Discord Scams: Fake Nitro, QR Codes and Account Theft
On Discord, scammers almost always have the same goal: take over your account to then trick your friends. Here are the techniques actually used, and the reflexes that protect you.
Why Discord is especially targeted
- The audience is young and servers gather thousands of strangers: a single stolen account lets scammers message hundreds of people who trust it.
- The paid Nitro subscription is coveted: it has become the most-used bait on the platform, according to security vendors tracking these campaigns.
- Attacks using login QR codes and token theft work even when two-factor authentication is enabled: the password is never asked for.
Sources: Bitdefender — Free Discord Nitro scams and analyses published in 2025-2026 on Discord QR code scams.
The QR code scam: the most dangerous one
Discord lets you log in on a computer by scanning a QR code with the mobile app. Scammers display this QR code on their own computer, turn it into an image, then send it to you claiming it's a Nitro gift, a verification step to join a private room, or proof of an airdrop.
If you scan it with your phone, you're not opening a page: you're authorizing the scammer's computer to log into your account. They don't need your password or your two-factor code. Within seconds, they change the account's email, message all your friends, and if a crypto wallet is linked, drain it.
Simple rule: never scan a QR code sent by someone else. A legitimate login QR code only ever appears on your own screen, when you are the one trying to log in.
Other common scams
The fake Nitro gift
"You've received 3 months of Nitro!" The link opens a login page identical to Discord's. Anything you type there goes straight to the scammer. A real Nitro gift is claimed inside the app, and never asks for your credentials again.
The fake verification bot
Upon joining a server, a "bot" asks you to authenticate on an external site. Real verifications happen inside Discord, with a simple reaction click or button.
The fake Discord staff member
"Your account has been reported, confirm your identity within 24 hours or it will be deleted." Discord never contacts users by private message for this kind of verification.
The fake game to test
A "developer" offers to pay you to test their game. The downloaded file is a program that steals passwords saved in the browser and the Discord session token.
Real messages, word for word
- "Free Nitro for 1 month 🎁 scan the QR code to claim"
- "Hey, I'm giving you my Nitro, I'm switching accounts, log in here to claim it."
- "Mandatory server verification: click the link to prove you're not a bot."
- "Discord Staff: your account will be deleted within 24 hours, confirm your information."
- "Can you test my game? I'll pay you $20, download the file here."
Warning signs
- You're sent a QR code to scan "to verify your account" or "claim your Nitro".
- A free Nitro link that opens a Discord login page: the real app never asks for your credentials this way.
- The site's address resembles Discord without being it: discorcl.gift, discord-nitro.ru, dlscord.com.
- A "moderator" or "member of Discord staff" messages you privately: real staff never do this.
- A friend sends you an unusual link with no explanation: their account is probably stolen.
- You're asked to download a .exe file, a "game in testing", or an "anti-cheat" tool.
- You're pressured: "offer valid for 10 minutes", "first 100 only".
- You're asked for your two-factor code or a backup code.
What to do
- Never scan a QR code you received in a private message, even from a friend.
- Only log into Discord through the app or by typing discord.com yourself.
- Enable two-factor authentication and keep your backup codes offline.
- If your account is stolen: change the password, then log out all devices (Settings → Devices) — this is the step that cuts off the scammer's access.
- Warn your servers and friends to ignore messages sent under your name.
- If you downloaded a suspicious file, scan your computer and change your passwords from another device.
Frequently asked questions
Does two-factor authentication protect me from everything?
No. It blocks password theft, but not login QR codes or token theft by an installed program. The right reflex remains: never scan, never download.
My friend sent me the link, so it's not a stranger.
That's exactly how it spreads: their account was taken over before yours. Message them outside Discord to confirm.
I scanned the QR code, what should I do right now?
Change the password, log out all devices, check the email address linked to the account, and if a crypto wallet was linked, immediately transfer the funds to a new wallet.
Does a Discord message seem suspicious?
Paste it into our tool, choose the "Discord" channel, and get a verdict in seconds.
Check a suspicious messageUne personne sur deux a déjà reçu ce type de message. Partagez avant qu'elle ne tombe dans le piège.
Envoyer ce guide sur WhatsAppSee also: Telegram Scams · Instagram Scams