How to spot a Discord scam

Scam pitches change constantly. Their structure does not, and that is what makes them identifiable without keeping up with the current wording.

The three signals

Almost every scam on Discord carries all three. Any one of them is a reason to slow down; two is effectively conclusive.

Manufactured urgency. A deadline, a limited number of places, an account about to be suspended. Urgency exists to prevent the pause in which you would notice the other two signals.

A link that must be opened now. The message’s actual purpose. Everything before it is construction.

A request to authorise, install or enter something. Logging in, scanning a code, authorising an app, downloading a file, entering a code you received elsewhere. This is where the loss happens.

A message with all three is a scam whatever it claims to be, and you do not need to have seen the specific pitch before.

The six patterns

Nearly all of it, in rough order of frequency.

The free gift. Nitro, a game key, a giveaway you did not enter. The pitch is generosity and the mechanism is a login page.

The QR code login. A code to scan “to claim” or “to verify”. Scanning a QR login code hands over an active session — the attacker is signed in as you, immediately, with no password involved. There is no legitimate reason to scan a QR code to receive anything.

The friend in trouble. A message from a compromised friend’s account, asking for help, a vote, or for you to look at something. It is effective because the account is genuine; the person is not behind it.

The staff impersonation. A DM claiming to be Discord staff, server staff or Trust & Safety, about a report, a warning or a verification. Discord staff never DM members about moderation, and no legitimate process ever asks for a token, a password or a 2FA code.

The opportunity. A commission, a beta test, a job, a collaboration. Longer conversation, more plausible, and it ends at a file to download or an app to authorise.

The fake bot. A bot invite or an authorisation prompt requesting broad permissions, often mimicking a well-known bot’s name and avatar. The tell is in the permission bitfield — are Discord bots safe covers reading an invite link before you click it.

What no legitimate process ever asks for

Worth stating flatly, because it collapses most cases in one line.

• Your token. Ever, for any reason, by anyone.
• Your password, outside Discord’s own login screen at discord.com.
• A 2FA code sent to you by anything other than your own authenticator.
• A QR scan to claim, verify or receive something.
• A file to run in order to verify, check or fix your account.

Any request for one of these ends the conversation, regardless of who appears to be asking.

Why filtering the domain does not work

Servers reach for a blocklist of scam domains, and it is the least durable control available.

The domain changes in minutes. Registering another is trivial and free-adjacent. A blocklist is always describing yesterday.

The message shape does not change. Urgency plus a link plus an authorisation request is the structure the scam requires, and it survives every domain rotation.

So the durable controls are shape-based:

• Discord’s suspected-spam rule, which is a maintained classifier rather than your wordlist.
• Mention-spam limits, since mass-mention delivery is how these reach a whole server at once.
• Invite and external-link rules, scoped so members who have been present a while are exempt.
• Intent-based scanning, which reads the pitch rather than the domain — one of the few cases a rule genuinely cannot cover.

The control that removes most of it

Most scam DMs come from accounts that joined minutes earlier. The account exists to send the message and is discarded afterwards.

Which means the highest-value control is not a filter at all — it is screening at the door. Raising the verification level costs nothing and removes a large share. A join-screening rule that combines account age with a join-rate spike removes most of the rest, because the throwaway accounts arrive in waves rather than individually.

Vetox’s Join Guard is the shape that works: 10 named conditions, each rule combining up to five with AND/OR logic and firing up to five actions, alongside rolling-window Anti-Raid detection, at its $4.99 Basic tier. Combining conditions is what makes it usable — account age alone either rejects legitimate new Discord users or admits accounts prepared a week earlier.

What to tell members

Short enough that people remember it. Three lines in your rules channel does more than a page nobody reads.

Nobody legitimate will ever ask for your token, your password, or a 2FA code. Never scan a QR code to claim anything. If it is urgent and it has a link, it is a scam. Ask in the server first.

The third line is the one that works, because it gives a member a specific alternative action rather than only a prohibition.

What to do when one gets through

Delete and ban, then report to Discord. The report matters — it is what removes the account from the platform rather than only from your server.

Say so publicly, briefly. “A scam DM went out from a fake account; nobody legitimate asks for your token.” Members who received it and did nothing need to know they were right; members who clicked need to know to change their password.

Check whether anyone acted on it, and help them: password change, session invalidation, 2FA. If the affected member holds server permissions, treat it as a compromised account and remove their roles until the account is secured.

Record it. The account ID, the message text, the time. A server that keeps a record of the last few attempts recognises the seventh instantly — and a bot logging join and message events gives you that without anyone taking notes. Vetox’s 148 log event types and a 100-warning case history are free on every tier.

Frequently asked questions

Does Discord DM members about moderation? No. Any DM claiming to be Discord staff about a report or a warning is a scam.

Is it safe to scan a QR code to claim a prize? No. Scanning a QR login code hands over an active session — there is no legitimate use of one to receive anything.

Why does blocking scam domains not work? The domain changes in minutes; the message structure does not. Filter the shape, not the address.

Where do most scam DMs come from? Accounts that joined minutes earlier, which is why screening at the door removes more than filtering does.

What should I do if a member clicked one? Password change, session invalidation and 2FA — and if they hold server permissions, remove their roles until the account is confirmed secure.