Discord Hacked by a Free Nitro Link or QR Code: What to Do

A friend sent you a free Nitro gift, a QR code to "claim" it, or a game they wanted you to test. You clicked, scanned or ran it, and now your account is sending the same message to everyone you know. Some friends have already asked why you are spamming them.

The short answer: if you can still open Discord, change your password right now. That single step cuts off a stolen session. Then lock the account down and warn your friends. If the attacker has already changed your email or password, report it to Discord through its hacked account form.

This guide covers how each version of the scam works, the first few minutes, your servers and payment card, and the fake helpers who turn up next.

Last checked: 5 October 2026.

#What Should You Do If a Free Nitro Scam Hacked Your Discord?

Change your Discord password immediately from a device you trust. Discord's QR code login FAQ says that changing your password logs out all devices at once, including ones you did not approve, and its spam and hacking tips say a password reset generates a new token. Next, turn on two-factor authentication, remove any authorised apps you do not recognise, and scan your computer if you downloaded a file. If you are already locked out, submit a ticket at dis.gd/hackedaccount. Only Discord can restore an account, and nobody outside Discord, including AwareXone, can do it for you.

#How the Free Nitro, QR Code and Test My Game Scams Work

All three tricks aim at your logged-in session. Discord keeps you signed in with a token, a kind of digital key, and whoever holds it can use your account without your password.

Discord's guide to securing your account calls the QR version one of the most common and dangerous scams on the platform. It explains that scanning the code lets the attacker log straight in, bypassing your password and any 2FA you set up. The same guide lists lookalike addresses such as "dlscord.com" with a lowercase L. Discord's hacked account page adds that suspicious links and files often pose as games or free Nitro.

The message usually comes from a friend because their account was taken first. Discord's shopping safety page makes the point directly: links can look like they come from someone you know, because accounts can be compromised.

#First 10 Minutes: Cut the Attacker Out

The attacker is using your account to reach more people, so work through these steps in order.

1. If you downloaded a file, disconnect that computer from the internet and use your phone or another clean device for the next steps. A token stealer on the computer can grab your new password too.
2. Open the Discord app or type discord.com yourself. Do not use any link from the scam message.
3. Change your password in User Settings, under My Account. Pick a long password you have never used anywhere else.
4. Turn on two-factor authentication in the same section. Discord's multi-factor guide recommends a security key or passkey, supports authenticator apps, and says SMS is better than nothing but not by a lot.
5. Download your backup codes and store them offline or in a password manager. Discord says each code works once.
6. Open User Settings, then "Authorized Apps", and press "Deauthorize" on anything you did not add. On mobile, tap the x next to the app.
7. Run a Windows Defender scan if you use Windows, as Discord's hacked account page suggests. Only then reconnect the computer and log in there.

#If You Moderate or Own a Server

A hijacked moderator account is a bigger problem than a hijacked personal one. Discord's account security guide warns that an attacker can ban members and delete channels, messages and roles in servers you moderate.

• Ask another trusted moderator to remove your roles temporarily while you secure the account, then add them back.
• Look for bans, deleted channels and role changes made while you were not in control, and note them for your ticket.
• Review webhooks and bots. Discord's scam protection advice tells owners to audit permissions, especially webhooks, and notes that reputable moderation bots rarely need admin rights.
• Post a short notice in an announcement channel so members know messages from your account were not you.

Discord's spam page is frank about the limit: it warns that bots promising free products will likely compromise a server, and that if anything gets deleted, Discord has no way of restoring what was lost.

#Check Billing for Nitro You Did Not Buy

Whoever controls the account can use a card saved on it, and Discord's hacked account page has a section on charges made after you lost control. Open User Settings, then your billing and subscription pages, and look for purchases or gifts you did not make.

• Report unauthorised charges in your hacked account ticket. Discord's hacked account page asks you to include them.
• Request a refund from Discord's billing team at dis.gd/billing.
• Think before filing a chargeback. Discord says a chargeback or refund request through your bank for Discord transactions may get the account suspended while it investigates.
• If the card was used outside Discord as well, call your bank and ask it to block the card.

#Locked Out: How to Report a Hacked Discord Account

If the scammer changed your password or email before you could act, you cannot fix it from inside the app. Discord's hacked account page says to submit a ticket at dis.gd/hackedaccount, and its scam page says reporting what happened can help you regain ownership.

1. Secure the email inbox on the Discord account first: new password, 2FA, and remove forwarding rules you did not create. Whoever controls that inbox can reset Discord.
2. Search the inbox for emails from Discord about a password or email change. Keep them.
3. Submit the ticket at dis.gd/hackedaccount from the email address that was on the account, if you still have it.
4. Give your username, the email on the account, roughly when you lost control, what you clicked or scanned, and any unauthorised purchases.
5. Reply only to messages that arrive from Discord's support system by email. Discord says its staff never contact users through the app for support.

If Discord also disabled the account because of the spam the attacker sent, the route has two parts. Our guide on a disabled Discord account explains how the hacked ticket and the Standing appeal fit together.

#Evidence Checklist Before You Submit the Ticket

• Your Discord username, the email address and phone number on the account, and roughly when you created it.
• The date and time you clicked the link, scanned the code or ran the file.
• Screenshots of the scam message, the sender's username and the link or QR code, with the date visible. Do not click the link again to capture it.
• Any Discord emails about password, email or 2FA changes.
• Receipts or bank notifications for purchases you did not make.
• A list of servers you own or moderate, and anything changed in them.
• Three or four calm sentences describing what happened, in order.

#Warn Friends Without Spreading the Scam Further

Your friends trust messages from you, which is why the scam travels. Tell them quickly from a channel the attacker does not control.

• Keep it short: your account was taken, ignore any Nitro, gift, QR code or game message sent from it, and do not click or scan anything.
• Ask anyone who already clicked to change their own Discord password straight away.
• Report the original scam message in Discord: hold or right-click it, choose "Report Message", then pick the type of abuse.

Our guide to a hacked account messaging your friends has wording you can adapt so the warning does not cause panic. If a hacked Snapchat is also messaging your friends, our guide to a hacked Snapchat account covers that cleanup too.

#How to Spot a Fake Nitro Gift Next Time

Discord's own Nitro features look different from the scams. Its Share Nitro page describes a trial shared by a friend as something that appears as a message inside Discord and is claimed entirely inside the app, not through an outside link or file you have to open first.

• A QR code you did not generate yourself. Discord's QR FAQ says to tap "Cancel" on any login screen you did not start.
• A login page after clicking a gift. You are already logged in to Discord, so a real gift does not need your password again.
• A download, a "Nitro generator" or a "token checker". Discord's scam advice says not to download programs or paste code you do not recognise.
• Urgency, such as a gift that expires in minutes, or a threat that your account will be deleted.
• An offer of cheap Nitro from a seller. Discord says its products are sold only through the app or its official Amazon store in some countries.

If someone has already contacted you with an offer like this, our guide on fake hackers offering account recovery explains the patterns to watch for.

#If You Lost Money or Shared Card Details in Malaysia

Handle the money first. The government's NSRC 997 hotline page says to call 997 within 24 hours of discovering a scam so authorities can try to block the transactions, then contact your bank and make a police report at the nearest station. This applies if you paid a fake seller, a fake Discord staff member or a recovery scammer.

If the takeover came from a phishing site or a malicious download, you can also report it to CyberSecurity Malaysia's Cyber999 incident response centre, which accepts reports through an online form, email, phone and its mobile app. Then change the password on every other account that shared the same password or used the same browser, because malware that reached your Discord login may have reached other logins on the same computer. Our guide to what to do after clicking a phishing link covers that wider clean-up.

#When a Case Review Makes Sense

Many Discord takeovers can be fixed with a fast password change, or with a clear ticket at dis.gd/hackedaccount, and only Discord can return an account. Outside help can make sense when the attacker changed your email and Discord's replies have stalled, when a hack and a suspension are tangled together, or when the account runs a large community you depend on. AwareXone, our recovery service, reviews the case first and tells you honestly whether an official route is still open. Help is best effort, and sometimes the answer is that you already have everything you need. The recovery hub explains how that review works, and our Trust Center sets out what we never ask for, starting with your password and codes.

#Frequently Asked Questions