Discord scams
Last updated September 18, 2026
The short answer
Discord scams spread through compromised friends: a free Nitro link, a "play my new game" download, or a QR code to scan. The download usually steals your Discord token, which gives account access without your password and without triggering two-factor.
Discord is built for trust inside servers and friend lists, which makes a compromised account a broadcast weapon — the message comes from someone you actually know, in a server you actually belong to. The technical detail that makes it self-sustaining is the token: a stolen session token grants account access without needing the password, and two-factor does not stop it, which is why "I changed my password" so often fails to end the problem.
How Discord scams work
- 1
Free Nitro phishing
A message from a friend offers free Discord Nitro through a link. The page is a fake Discord login that captures credentials, or a token stealer.
- 2
Token stealers as game builds
A "developer" asks you to test their game and sends a download. The executable extracts your Discord token, giving account access that survives a password change until sessions are invalidated.
- 3
QR code login hijacking
You are asked to scan a QR code for a giveaway or verification. Scanning with the Discord app logs the attacker into your account — the code is Discord's own remote-login QR.
- 4
Crypto and NFT server scams
Compromised or impersonated server accounts announce a mint or airdrop, linking to a wallet drainer.
Warning signs
- A friend sends a link out of the blue, especially for free Nitro
- You are asked to download and run an executable to test a game
- Anyone asks you to scan a QR code with the Discord app
- An "official" announcement of a mint or airdrop with a countdown
- A moderator DMs you first about a problem with your account
- A login page is not on discord.com
- Your friends report messages from you that you did not send
Examples
The game that took the token
A user is asked by a server contact to test an indie game build. The executable runs, shows a crash, and quietly extracts the Discord token. The account then sends the same request to 200 friends. Changing the password does nothing until all sessions are invalidated.
Scan to verify
A giveaway asks entrants to scan a QR code to verify their account. The code is Discord's own remote-login QR. Scanning it logs the attacker in directly, with no password and no two-factor prompt involved.
What to do
- Never run an executable someone sends you, however well you think you know them.
- Never scan a QR code at anyone's request — it is a login, not a verification.
- If compromised, change your password AND log out of all devices to invalidate tokens.
- Turn on two-factor, which protects logins even though it does not stop token theft.
- Warn your friend list, since the account will be used to phish them.
- Check Authorised Apps in settings and revoke anything unfamiliar.
Report it to Discord
Report accounts and servers through Discord Trust & Safety. After a compromise, change your password and log out of all devices to invalidate stolen tokens.
Getting your money back
Change the password and then log out of all devices — this is the step that matters, because a stolen token keeps working after a password change until sessions are invalidated. Revoke authorised apps, turn on two-factor, and run a malware scan if you executed anything. Warn your servers and friend list, since the account has been messaging them. If a crypto wallet was connected to anything during the compromise, revoke approvals at revoke.cash and move assets to a new wallet.
Frequently asked questions
What is a Discord token and why does it matter?
It is the credential your client uses to stay logged in. Someone who steals it has your account without needing the password, and two-factor authentication does not stop them — which is why a password change alone does not end the compromise. You must also log out of all devices to invalidate existing tokens.
Is free Nitro ever real?
Discord and some partners do run genuine promotions, but they are redeemed inside Discord, never through a link in a DM. A friend sending a free Nitro link is almost always a compromised account broadcasting to its entire friend list.
Why is scanning a QR code dangerous?
Discord's QR code is a remote login. Scanning one with the app logs that device into your account immediately, with no password and no two-factor prompt. There is no legitimate reason for a giveaway, a moderator or a friend to ask you to scan one.
Other companies scammers impersonate
Scams reuse their scripts across brands. If you were contacted about Discord, these are the guides worth reading next.