Skip to main content
If your Discord account sent a scam image or link that you did not post, treat the account and the device you use for Discord as compromised. Act quickly, but use a different, trusted device for password changes if you think you installed malware.
Discord staff will not DM you inside Discord to investigate a report, reverse a ban, or secure your account. Do not pay anyone, share a code, scan a QR code, or change your account email for a person claiming to be Discord support.

​
How Discord Accounts Get Hacked

Many Discord accounts used to spread scams are stolen by information-stealing malware, not by someone guessing the password. The malware is commonly hidden in:
  • Trojanized game mods, including unofficial Minecraft mods and mod installers
  • Cracked software, cheats, plugins, and modified Discord clients
  • A fake game or beta test sent by a friend whose account was already hacked
  • Fake verification tools, CAPTCHA downloads, and “security” applications
  • Malicious browser extensions or files advertised as free Nitro
These files can steal Discord sessions, browser cookies, saved passwords, cryptocurrency wallets, and other accounts. A password reset alone may not be enough if the infected device can steal the new password or session again. Phishing is another common cause. Fake Discord login pages, QR-code login prompts, and the “I accidentally reported your account” scam are designed to make you hand over access yourself.

​
1. Secure Your Email Account First

Your email account controls Discord password resets, so secure it before or alongside Discord.
  • Change the email password from a clean device and use a password you have never used elsewhere.
  • Enable two-factor authentication on your email account.
  • Review recent sign-ins, recovery addresses, forwarding rules, and active sessions.
  • If Discord emailed you that your address was changed, use the recovery link in that email immediately.
Do not click password-reset links from an unexpected Discord DM. Open Discord or type the official address into your browser yourself.

​
2. Reset Your Discord Password

Go to discord.com/reset immediately. If you cannot access the account or its email address, submit Discord’s official hacked account form. Choose a password that is:
  • At least 12 characters long; a longer passphrase is even better
  • Unique to Discord and never reused on another website
  • Stored in a reputable password manager
Resetting the password invalidates existing Discord sessions, which helps remove the attacker from other devices. Do the reset from a clean phone or computer if the usual device may contain malware.

​
3. Check the Device for Malware

Think back to anything you downloaded or ran shortly before the account was hacked, especially a game mod, mod installer, cheat, plugin, cracked program, or verification tool.
  1. Disconnect the suspected device from the internet if you find an unknown process, security alert, or confirmed infection.
  2. Remove unfamiliar browser extensions and uninstall suspicious applications.
  3. Run a full scan with Windows Security (Microsoft Defender) and a reputable second-opinion scanner such as Malwarebytes.
  4. Review recently downloaded files, startup applications, and installed programs.
If an information stealer or other malware is found, the safest response is to reinstall Windows from trusted installation media. Some stealers leave persistence behind, and a scanner reporting that it removed one file does not prove the device is clean. Back up only personal documents, photos, and other known data files before reinstalling. Do not carry over unknown executables, scripts, installers, mods, or browser profiles. From a separate clean device, change passwords for your email, password manager, Discord, gaming accounts, financial accounts, and any other credentials stored in the affected browser.

​
4. Enable Two-Factor Authentication

In Discord, open User Settings -> Password and Authentication and enable multi-factor authentication.
  • Prefer an authenticator app, security key, or passkey when available.
  • Do not rely on SMS as your only protection.
  • Download the backup codes and store them somewhere private and offline.
  • Never send an authentication code or backup code to another person.
Two-factor authentication makes a stolen password less useful, although malware that steals an active session can sometimes bypass it. Keeping the device clean still matters.

​
5. Revoke Suspicious Apps and Sessions

Open User Settings -> Authorized Apps and deauthorize anything you do not recognize or no longer use. A malicious OAuth application may be able to access account information or make your account join servers even after the original scam. Also review:
  • Connections for accounts you did not link
  • New servers, friends, and direct-message conversations
  • Changes to your profile, email address, phone number, or security settings
  • Authorized devices and sessions shown by Discord, if available
Only authorize applications you deliberately opened from a developer or service you trust. An OAuth consent screen is not proof that an app is safe.

​
6. Review Messages Sent by the Hacker

Attackers often use a stolen Discord account to send the same malicious mod, fake game, scam image, or phishing link to friends and servers.
  • Check recent DMs and outgoing server messages for anything you did not write.
  • Delete malicious messages where you still can.
  • Warn recipients not to open the link, scan the QR code, or run the file.
  • Tell server moderators that your account was compromised so they can remove copies and warn members.
  • If private or sensitive information was exposed, notify the affected people promptly.
Anyone who downloaded or ran the file should follow this guide too. Simply deleting the message does not remove malware from their device.

​
7. Check Purchases and Payment Details

Review Discord purchases, Nitro gifts, and the payment methods connected to the account. If you find an unauthorized Discord charge, include it in your hacked-account report and contact Discord Billing Support. Keep screenshots, emails, dates, transaction IDs, and relevant message links. Avoid filing duplicate support tickets because that can make the case harder to track.

​
Stay Safe After Recovery

  • Do not download unofficial mods, cheats, cracks, or “test my game” files without independently verifying the source.
  • Treat a file sent by a friend as untrusted if the message is unusual; their account may be hacked.
  • Never scan a random Discord QR code for verification, a giveaway, or staff support.
  • Check the complete website domain before entering a password or approving OAuth access.
  • If a site asks you to sign in again unexpectedly, close it and open Discord directly.
  • Keep Windows, your browser, antivirus software, Discord, and game launchers updated.
  • Use a password manager so every important account has a different password.
If Scrump notified you about a scam sent from your account, that warning does not mean Scrump hacked or accessed the account. It means Scrump detected known scam content posted in a server with scam protection enabled.