Safety guides
“Free” Nitro, Steam and skins
The trap
A message —sometimes from a friend whose account was stolen— gives you Nitro, skins or money through a link. The page copies Discord or Steam and asks you to log in.
What to do
- Discord does not give Nitro away by direct message. Real gifts are discord.gift links that open inside the app.
- Read the domain letter by letter: dlscord, discorcl, steamcommunlty… are fake even if they look right.
- If a friend sent it, ask them some other way: their account may be stolen and the message is not theirs.
- Never log in from a link you got in a message. Type the address yourself.
If you already fell for it
Change your password now: that ends every session and voids what was stolen. Then turn on two-factor authentication and tell the server staff.
QR codes to “verify” you
The trap
A bot or a website asks you to scan a QR code with the Discord app to verify or claim a prize. That QR is Discord’s login: scanning it hands your account to whoever made it.
What to do
- Scanning a QR code with the Discord app does exactly one thing: log in on ANOTHER device.
- Axis never asks for a QR code. Its verification is a button and a page in your own browser.
- If the app asks “Log in on a new device?” and it wasn’t you, tap no.
If you already fell for it
Change your password (it ends every session) and check Settings → Devices: log out anything you don’t recognise. Turn on two-factor authentication.
Two-factor authentication
The trap
With only a password, anyone who gets it walks in. Passwords leak from other sites and then get tried everywhere.
What to do
- Settings → My Account → Enable Authenticator App. Use an app (Aegis, Google Authenticator, Authy) rather than SMS.
- Keep your backup codes off your phone: on paper or in a password manager.
- Use a password for Discord that you use nowhere else.
- If you’re staff: the server can require 2FA to moderate (Server Settings → Safety).
If you already fell for it
If you already have it: check today that you know where your backup codes are. Without them, losing your phone means losing the account.
My account was stolen
The trap
Your account sends messages you didn’t write, your email changed, or you can’t log in anymore.
What to do
- If you can still log in: change your password now. That voids the stolen access and ends every session.
- Turn on two-factor authentication and check Settings → Authorized Apps and Devices: remove anything you don’t recognise.
- If you can’t log in: use “Forgot your password?” and, if they changed the email, contact Discord support (dis.gd/contact).
- Warn your friends and the staff: whoever took it will be sending links as you.
If you already fell for it
Meanwhile, staff can quarantine your account with Axis so it can’t do damage in the server. Ask them to.
“Try my game”: files that steal accounts
The trap
Someone asks you to test their game, a program or a “Nitro tool”. The file (.exe, .scr, .bat, a password-protected .zip) steals your Discord session, the passwords saved in your browser and your wallets.
What to do
- Don’t run programs someone sent you on Discord, even from a friend.
- A password-protected .zip exists so antivirus can’t look inside. That’s the tell.
- Only download software from its official site or stores like Steam.
- “Looking for paid testers” and “private beta” are the usual script.
If you already fell for it
Disconnect that computer from the internet and run an antivirus. From ANOTHER clean device change every password, starting with your email, and turn on two-factor authentication.
Fake bots, apps and the console
The trap
A fake “verification bot” asks you to authorize an app with too many permissions, or to paste code into the browser console (Ctrl+Shift+I). That code sends your session to someone else.
What to do
- Never paste anything into the browser console. Discord itself warns you there, in red.
- Before authorizing an app, read the permissions. “Join servers for you” or “read your messages” aren’t needed to verify you.
- Axis verification only asks to identify your account (and to see linked accounts if the server turns that on). Never to join servers or read messages.
- Check Settings → Authorized Apps now and then and remove what you don’t use.
If you already fell for it
Remove the app in Settings → Authorized Apps. If you pasted something into the console, change your password now: that voids the stolen session.
Fake Discord or server staff
The trap
“Discord Trust & Safety” or a moderator messages you: you’re about to be banned over a report and must talk to “support” to avoid it. Then they ask for details, codes, a QR code or a payment.
What to do
- Discord doesn’t threaten you with a ban by direct message. Its notices arrive as system messages with the official badge.
- A real moderator never asks for passwords, codes, QR codes or payments.
- Check their role in the server: names and avatars can be copied; roles can’t.
- Report the message and tell the server’s real staff.
If you already fell for it
Change your password now: that ends every session and voids what was stolen. Then turn on two-factor authentication and tell the server staff.