Was Your Discord Account Hacked? Account Security and Recovery Guide

Signs That Your Account Has Been Compromised

Account takeovers often start quietly. The attacker initially uses the account for their own gain and saves locking you out for later. A single sign listed below isn't definitive proof on its own, but if you notice multiple, move on to the next section immediately.

• Your friends report receiving a link or a "free Nitro" message from you that you didn't send.
• You received an email from Discord stating that your account's email address or password was changed.
• Your password is no longer accepted, or you've been unexpectedly logged out.
• You see servers you didn't join, friend requests you didn't send, or unfamiliar direct messages.
• There is an application you didn't authorize in the Authorized Apps list under User Settings.
• If you're a moderator, audit logs attribute bans, channel deletions, or role changes to your account that you didn't perform.

What to Do in the First 15 Minutes If Your Account Is Compromised

Order matters. Working on other tasks before ending the attacker's active session gives them precious time.

1. Change your password. Discord's account safety page notes that changing your password invalidates your current session token and logs out all devices. If you can't log in, use the password reset link ("Forgot your password?") on the login screen.
2. Check your email inbox. According to Discord's Help Center, when an account's email address is changed, a notification is sent to your old email address, containing a link to revert the change. Reverting it will log out all devices. Also change your email password—resetting a Discord password is easy if someone has access to your email.
3. Enable two-factor authentication (2FA). Steps are outlined in the section below. A password alone isn't enough; if your password gets stolen again, 2FA protects your account.
4. Clean up authorized apps. Discord's article on compromised accounts recommends reviewing the Authorized Apps list in User Settings and deauthorizing anything unrecognized. Revoking permissions cuts off account access granted to that app.
5. Scan your computer. If your account was hacked after running a file or command, the problem might be malware on your device. Info-stealing malware often targets Discord sessions. In that case, your new password could be stolen too—don't just change your password without running a full scan with your antivirus software.
6. Warn your network. Tell your friends not to click any links sent from your account. Discord's security page reminds users that a compromised moderator account can ban members or delete messages, channels, and roles. Inform staff members of any servers where you hold staff roles.
7. Contact Discord Support. If you cannot access your account or if the attacker enabled their own 2FA, open a ticket via the compromised account form.

It's important to understand a key limitation: as Discord explains, if you lose access to both your authenticator app and your backup codes, Support cannot remove 2FA for you or generate new backup codes. That is why keeping these codes safe is crucial to recovering your account.

How to Set Up Two-Factor Authentication

Discord now refers to this feature as Multi-Factor Authentication (MFA). The setup article in the Help Center lists three methods: a security key or passkey, an authenticator app, and SMS. Discord recommends security keys first, though the most common method is an authenticator app.

1. Open User Settings > My Account in Discord.
2. Start the authenticator app option. Discord will prompt you for your password.
3. Scan the QR code on your screen using an authenticator app on your phone, or manually enter the secret key provided. Apps like Google Authenticator and many password managers support this.
4. Type the code generated by the app into Discord. According to Discord, this code refreshes every 30 seconds.
5. Immediately save the backup codes provided at the end of the setup in a safe place.

Discord offers another warning: not all authenticator apps sync across devices. If you lose your phone, your 2FA codes might be lost too. If you use an un-synced app, backup codes are your only way back in.

Backup codes

Backup codes are single-use recovery codes. Discord recommends storing them in a password manager. If you lose your backup codes but are still logged in, you can generate a new set via My Account > View Backup Codes. You will be prompted for your password, and generating a new set invalidates all old codes. Keeping codes as a screenshot on your phone won't help if your phone is lost.

SMS and passkeys

SMS backup can only be added after app-based 2FA is enabled. Discord's safety page notes that SMS authentication is less secure than app authentication. The Help Center points to SIM swap attacks as the primary reason: an attacker could trick your carrier into transferring your phone number to their own SIM card.

Passkeys unlock your account using biometric verification (fingerprint, facial recognition) or your device PIN. According to Discord's March 2026 blog post, you can add up to 16 passkeys to an account, and adding a secondary passkey as a backup is recommended. The same post notes that enabling any multi-factor authentication method disables login verification emails.

The Most Common Types of Scams

Most accounts aren't stolen through password guessing, but by tricking users into taking action. The table below summarizes the four most common methods.

Fake Nitro and gift links

These messages frequently come from a hijacked friend's account, making them look convincing. The link leads to a domain that mimics Discord. Examples given by Discord include typosquatted domains like diiscrd.com or dlscord.com (using a lowercase "l" instead of an "i"). The same page highlights that a padlock icon in the address bar and an https connection do not guarantee a website is authentic. If you need to log in, don't click the link—type the official URL manually.

QR code login trap

Discord's QR code scanner is solely meant for logging into your account on another device. When you scan a QR code sent by someone else using your Discord app, you approve the session on the browser that generated the code. According to Discord, this allows an attacker to bypass both your password and 2FA. The QR Code Login FAQ explains that if you accidentally approve a login, changing your password will log out all active sessions.

"I accidentally reported you" scam

According to Bitdefender's February 2026 report, the scam unfolds like this: someone you know from a shared server—sometimes after chatting for months—claims they accidentally reported your account and that it will be banned. They might show a fake screenshot of a support email. Next, they direct you to a user claiming to be "Discord Support." This user asks for a verification code sent to your email or asks you to change your account email address. The moment you share the code or update your email, your account is gone.

Recognizing the scam is simple: Discord never resolves reports through DMs and will never ask for your code or password. If a friend sends this message, their account was likely compromised. Contact them through another medium, such as phone.

Fake bot verification servers

Check Point Research's June 2025 report describes a prime example of this technique. Attackers claim expired or deleted invite links as custom vanity URLs for their own malicious servers. Users clicking the old link land on a server where only a channel named "verify" is visible. A fake bot named "Safeguard" requests verification and redirects the user to a Discord-like site. The site shows an intentionally failing CAPTCHA prompt that instructs the user to open the Run window (Win+R), paste the copied command, and hit Enter. The clipboard-hijacked command downloads malware identified in the report as AsyncRAT and Skuld Stealer.

The golden rule: you should never have to paste anything into the Run window, terminal, or browser console to join a server. Any site asking you to do so is an attack.

For Server Owners: Staff Account Security Is Server Security

When a staff account is hijacked, the attacker inherits all permissions assigned to that user. Server security therefore begins with staff account security.

• 2FA requirement for moderation. According to Discord's safe server guide, server owners can enable 2FA requirements under Server Settings > Safety Setup. The server owner must have 2FA enabled on their own account to turn this on. When enabled, staff members without 2FA cannot perform sensitive administrative actions listed on Discord's permissions page (Administrator, Kick Members, Ban Members, Manage Channels, Manage Server, Manage Roles, Manage Messages). This requirement does not affect regular members.
• Link filter. Compromised member accounts often spam fake links across servers. Discord's built-in AutoMod or a bot can block these messages. When VeyroBot's AutoMod link filter is enabled, messages containing links starting with http or https that do not match whitelisted domains are blocked using Discord's native AutoMod rules; invite links can be blocked via a separate filter. Staff roles with the Manage Messages permission are exempt from this filter; therefore, the link filter won't stop a compromised staff account, which is why requiring 2FA is essential. Setup details can be found in our AutoMod setup guide.
• Outdated invite links. The attack described in the Check Point report targeted expired invite links left on websites and forums. Periodically check that invite links published on promotional sites still point to your server.
• Principle of least privilege. Do not give Administrator permissions to everyone. If a staff member's account is compromised, potential damage will be confined to that account's assigned permissions. Check our server security audit article for a checklist, and our first 30 minutes guide when a server is nuked for worst-case scenario protocols.

Frequently Asked Questions

Will changing my password log the attacker out?

Yes. According to Discord, changing your password invalidates your current session token and logs out all devices. However, if the attacker can intercept your new password—such as through malware installed on your device—the issue will persist. Clean your device first.

I lost my backup codes and phone, will Discord remove two-factor authentication?

According to Discord's help article, no. Support cannot remove 2FA or generate new backup codes under these circumstances. If you are still logged into your account on any device, generate a new set of backup codes from there immediately.

I received a message with an OFFICIAL badge, is it trustworthy?

Official system messages from Discord appear in-app with an OFFICIAL badge and cannot be replied to. Any account without this badge asking for codes or expecting a reply is not Discord.

Last updated: October 9, 2026. Information sourced from Discord's Help Center (articles on multi-factor authentication, compromised accounts, QR login, and official system messages), Discord security pages, Check Point Research's June 2025 report, and Bitdefender's February 2026 advisory. Discord menu names may vary depending on app version.