Discord scams: how Nitro phishing works and how to protect your members

How the scams work

• Fake Nitro — “You received Nitro for 3 months” with a link to a login page that copies Discord’s. The login sends the token to the attacker.
• Free games and skins — a Steam or game-key giveaway that asks you to “sign in with Discord” on a third-party site.
• QR code scams — “scan this to verify” leads to Discord’s own login QR, which grants the attacker a session.
• Hacked-account DMs — the scam arrives from a friend’s account, which is why people trust it.
• Malware disguised as a mod or cheat — a download that steals tokens from the Discord client directly.

Why hacked accounts are worse than bots

A bot account is easy to spot: no avatar history, no mutual servers, a name full of numbers. A hacked account has your member’s name, their roles and their friends. It can ask staff for help, post in channels that require verification, and DM people who have known it for years.

That is also why “ban the account” is not the whole fix. The person behind it is a victim, and they need to know what happened and how to get their account back.

What the links look like

• A domain that is almost right: discord-nitro.com, dlscord.gift, steamcommunlty.com.
• Urgency: “expires in 10 minutes”, “only the first 50 people”.
• A login page with no address bar check, or a Discord login inside an iframe on a non-Discord domain.
• A request for a QR scan, a password, or a “verification code” that is actually a 2FA code.

Server defences that work

You cannot stop a member from clicking a link in a DM. You can make the server a place where the link does not spread.

• Turn on the scam filter: /automod toggle enabled:true, then check /automod scam is on.
• Block links for members without a role, or allow only the domains you trust with /automod links.
• Limit mentions so a compromised account cannot ping the whole server at once: /automod mentions.
• Use a honeypot. Compromised accounts and spam bots often post in the first channel they see; /honeypot setup catches them before the message reaches anyone.
• Keep a pinned warning in #general with the three things real Discord will never ask for: your password, your 2FA code, or a QR scan to “verify” a server.

When an account is compromised

• Remove its roles and ban it with a clear reason, so it cannot post while the owner recovers the account.
• Delete the messages it sent in the last day, including in DMs you can see — /purge handles channels, and a ban with delete_days:1 clears recent history.
• Tell the owner out of band — a mutual friend, another server, anything that is not the compromised account.
• Ask them to change their Discord password, enable 2FA, and remove any authorised apps in User Settings → Authorised Apps. Changing the password ends existing sessions.
• If a staff account was hit, treat it as a nuke attempt: check the audit log for deleted channels, new webhooks and permission changes.

Teach members in one message

One short pinned message does more than a security channel nobody reads: “Lyx and Discord will never DM you a Nitro link. If a friend sends you one, their account is compromised — do not click it, and tell us.”

Repeat it after every wave. Scams work on people who have not seen the pattern before, and there are always new members who have not.