February 3, 2022

Scams and What to Look out for

Editor's Note: Check out our latest article for the most up to date information on common scams and how to protect yourself here.


It’s always a good idea to be aware of what an impersonator trying to scam you looks like. Sometimes that impersonation is easy to spot — one way is if this person newly-DMing does not share any mutual servers with you or you don’t have a DM history with them.

However, this isn’t a foolproof way to rule out impersonators: the most determined of hackers will employ tactics that include targeting the friends list of an account they have already taken over and pretending that they are your friend.

Let’s go over some of the methods that hackers may use to target you on Discord and how you can apply the methods we discussed in the Protecting Against Scams on Discord article to make sure you don’t fall prey to their schemes.

Fake Games, Programs, Videos or Downloads

In this situation, a user pretending to be your friend, or using a friend’s compromised account, reaches out asking you to check out their video, test a game they made, or practice running code they wrote. No matter the backstory, they’ll always ask you to download a program or click a link they provide, resulting in a malicious program entering your computer and/or compromising your account.

A suspicious Discord user sending a message that says "gi, hi" then sending two files called "Not a Virus dot Zip."

Another variation of this scheme involves a user asking you to “test” something for them, directing you to open the developer tools on your internet browser while logged into the web app. They’ll then ask you to show them your token — do not do this. With your token, malicious users can sign in and take over your account.

Discord will never ask you for your token, and you should never have any reason to open Discord’s Developer Console in the first place. Note that this is only applicable to Discord on your internet browser, and not the desktop or mobile application.

Fake Giveaways/NFT Drops

This is similar to the previous scheme in that usually it is, again, a trusted individual that DMs you. Sometimes it's in the form of a well-known bot or under the facade that they are an administrator for a server that you're active in. It may involve very genuine-looking links to websites as well. Like we said, if it's too good to be true, it likely is.

Discord Impersonation for Partner/Verified/HypeSquad

Discord impersonation involves a hacker pretends to be messaging you from an “official Discord account” and offer entry to one of our community initiatives, such as the HypeSquad or Partner programs.

This is nearly always fake. Below are two screenshots, both of which present themselves as official Discord-sent messages. However, of these two conversations, only the right screenshot is actually from Discord.

Two Discord messages side by side. On the left, a regular user is attempting to act like a Discord Employee to try and obtain personal information. On the left, a real Discord message has a verification checkmark that says "System" next to it, to prove it's a real message. Under the official message is a banner that says the following: "This thread is reserved for official Discord notifications. Discord will never ask you for your password or account token."

On the right, you can note the blurple “System” tag next to the sender’s name, as well as the Reply space being replaced with a unique banner that only official system messages come with.

The DM on the left does its best to be convincing though. It even sends an invite link to a real Discord-run server called Discord Testers and a somewhat-real-looking link to the supposed Discord Hypesquad form. Scammers will use a technique of mixing real Discord invite links (to public Discord servers usually) with their malicious links in order to portray legitimacy and lull you into a false sense of security.

A Discord message window. A button that says "Report Spam" is highlighted next to the user's name.

If you suss out that a DM is a fake, report it as Spam using the red “Report Spam” button at the top of the DM.

This feature is one of many improvements that we’re working on to help identify and remove bad actors as soon as we’re aware of them.

Free Nitro Scams

One of the oldest scams is the temptation of “free Nitro.” While we can’t discount people who may be truly full of generosity and believe in gifting Nitro, getting a random DM from a stranger claiming to have chosen *you* for a Nitro giveaway is incredibly sus, and most likely a scam.

Discord will never ask you to scan a QR code in order to redeem a Nitro code. Do NOT scan any QR codes from people you don’t know or those you can’t verify as legitimate.

If you ever use QR Code Login to sign in to Discord, make sure you’re using the desktop app, or if you’re on the web app, that your URL bar says “https://discord-webhook-relay-6q9nx.thz.cool/login” exactly as it's written.

The above tactics are some of the ways that scammers may attempt to socially-engineer you into giving up your information. Even if you don’t click any of their links, it's best to simply block and report them to us, rather than engage further.

We encourage you to share this article with friends who may not be as informed as you — when everyone’s aware, our communities are safer than ever. Here’s a quick link back to Protecting Against Scams on Discord too.

Stay safe out there!

Tags:
Account Security
Server Safety
User Safety

Lorem Ipsum is simply