Most Discord scams do not break anything. They persuade you to hand something over: a login, a token, a QR scan, a download. That is good news, because it means the defence is mostly recognition. Once you know the handful of shapes these scams take, the new variants stop looking new.
Streamers have more at stake than most users. Your account is attached to a community that trusts links you post, so a compromised streamer account is worth far more to an attacker than a random one. This guide covers how the scams work, the ones circulating now, and how to lock down both your account and your server.
How nearly every Discord scam works
The pattern is social engineering. The scammer either offers you something (free Nitro, a prize, a paid opportunity) or invents a problem only you can fix (your account was reported, your payment failed). Then they push you toward one action: click this link, scan this code, run this file, log in here.
The prize is usually your account token, the credential that keeps you logged in. A stolen token lets an attacker act as you without your password, and it is why a hacked account can start messaging your friends within minutes. Those friends see a familiar name, trust it, and the cycle repeats.
The scams to know
“Can you test my game?”
The most effective scam right now arrives from someone you know. A friend’s hijacked account messages you about an indie game they made, or a playtest with limited slots, and asks you to download a build. The file steals your token, saved passwords and often crypto wallet data, then uses your account to send the same message to everyone on your friends list. Security researchers flagged a wave of these fake playtest invitations across Discord, Steam and YouTube in early 2026, sometimes run by attackers who spend weeks building rapport first.
The rule is simple: if a friend sends an unexpected download, confirm it with them somewhere other than Discord before opening anything. A text message or a call takes thirty seconds.
Free Nitro and gift links
A message offers free Nitro and links to a page that looks like Discord and asks you to log in. Some versions ask you to “link your Steam account” instead, and steal your Steam login on a fake page. Real Discord gifts use the discord.gift or discord.com domains and appear in chat as a distinctive gift embed, not as a plain link to an unfamiliar site. If it is not that embed, treat it as a scam.
QR code “verification”
You join a server, often through a link promising something enticing, and are asked to verify by scanning a QR code with the Discord mobile app. That QR code is a login request. Scanning it signs the scammer into your account on their device. Discord’s QR login is only for logging yourself into your own desktop, never for verifying anything in a server.
Fake Discord staff and “you’ve been reported”
A message claims your account was reported or is about to be banned, and offers a way to appeal that runs through a link, a login or a “support agent” on another account. Some versions come from an account posing as a friend who “accidentally reported you” and hands you a contact to sort it out. Discord does not handle account issues this way. An official system message carries a staff badge and a system tag, and never asks for your password or token. You can check your real standing at any time under User Settings, Privacy and Safety, Standing.
Fake sponsorships and brand deals
This one targets streamers specifically. A “brand” or “agency” offers paid promotion of a game or product, and the next step involves downloading a press kit, installing the game from a private link, or signing in through a portal they host. Real sponsors send contracts and briefs, and pay through established channels. They do not need you to run an executable from a file-sharing link. If an offer arrives in your DMs rather than your business email, check the company’s official site and contact them there before doing anything. Our guide to getting sponsored as a streamer covers what legitimate offers look like.
Fake cheats, mods and early builds
Free cheats, unlocked mods and leaked builds are a reliable way to distribute information-stealing malware, and they are often shared in Discord servers. Even official storefronts are not a guarantee: Steam removed a free game called BlockBlasters after it was found to drain crypto wallets, and a streamer was reportedly among those who lost money. Only run software from its developer’s official page, and keep anything that holds money off the machine you test sketchy files on.
Crypto, NFT and celebrity giveaways
A server or bot announces a giveaway, often using a famous creator’s name and sometimes a deepfaked clip, and asks you to connect a wallet or send a small deposit to claim. A genuine giveaway never requires you to pay or connect anything. Scammers also post these as images rather than text, specifically to slip past keyword filters.
Phishing emails
Not every scam starts inside Discord. Emails warning about an expiring Nitro subscription, a report on your account or unusual login activity link to lookalike login pages. Go to Discord directly instead of following the link.
Lock down your account
- Turn on two-factor authentication from User Settings, My Account. Use an authenticator app rather than SMS, which can be intercepted through SIM swapping.
- Use a unique password, and secure the email account behind Discord just as carefully, since it is the recovery route.
- Limit who can message you. Under Privacy and Safety, turn off direct messages from server members for large servers you do not moderate.
- Review Authorized Apps in your user settings and remove anything you do not recognise or no longer use.
Understand the limit of two-factor authentication. It stops someone who has your password. It does not stop someone who has your token, because a token is an already-logged-in session. That is why the download-based scams above work even on accounts with 2FA enabled, and why not running unknown files matters as much as any setting.
Protect your community
If you run a server, your security decisions protect everyone in it.
- Publish one official invite and keep it current on your stream panels and socials, so members can spot impostor servers.
- Keep admin permissions tight. Few people need Administrator, and every account that has it is a way to wreck the server if compromised. Require moderators to use 2FA.
- Filter links and invites with AutoMod and a moderation bot, and hold messages from brand-new accounts. Our guide to Discord bots covers how to set this up without over-granting permissions.
- Tell your community what you will never do: DM them about giveaways, ask them to scan a QR code, or send them a download. Pin it. If your account is ever compromised, that message does your warning in advance.
If you have been scammed
Move quickly, and do it from a device you trust. If you ran a suspicious file, assume that machine is compromised and use a different one until it has been cleaned.
- Change your Discord password, which also invalidates existing tokens, and reset two-factor authentication.
- Change the password on your email and on any account that shared the old password.
- Remove unfamiliar entries from Authorized Apps.
- Warn your friends and your server that recent messages or links from you may be malicious.
- If you cannot get back in, submit a ticket through Discord’s hacked account form at dis.gd/hackedaccount, with screenshots, usernames and timestamps.
- If money or card details were involved, contact your bank or payment provider straight away.
Report the scammer’s account to Discord and block it, and report the server if the scam came from one.
Common questions
Will Discord staff ever DM me?
Official system messages are marked with a staff badge and a system tag, and they never ask for your password, token or a login through an outside link. Anything else claiming to be Discord staff is not.
Can I get hacked just by clicking a link?
Usually the damage comes from what you do next: logging in on a fake page, scanning a code or running a download. Clicking is still the first step in almost every scam, so check where a link actually goes before you open it.
My friend sent me something strange. What do I do?
Do not open it, and contact them outside Discord. If their account is compromised, they may not know yet.
Does two-factor authentication make me safe?
It makes you much safer against stolen passwords, but not against token theft from malware or a scanned QR code. Pair it with caution about downloads and logins.
Where to go next
Server security depends on the tools you let in, so read our guide to Discord bots before adding any. Your stream chat needs the same care, covered in Twitch mods. For growing the community you are protecting, browse the growth guides.
