | A commercial blog. Weak, but widely corroborated by users |
| More than $360,000 in tokens stolen through one hacked server in June 2022 | Documented | A blockchain analysis firm. Seen as a search summary |
| Most scam messages come from friends' stolen accounts | Observed | Consistent with the campaigns above. No figures exist |
| The "three moves" and "five rules" | Observed | The writer's own grouping, offered as a teaching aid |
Why accounts are worth stealing
- The friends list. A message from a friend is opened and believed. This is the main value.
- Saved payment details. Accounts with a card attached can be used to buy gift subscriptions.
- Roles in servers. An account that moderates a large server can post to thousands of people at once.
- What the same malware finds next to it. The files that steal Discord sessions also take saved browser passwords, game accounts and cryptocurrency wallets.3
The key under the mat
When you log in, Discord gives your device a long secret code that proves you are you, so you do not have to type your password every time. Security writers call it a token. Anyone who has a copy of it is logged in as you, without needing your password or the six-digit code from your phone.
This is why victims say "but I had two-step verification on". Two-step verification guards the front door. Most Discord scams do not use the front door: they copy the key from under the mat. Discord's own guidance says of the QR code scam that it allows an attacker to log in "bypassing your password and any 2FA you may have configured".1
The good news is in the same guidance: changing your password makes every existing key stop working.1
The three moves
- The fake login. A link leads to a page that looks like Discord and asks you to sign in.
- The code. You are asked to scan a QR code, or read out a code sent to you.
- The file. You are asked to download and run something.
The catalogue
Free Nitro
A message, often from a friend's account, announces a free month of Nitro with a link to claim it. The link leads to a copy of Discord's login page, or asks you to "authorise" an app. A security firm that studied these scams describes free Nitro offers as among the most common routes to account takeover.2 Discord warns about lookalike addresses that swap one letter, such as a lowercase L in place of the i.1
The QR code
Discord lets you log in on a computer by scanning a QR code with the phone app. Scammers send that code to you, dressed up as a gift, a verification step or a giveaway entry. Scanning it logs their computer in to your account. Discord states plainly that its scanner "is only used to log in".1 It has shortened the life of each code to two minutes, which makes the attack harder but not impossible.2
"Can you try a game I made?"
Someone, often an acquaintance, says they are building a game and asks you to test it. They send a download link and a password for the file. Malwarebytes documented this campaign in January 2025: the installer is an information-stealing program, the files are often stored on Discord's own file hosting to look trustworthy, and the messages are sent from accounts that were themselves stolen the same way.3
The password on the file is a tell. It exists to stop security software scanning the contents.
"I accidentally reported you"
A stranger or a friend's stolen account messages in apparent panic: they reported your account for fraud by mistake, and it will be banned unless you speak to a staff member to clear it up. The "staff member" is a second account run by the same person, who asks for your login details, a code, or a payment. The warning signs listed by security writers are a claim of an accidental report, a referral to someone else to resolve it, and any request for credentials, a code or a purchase.4
Fake staff
Discord employees do not message users to ask for passwords or codes. Real system messages carry an official label that cannot be copied by changing a name and picture. Anyone asking for a login code is a scammer, whatever their profile says.
The fake verification bot
Many servers ask new members to click a button to prove they are human. Scam servers copy the look of these checks and add a step that is one of the three moves: scan this code, log in here, or run this. A real verification never needs your password.
Hacked servers and wallet drainers
When a moderator's account is stolen, the thief can post an announcement to the whole server. In communities built around cryptocurrency this has been used to advertise fake giveaways that empty the wallets of anyone who connects. In June 2022 a compromised account in the Bored Ape Yacht Club server led to the theft of more than $360,000 in tokens.5 Later that year the invite links to a well-known digital artist's server were hijacked to send fans to a copy built to do the same.6
The message from a friend
"Is this you in this video?" "Vote for my team." "I need you to do me a quick favour." The account is real; the person typing is not. This is the engine that keeps all of the above running, and it is the same pattern described in the Roblox series.
After it happens
- Change the password immediately, from a device you trust. This logs out every session, including the thief's.1
- If a file was run, assume everything saved on that computer is known: browser passwords, other game accounts, wallets. Scan the machine, then change those passwords from a different device.
- Turn on two-step verification with an authenticator app. Discord recommends an app over text messages, which can be intercepted.1
- Warn your friends. They have probably been sent the same message from your account.
- Check for purchases on any saved card and contact the card provider if there are any.
- If the email address on the account was changed, contact Discord support through its website. Ignore anyone who offers to recover the account for a fee.
Five rules
- Never scan a QR code someone sends you.
- Never log in through a link. Open the app or type the address yourself.
- Never run a file from a chat, especially one that comes with a password.
- Nobody from Discord will message you for a code or password.
- If a friend's message is odd, ask them another way. Call, text, or ask in person.
For professionals
- For schools. A wave of the same strange message across a year group usually means one pupil's account was taken and is being used to reach the rest. Treat it as a chain to be broken, not as misbehaviour by the first account.
- Loss of an account can be a safeguarding matter. Private messages, images and the identities of contacts pass to whoever took it. Ask what was in the account.
- What to record. The message as received, the sender's username, any link or file name, and the time. Do not open the link or file to check it.
- For IT staff. Information stealers take browser sessions as well as passwords. Resetting passwords without ending sessions and cleaning the device leaves the door open.
What is still unknown
- How many accounts are stolen. Discord's public figures were not obtained for this article.
- How much money is lost. Estimates exist only for individual cryptocurrency thefts.
- Who runs the campaigns. The tools are sold as a service, so those sending the messages are often not those who built them.
Glossary
- Infostealer
- A program that copies saved passwords, login sessions and wallet files from a computer and sends them to an attacker.
- Nitro
- Discord's paid subscription. The promise of a free one is the most common scam bait.
- Phishing
- Tricking someone into entering their login details on a fake copy of a real site.
- QR login
- Discord's feature for logging in on a computer by scanning a code with the phone app. Abused to take over accounts.
- Token
- The secret code a device holds that keeps it logged in to an account. Whoever has a copy is logged in too.
- Two-step verification
- A second proof of identity at login, usually a code from an app. Often written 2FA. It does not protect a login that is already open.
- Wallet drainer
- A fake site that, once a cryptocurrency wallet is connected to it, transfers out everything the wallet holds.
Sources
- Discord, "Securing Your Discord Account". discord.com
- Black Hills Information Security, "How to Not Get Scammed on Discord". blackhillsinfosec.com
- Malwarebytes, "'Can you try a game I made?' Fake game sites lead to information stealers", January 2025. malwarebytes.com
- NordVPN, "Discord scams that can steal your data". nordvpn.com
- TRM Labs, "Analysis of Recent NFT Discord Hacks Shows Some Attacks Are Connected", 2022. trmlabs.com
- Decrypt, "NFT Artist Beeple Warns Discord Members of Wallet Drainer Exploit", 2022. decrypt.co