How phishing spreads on Discord

A Discord phishing message does not always come from a brand-new account with a nonsense name. It may come from someone already in the server whose account has been taken over. The avatar, account age, and shared servers can all look normal.

Treat the request itself as the clue. An unexpected gift, urgent account warning, or private offer of support deserves a second look, even when the sender seems familiar.

One common message offers free Nitro or asks you to “verify” by scanning a QR code. Discord’s QR scanner is used to approve a login on another device. Scanning and approving a code that somebody else supplied can let them into your account without giving them your password.

Discord covers this in its account security guidance. If you approved a suspicious QR login, change your Discord password through the real app or website. Discord says this invalidates the current account token and signs the account out on other devices.

Do not scan a second code that promises to cancel the first one.

Scammers watch public help channels and reply to people who are already looking for assistance. They may copy a moderator’s name, invite you to a separate server, or send a fake support page.

Use the server’s published support route. If a moderator appears to contact you privately, check with the team in a channel you already know. Never give a password, backup code, wallet recovery phrase, or login approval to someone in a conversation.

Another version of the scam asks you to download a “test build”, install a verification tool, or paste a command. Discord’s own scam prevention advice warns against running unfamiliar programs or code.

When a scam appears in a server

Report the message with Discord’s built-in controls. Its reporting guide shows where those controls are on different devices.

Tell the server moderators where the post appeared. If the message includes a phishing website, copy the URL without visiting it and send it to Phish Takedown. Mention that it came from Discord and describe what the page or message asked users to do.

Avoid posting the live phishing link in a public warning. A screenshot or a plain description of the lure lets members know what to avoid without giving the site more clicks.

Save the message link and enough context to understand the incident, then remove the scam post. If the account is compromised, contain its permissions while you contact the owner through a route you trust.

Check whether the same message was posted elsewhere and whether a webhook or bot was involved. Review powerful permissions rather than only banning the visible account. Discord recommends auditing server permissions and keeping official invite links current.

Tell members what happened in direct language: what the message claimed, what members should avoid, and what to do if they interacted with it. There is no need to repeat the scammer’s sales pitch.

ScammerSlammer can identify known scam links and offenders across participating servers. It helps with detection, but new campaigns still require reports and moderator judgement.

If it caught you out

Change the affected account password through Discord, review authorised apps and active sessions, and check whether your account sent messages you did not write. Let server staff and recent contacts know if a scam was sent from your account.

If you downloaded a file or approved access somewhere else, follow the wider phishing response steps. They cover device checks, reused passwords, payment details, and reporting.