How to spot a phishing attempt on Discord
Phishing means tricking you into handing over your account, your password or your data. On Discord it is one of the most common ways to steal accounts, and it almost always follows the same patterns. Once you know them, they are easy to avoid.
The example messages in this article are recreations made by FireFighter: the names and links are made up and don't lead anywhere.
1. Free Nitro and fake gifts
It's the oldest scam on Discord. You get a message, sometimes from a stranger and sometimes from a friend whose account has been stolen, giving you a month of Nitro. When you open the link, a website that imitates Discord or Steam asks you to log in. Whatever you type goes straight to the scammers.
Look, I'm giving you free Nitro for 1 month. Just link your Steam account and enjoy 🎁
dlscord-nitro.gift/claim2. "I reported you by mistake"
Someone messages you, very worried, saying they reported your account by accident. To avoid a ban, they ask you to talk to a supposed member of Discord's safety team, who is actually another scammer. Little by little they'll ask for your email, your password or for you to scan a code.
Sorry, I reported you by accident 😟 Discord told me you'll be banned in 24 hours. Talk to this moderator, he'll sort it out: Discord Trust & Safety#0001
3. QR codes and fake verification bots
A bot or a user asks you to scan a QR code with the Discord app to verify yourself or get a prize. Discord's QR code scanner is only used to log in, so by scanning it the attacker gets straight into your account, without needing your password or your two-step verification. Another variant is a bot that asks you to "authorize" an app to verify yourself, and that way gains permissions over your account.
4. Crypto casinos with MrBeast's face
In 2026 a wave of messages sent from stolen accounts spread. A friend writes just "Bro" and attaches screenshots: a supposed announcement of MrBeast's "crypto casino", a sign-up page and a transfer to a wallet. They promise a bonus of thousands of dollars that you can withdraw immediately. According to security company Bitdefender, those who fall for it end up downloading malware, connecting their crypto wallet, scanning QR codes or authorizing fake apps, and their account then starts sending the same message to their contacts.
Bro
MrBeast opened a casino and he's giving away $2,500 with the code BEAST. I already withdrew mine 🤑
A real case: "Vosowin"
These screenshots reached us from our community and show the whole scam, step by step. If anyone tells you about vosowin.com or any MrBeast casino, it's a scam.
5. Elon Musk giveaways that "double" your crypto
AI-manipulated videos (deepfakes), fake livestreams and messages from stolen accounts circulate in which Elon Musk, Tesla or SpaceX announce a giveaway: if you send crypto to an address, you get double back. Nobody sends anything back. The money goes to the scammers' wallet, and crypto transactions can't be undone.
Send between 0.1 and 20 BTC to the address below and you'll instantly receive double.
bc1q9x… (the scammers' address) Ends in 00:14:59
6. "Try my game": files with malware
A friend asks you to try a game they're making and sends you a file or a download link. It's actually a program that steals your passwords, your open sessions and your wallets. Other times, fake warnings say your computer is infected so that you install something or call a number.
Warning signs
- Urgency: "today only", "you have 10 minutes" or "you're going to be banned".
- Links with swapped letters, like dlscord or disc0rd, or with strange domains.
- Requests for your password, your verification codes or to scan a QR code.
- Celebrities who give away money or crypto, or who promise to double what you send.
- Offers that are too good to be true.
How to protect yourself
- Turn on two-step verification on your account.
- Only log in on discord.com or in the official app, never from a link someone sent you.
- Never scan a QR code someone else gives you.
- If a friend sends you something strange, ask them through another channel before opening it.
- Don't download or run files sent to you by private message.
- If you think you fell for it, change your password right away and log out of open sessions from your account settings.
How FireFighter helps on your server
New member verification and the trap channel stop many of the automated accounts that send these links, and the log channel lets you see what was posted and who posted it. If you spot a scammer, add them to the blacklist with >>blacklist add.