Discord scams in 2026: the nine that actually work and how to spot each one

Most Discord scams in 2026 want one of three things: your login session, a file run on your computer, or money sent where it cannot be pulled back. The nine below are the patterns that keep turning up, from fake Nitro gifts and QR-code logins to fake verification bots and hijacked invite links, each with what it looks like, the tell and what to do. After that: the account settings that blunt all of them, recovery steps if you were already hit, and what server owners can switch on today.

The scale is not small. Discord's 2026 Transparency Report, covering March 2025 to March 2026, says Discord took action on 3,084,168 accounts for Deceptive Practices (malware, phishing, credential theft and financial scams), and separately disabled 47,832,832 spam accounts.

The quick version

The nine Discord scams that are actually common

1. Fake Nitro and Steam gifts

What it looks like: a DM or a channel message saying someone gifted you Nitro, or that a friend is giving away a $50 Steam gift card. The link goes to a page that copies Discord's or Steam's login screen. Discord's Safety Center uses "dliscordnltro.com" as its example.

The tell: a genuine Nitro gift sent inside Discord shows an Open gift button and an Accept gift confirmation in the app, according to Discord's gift claiming FAQ. It never sends you to log in on another site. A real Steam gift arrives in your Steam account, not via a login page someone linked. Discord also says it has "never created a bot designed to offer you free products", so a bot DM offering Nitro is a scam by definition.

What to do: do not log in. Report the message (right-click or long-press, Report Message); if a friend sent it, assume their account is compromised (scam 6).

2. QR-code login takeover

What it looks like: "Scan this to claim your reward" or "scan to verify you are human". The code is a real Discord login code generated on the scammer's computer. Scan it and tap Log in, and you have logged them into your account.

The tell: Discord's QR Code Login FAQ is direct: "Never approve a QR code login that you didn't generate yourself!"

What to do: hit Cancel on the approval screen. If you already approved it, Discord says changing your password logs out all devices at once, including the scammer's.

3. "I accidentally reported you" and fake Discord staff

What it looks like: someone, often a friend, says they reported your account by mistake and it will be banned unless you contact a "Discord staff member" right now. The "staff member" then walks you through "verification": a code from your email, an email change, a QR scan or a payment. As Bitdefender's February 2026 write-up puts it: "The objective is account takeover, not dispute resolution."

The tell: Discord's hacked-account article states that "Discord Staff will never contact users directly through the Discord app for support-related matters." Real messages from Discord carry an OFFICIAL badge, start with a system notice, and cannot be replied to. Real enforcement also shows up in User Settings → My Account → Standing; if it says "All good", there is nothing to appeal.

What to do: block both accounts and report them. Never read out a code from your email or authenticator to anyone.

4. "Try my game" and fake game-tester malware

What it looks like: a friendly DM asking you to beta test an indie game, sometimes with a slick website. You get a download link (Dropbox, Catbox or Discord's own CDN) and an archive password. Malwarebytes documented the installers dropping Nova, Ageo and Hexon stealers, which take Discord tokens, saved passwords, browser cookies, card details and crypto wallets.

The tell: the archive password. The usual reason to lock an archive is to stop security scanners looking inside.

What to do: do not run it. If you already did, treat the computer as compromised: scan it (Discord's support article recommends a Windows Defender scan on Windows), then change your Discord and email passwords from a clean device. A stolen token is a live login; a password change logs out every device and kills it.

5. Fake verification bots and "paste this to verify"

What it looks like: you join a server where everything is locked except a #verify channel. A bot asks you to click Verify, which opens a page that copies something to your clipboard and tells you to press Windows+R and paste, or to drag a "verification" bookmark to your bookmarks bar and click it on discord.com. Check Point Research traced exactly this flow in June 2025: a fake "Safeguard" bot, a lookalike site, a PowerShell command run through the Run dialog, and AsyncRAT plus Skuld Stealer at the end. KrebsOnSecurity reported the bookmark version, which silently sends your Discord token to the attacker.

The tell: no real verification asks you to run anything: not in the Run dialog, a terminal, your browser's console or a bookmark. Discord's Safety Center: "Never share or screenshare your authorization token. Seriously. Don't do it."

What to do: leave the server and report it. Legitimate captcha bots such as Wick and Captcha.bot have you solve a challenge in Discord or on their own site; Check Point also recommends checking for Discord's Verified App badge before authorising any bot.

6. Compromised friend accounts

What it looks like: a trusted friend suddenly sends a link, a game, a "vote for me" page, a crypto casino with free credits, or a request for money. Most scams above spread this way, because each stolen account messages its whole friend list.

The tell: tone. Different spelling, a different language, urgency, and a link within the first two messages.

What to do: check with them outside Discord before clicking anything, and report the messages so Discord can lock the account.

7. Crypto, NFT and fake giveaway scams

What it looks like: a "surprise mint" or airdrop in a project's own announcements channel, a giveaway you never entered, or an invitation into an "investment group". The Krebs-reported bookmark attacks worked this way: steal an admin's token, then post fake mint announcements leading to wallet-draining sites.

The tell: any request to connect a wallet, sign a transaction or pay a "release fee" to claim a prize. Discord's scam guidance flags anyone rushing you "to act fast or lose out on an offer".

What to do: confirm on the project's website before touching a link, even in its official server. Nobody, Discord included, can reverse a signed crypto transaction.

8. Commission scams aimed at artists

What it looks like: a client who wants to pay in Nitro gifts, gift cards or an unusual method, sends "too much" and asks for the difference back, or wants finished work before any payment. In the other direction, buyers get fake artists who take payment and block them.

The tell: pressure to skip your normal terms, and payment you cannot confirm has arrived and cleared.

What to do: take payment upfront or in milestones through a protected method, share watermarked previews until paid, and keep the whole conversation. If you paid in Nitro gifts and got scammed, do not file a chargeback: Discord warns that doing so with your bank for a Discord transaction "may result in account suspension pending further investigation", and the Safer Ways to Shop article says it "cannot mediate financial disputes" for unauthorised sellers. Use dis.gd/billing instead.

9. Hijacked vanity URLs and expired invites

What it looks like: an invite on a forum, a video description or an old directory page lands you in a server that looks right but asks you to verify through a bot (scam 5). Someone else has claimed the original link.

The tell: the server name in Discord's join preview does not match the community you were looking for, or the server is brand-new and everything is locked behind one #verify channel.

Why it happens: a Custom Invite Link (vanity URL) is only available at Boost Level 3, and Discord's support article says a server that loses its boosts loses the link after 30 days. Check Point found attackers re-registering those freed codes, and noted that "the Discord app sometimes gives users the false impression that temporary links have been made permanent", so expired ordinary invites were reused too.

What to do: paste an invite into a message to yourself first, so Discord shows the server's name and icon before you join. This is also why Discordfinder checks every listed invite every 15 minutes: an invite that stops resolving is marked broken, pulled from results and its owner gets a DM to fix it, so dead codes do not sit on a public page waiting to be claimed. A working invite is still not proof of ownership, so do the name check. Owners: a permanent invite link prevents most of this.

Lock your account down in ten minutes

Discord supports three MFA types: passkeys and security keys, authenticator apps, and SMS. It recommends security keys, warns that SMS "is better than no MFA, but not by a lot" because of SIM swaps, and only allows SMS once an authenticator app is set up. You can register up to 16 passkeys or security keys, per its passkey article.

Know the limits: MFA stops someone who has your password. It does not stop you approving a QR login (scam 2) or malware lifting your logged-in token (scams 4 and 5).

If you were hacked: the order that works

1. Check your email first. If the email on your account was changed, Discord sends the old address a "Discord Email Address changed" message with a Start Account Recovery button. The link always starts with https://discord.com/wasntme/ and works for 48 hours; it reverts the email, forces a new password, removes phone and MFA methods and logs the account out of every device, per Discord's email-change article. Support cannot send a new one if it expires.
2. Secure the email account itself with a new password and MFA, from a clean device.
3. Change your Discord password. This logs out all sessions, including stolen tokens.
4. Re-enable MFA and save fresh backup codes.
5. Deauthorize unknown apps in User Settings → Authorized Apps.
6. Scan the computer if you ran anything, before logging in on it again.
7. Warn your friends and servers that recent messages from you were not you.
8. File a report at dis.gd/hackedaccount if you are still locked out, listing any unauthorised charges. Discord's hacked-account article warns it "may be unable to assist" with accounts that were not secured.

One more fake: after the October 2025 breach at 5CA, a customer-service vendor, Discord said affected users would be emailed from [email protected] and "We will not contact you about this incident via phone."

For server owners: how to protect members

One compromised moderator account reaches thousands of people. The baseline from our AutoMod and permissions guide applies; these are the scam-specific additions.

1. Turn on Block Spam Content in Server Settings → AutoMod. It targets "unsolicited messages or advertisements (free Nitro)" and invite spam, learned from user reports. English only.
2. Add a custom keyword rule for scam phrasing. Each rule takes up to 1,000 terms of 60 characters, with * wildcards, and up to 10 regex patterns of 75 characters each (Rust syntax). Two useful starters: fr[e3]{2}\s*n[i1l]tr[o0] for "free nitro" spellings, and @(everyone|here).*https?:// set to alert only, since a mass ping with a link is the classic sign of a stolen account. Custom keyword rules can also time the sender out.
3. Consider Community. Every Community server gets Discord's suspicious link filter, which blocks known phishing and malware sites.
4. Open Safety Setup. Under Server Settings → Safety Setup → DM and Spam Protection, enable warnings before members visit outbound links, hiding DMs from suspicious users, filtering DMs from unknown users, and removing messages from suspected spammers. Set a verification level of at least Low, and require 2FA for moderation so a stolen mod password alone cannot ban or delete.
5. Audit permissions. Discord's Safety Center singles out webhooks, and notes that "any large and reputable moderation bot will never need admin permissions." Remove Manage Webhooks, Manage Server and Administrator from anyone who does not strictly need them.
6. Use Security Actions during an incident. When an Activity Alert fires, you can pause invites and pause DMs between non-friend members for a set time while you clean up.
7. Tell members what staff will never do (DM first, ask for codes, ask for a QR scan or a command) and put it in Rules Screening.
8. Protect your invite. A vanity URL goes 30 days after losing Level 3; keep a permanent invite as backup and update links everywhere when anything changes.

For bots, our moderation, anti-raid and support tags list live, health-checked options; the best Discord moderation bots ranks them.

Try it: before you click an invite from an old forum post, look the server up on Discordfinder. Every listed invite is re-checked every 15 minutes, and broken ones are pulled from results until the owner fixes them.