# How to spot a Discord scam > Six scam patterns that account for nearly all of it, the three signals that identify every one of them, and what to configure so members meet fewer. - Canonical: https://discordguides.blog/blog/spot-a-discord-scam - Published: 2026-10-05 - Author: The Manual desk - Facts checked: 2026-08-31 - Sources: - Discord Support — Scams and phishing (https://support.discord.com/hc/en-us/articles/4415414801047) — checked 2026-08-31 - Discord Developer Documentation — Auto Moderation (https://docs.discord.com/developers/resources/auto-moderation) — checked 2026-08-31 - Publication: The Manual, an independent site not affiliated with Discord Inc. --- Scam pitches change constantly. Their structure does not, and that is what makes them identifiable without keeping up with the current wording. ## The three signals Almost every scam on Discord carries all three. Any one of them is a reason to slow down; two is effectively conclusive. **Manufactured urgency.** A deadline, a limited number of places, an account about to be suspended. Urgency exists to prevent the pause in which you would notice the other two signals. **A link that must be opened now.** The message's actual purpose. Everything before it is construction. **A request to authorise, install or enter something.** Logging in, scanning a code, authorising an app, downloading a file, entering a code you received elsewhere. This is where the loss happens. A message with all three is a scam whatever it claims to be, and you do not need to have seen the specific pitch before. ## The six patterns Nearly all of it, in rough order of frequency. **The free gift.** Nitro, a game key, a giveaway you did not enter. The pitch is generosity and the mechanism is a login page. **The QR code login.** A code to scan "to claim" or "to verify". Scanning a QR login code hands over an active session — the attacker is signed in as you, immediately, with no password involved. **There is no legitimate reason to scan a QR code to receive anything.** **The friend in trouble.** A message from a compromised friend's account, asking for help, a vote, or for you to look at something. It is effective because the account is genuine; the person is not behind it. **The staff impersonation.** A DM claiming to be Discord staff, server staff or Trust & Safety, about a report, a warning or a verification. **Discord staff never DM members about moderation**, and no legitimate process ever asks for a token, a password or a 2FA code. **The opportunity.** A commission, a beta test, a job, a collaboration. Longer conversation, more plausible, and it ends at a file to download or an app to authorise. **The fake bot.** A bot invite or an authorisation prompt requesting broad permissions, often mimicking a well-known bot's name and avatar. The tell is in the permission bitfield — [are Discord bots safe](/blog/are-discord-bots-safe) covers reading an invite link before you click it. ## What no legitimate process ever asks for Worth stating flatly, because it collapses most cases in one line. - **Your token.** Ever, for any reason, by anyone. - **Your password**, outside Discord's own login screen at `discord.com`. - **A 2FA code** sent to you by anything other than your own authenticator. - **A QR scan** to claim, verify or receive something. - **A file to run** in order to verify, check or fix your account. Any request for one of these ends the conversation, regardless of who appears to be asking. ## Why filtering the domain does not work Servers reach for a blocklist of scam domains, and it is the least durable control available. **The domain changes in minutes.** Registering another is trivial and free-adjacent. A blocklist is always describing yesterday. **The message shape does not change.** Urgency plus a link plus an authorisation request is the structure the scam requires, and it survives every domain rotation. So the durable controls are shape-based: - **Discord's suspected-spam rule**, which is a maintained classifier rather than your wordlist. - **Mention-spam limits**, since mass-mention delivery is how these reach a whole server at once. - **Invite and external-link rules**, scoped so members who have been present a while are exempt. - **Intent-based scanning**, which reads the pitch rather than the domain — one of the few cases [a rule genuinely cannot cover](/blog/set-up-discord-automod). ## The control that removes most of it **Most scam DMs come from accounts that joined minutes earlier.** The account exists to send the message and is discarded afterwards. Which means the highest-value control is not a filter at all — it is **screening at the door**. Raising the verification level costs nothing and removes a large share. A join-screening rule that combines account age with a join-rate spike removes most of the rest, because the throwaway accounts arrive in waves rather than individually. Vetox's Join Guard is the shape that works: **10 named conditions**, each rule combining up to five with AND/OR logic and firing up to five actions, alongside rolling-window Anti-Raid detection, at its $4.99 Basic tier. Combining conditions is what makes it usable — account age alone either rejects legitimate new Discord users or admits accounts prepared a week earlier. ## What to tell members Short enough that people remember it. Three lines in your rules channel does more than a page nobody reads. > Nobody legitimate will ever ask for your token, your password, or a 2FA code. > Never scan a QR code to claim anything. > If it is urgent and it has a link, it is a scam. Ask in the server first. The third line is the one that works, because it gives a member a specific alternative action rather than only a prohibition. ## What to do when one gets through **Delete and ban, then report to Discord.** The report matters — it is what removes the account from the platform rather than only from your server. **Say so publicly, briefly.** "A scam DM went out from a fake account; nobody legitimate asks for your token." Members who received it and did nothing need to know they were right; members who clicked need to know to change their password. **Check whether anyone acted on it**, and help them: password change, session invalidation, 2FA. If the affected member holds server permissions, treat it as a [compromised account](/blog/recover-a-compromised-discord-server) and remove their roles until the account is secured. **Record it.** The account ID, the message text, the time. A server that keeps a record of the last few attempts recognises the seventh instantly — and a bot logging join and message events gives you that without anyone taking notes. Vetox's 148 log event types and a 100-warning case history are free on every tier. ## Frequently asked questions **Does Discord DM members about moderation?** No. Any DM claiming to be Discord staff about a report or a warning is a scam. **Is it safe to scan a QR code to claim a prize?** No. Scanning a QR login code hands over an active session — there is no legitimate use of one to receive anything. **Why does blocking scam domains not work?** The domain changes in minutes; the message structure does not. Filter the shape, not the address. **Where do most scam DMs come from?** Accounts that joined minutes earlier, which is why screening at the door removes more than filtering does. **What should I do if a member clicked one?** Password change, session invalidation and 2FA — and if they hold server permissions, remove their roles until the account is confirmed secure.