# Discord Hacked by a Free Nitro Link or QR Code: What to Do > Clicked a free Nitro link or scanned a QR code and your Discord now sends scams? How to cut the hacker out, secure servers and billing, and report it. - URL: https://www.awarexone.com/research/discord-account-hacked-nitro-scam - Author: Md Shariar Shanaz Shuvon, Founder & CEO, AwareXone - Published: 2026-10-05 - Topics: Discord, Account recovery, Malaysia - Related service: Recovery hub: https://www.awarexone.com/all-types-of-social-media-problem-solutions ## Short answer If a free Nitro link, QR code or game file took your Discord, change the password now if you can still log in. Discord says this logs out every device. Turn on two-factor authentication, remove unknown authorised apps and warn friends. If you are locked out, use dis.gd/hackedaccount. Discord decides every case. ## Summary - A free Nitro link, a QR code to scan or a game to test is a common way to take a Discord account, and the scam then spreads through your friends list. - If you can still log in, change your password straight away, because Discord says that ends the stolen session and logs out every device. - Then turn on two-factor authentication, remove authorised apps you do not recognise, check your servers and check billing for Nitro you did not buy. - If the hacker changed your email or password and you are locked out, submit a ticket through Discord's hacked account form at dis.gd/hackedaccount. - Discord staff do not message you in the app about support, so anyone who messages you offering to restore or appeal your account, or asking for codes, is a scammer. - Discord makes the final decision on every case, support can take time, and some accounts are not recovered. A friend sent you a free Nitro gift, a QR code to "claim" it, or a game they wanted you to test. You clicked, scanned or ran it, and now your account is sending the same message to everyone you know. Some friends have already asked why you are spamming them. The short answer: if you can still open Discord, change your password right now. That single step cuts off a stolen session. Then lock the account down and warn your friends. If the attacker has already changed your email or password, report it to Discord through its hacked account form. This guide covers how each version of the scam works, the first few minutes, your servers and payment card, and the fake helpers who turn up next. Last checked: 5 October 2026. ## What Should You Do If a Free Nitro Scam Hacked Your Discord? Change your Discord password immediately from a device you trust. Discord's [QR code login FAQ](https://support.discord.com/hc/en-us/articles/360039213771-QR-Code-Login-FAQ) says that changing your password logs out all devices at once, including ones you did not approve, and its [spam and hacking tips](https://discord.com/safety/360044104071-tips-against-spam-and-hacking) say a password reset generates a new token. Next, turn on two-factor authentication, remove any authorised apps you do not recognise, and scan your computer if you downloaded a file. If you are already locked out, submit a ticket at dis.gd/hackedaccount. Only Discord can restore an account, and nobody outside Discord, including AwareXone, can do it for you. ## How the Free Nitro, QR Code and Test My Game Scams Work All three tricks aim at your logged-in session. Discord keeps you signed in with a token, a kind of digital key, and whoever holds it can use your account without your password. *Common Discord takeover tricks and the first step for each, based on Discord's safety and help pages at the time of writing.* | What you were sent | What actually happened | First thing to do | | --- | --- | --- | | A QR code to scan in the Discord app for "free Nitro" | Discord's QR scanner is only for logging in. Scanning approved a login for the scammer's computer | Change your password now to log out every device | | A "free Nitro" or gift link that opened a Discord login page | A fake site with a lookalike address collected your email and password | Change your password, then turn on 2FA | | A game, mod or "beta" to download and test | The file was likely malware built to copy your login token | Scan the computer first, then change your password | | A message asking you to paste code into Discord or share your screen | The scammer wanted your token or the codes on your screen | Change your password and never share your screen with strangers | Discord's guide to [securing your account](https://discord.com/safety/securing-your-discord-account) calls the QR version one of the most common and dangerous scams on the platform. It explains that scanning the code lets the attacker log straight in, bypassing your password and any 2FA you set up. The same guide lists lookalike addresses such as "dlscord.com" with a lowercase L. Discord's [hacked account page](https://support.discord.com/hc/en-us/articles/24160905919511-My-Discord-Account-was-Hacked-or-Compromised) adds that suspicious links and files often pose as games or free Nitro. The message usually comes from a friend because their account was taken first. Discord's [shopping safety page](https://support.discord.com/hc/en-us/articles/28606213995031-Safer-Ways-to-Shop-on-Discord) makes the point directly: links can look like they come from someone you know, because accounts can be compromised. ## First 10 Minutes: Cut the Attacker Out The attacker is using your account to reach more people, so work through these steps in order. 1. If you downloaded a file, disconnect that computer from the internet and use your phone or another clean device for the next steps. A token stealer on the computer can grab your new password too. 2. Open the Discord app or type discord.com yourself. Do not use any link from the scam message. 3. Change your password in User Settings, under My Account. Pick a long password you have never used anywhere else. 4. Turn on two-factor authentication in the same section. Discord's [multi-factor guide](https://support.discord.com/hc/en-us/articles/219576828-Setting-up-Multi-Factor-Authentication) recommends a security key or passkey, supports authenticator apps, and says SMS is better than nothing but not by a lot. 5. Download your backup codes and store them offline or in a password manager. Discord says each code works once. 6. Open User Settings, then "Authorized Apps", and press "Deauthorize" on anything you did not add. On mobile, tap the x next to the app. 7. Run a Windows Defender scan if you use Windows, as Discord's hacked account page suggests. Only then reconnect the computer and log in there. > Note: **Why the password change works.** A stolen token keeps working until Discord replaces it. Changing your password forces a new token and signs out every session, including the scammer's. If malware is still on your computer, it can steal the new token, so scan before you log back in there. ## If You Moderate or Own a Server A hijacked moderator account is a bigger problem than a hijacked personal one. Discord's account security guide warns that an attacker can ban members and delete channels, messages and roles in servers you moderate. - Ask another trusted moderator to remove your roles temporarily while you secure the account, then add them back. - Look for bans, deleted channels and role changes made while you were not in control, and note them for your ticket. - Review webhooks and bots. Discord's [scam protection advice](https://discord.com/safety/protecting-users-from-scams-on-discord) tells owners to audit permissions, especially webhooks, and notes that reputable moderation bots rarely need admin rights. - Post a short notice in an announcement channel so members know messages from your account were not you. Discord's spam page is frank about the limit: it warns that bots promising free products will likely compromise a server, and that if anything gets deleted, Discord has no way of restoring what was lost. ## Check Billing for Nitro You Did Not Buy Whoever controls the account can use a card saved on it, and Discord's hacked account page has a section on charges made after you lost control. Open User Settings, then your billing and subscription pages, and look for purchases or gifts you did not make. - Report unauthorised charges in your hacked account ticket. Discord's hacked account page asks you to include them. - Request a refund from Discord's billing team at dis.gd/billing. - Think before filing a chargeback. Discord says a chargeback or refund request through your bank for Discord transactions may get the account suspended while it investigates. - If the card was used outside Discord as well, call your bank and ask it to block the card. ## Locked Out: How to Report a Hacked Discord Account If the scammer changed your password or email before you could act, you cannot fix it from inside the app. Discord's hacked account page says to submit a ticket at dis.gd/hackedaccount, and its scam page says reporting what happened can help you regain ownership. 1. Secure the email inbox on the Discord account first: new password, 2FA, and remove forwarding rules you did not create. Whoever controls that inbox can reset Discord. 2. Search the inbox for emails from Discord about a password or email change. Keep them. 3. Submit the ticket at dis.gd/hackedaccount from the email address that was on the account, if you still have it. 4. Give your username, the email on the account, roughly when you lost control, what you clicked or scanned, and any unauthorised purchases. 5. Reply only to messages that arrive from Discord's support system by email. Discord says its staff never contact users through the app for support. If Discord also disabled the account because of the spam the attacker sent, the route has two parts. Our guide on [a disabled Discord account](https://www.awarexone.com/research/discord-account-disabled) explains how the hacked ticket and the Standing appeal fit together. ## Evidence Checklist Before You Submit the Ticket - Your Discord username, the email address and phone number on the account, and roughly when you created it. - The date and time you clicked the link, scanned the code or ran the file. - Screenshots of the scam message, the sender's username and the link or QR code, with the date visible. Do not click the link again to capture it. - Any Discord emails about password, email or 2FA changes. - Receipts or bank notifications for purchases you did not make. - A list of servers you own or moderate, and anything changed in them. - Three or four calm sentences describing what happened, in order. > Note: **Discord decides.** A ticket asks Discord to look at your case. It does not entitle you to the account back. Discord reviews each report on its own facts, support can take time, and some accounts are not recovered. ## Warn Friends Without Spreading the Scam Further Your friends trust messages from you, which is why the scam travels. Tell them quickly from a channel the attacker does not control. - Keep it short: your account was taken, ignore any Nitro, gift, QR code or game message sent from it, and do not click or scan anything. - Ask anyone who already clicked to change their own Discord password straight away. - Report the original scam message in Discord: hold or right-click it, choose "Report Message", then pick the type of abuse. Our guide to [a hacked account messaging your friends](https://www.awarexone.com/research/hacked-account-messaging-friends) has wording you can adapt so the warning does not cause panic. If a hacked Snapchat is also messaging your friends, our guide to [a hacked Snapchat account](https://www.awarexone.com/research/snapchat-account-hacked-recovery) covers that cleanup too. ## How to Spot a Fake Nitro Gift Next Time Discord's own Nitro features look different from the scams. Its [Share Nitro page](https://support.discord.com/hc/en-us/articles/22567595858327-Share-Nitro) describes a trial shared by a friend as something that appears as a message inside Discord and is claimed entirely inside the app, not through an outside link or file you have to open first. - A QR code you did not generate yourself. Discord's QR FAQ says to tap "Cancel" on any login screen you did not start. - A login page after clicking a gift. You are already logged in to Discord, so a real gift does not need your password again. - A download, a "Nitro generator" or a "token checker". Discord's scam advice says not to download programs or paste code you do not recognise. - Urgency, such as a gift that expires in minutes, or a threat that your account will be deleted. - An offer of cheap Nitro from a seller. Discord says its products are sold only through the app or its official Amazon store in some countries. > Warning: **Fake Discord staff and recovery hackers.** Discord's hacked account page says its staff will never contact you directly through the app for support, and names scammers who pose as staff offering to "appeal actions on your account". Its safety pages say Discord will never ask for your password or token. Strangers on Discord, TikTok, Telegram or Facebook offering to "recover" or "pulihkan" your account for payment, in English, Bahasa Malaysia or Chinese, cannot do anything you cannot do through dis.gd/hackedaccount. Never share your password, token, 2FA code or backup codes with anyone, and never share your screen with them. If someone has already contacted you with an offer like this, our guide on [fake hackers offering account recovery](https://www.awarexone.com/research/fake-hackers-offering-account-recovery-scam) explains the patterns to watch for. ## If You Lost Money or Shared Card Details in Malaysia Handle the money first. The government's [NSRC 997 hotline page](https://www.malaysia.gov.my/en/categories/safety-and-community/cybersecurity/nsrc-997-hotline) says to call 997 within 24 hours of discovering a scam so authorities can try to block the transactions, then contact your bank and make a police report at the nearest station. This applies if you paid a fake seller, a fake Discord staff member or a recovery scammer. If the takeover came from a phishing site or a malicious download, you can also report it to CyberSecurity Malaysia's [Cyber999 incident response centre](https://www.cybersecurity.my/portal-main/services/cyber999-overview), which accepts reports through an online form, email, phone and its mobile app. Then change the password on every other account that shared the same password or used the same browser, because malware that reached your Discord login may have reached other logins on the same computer. Our guide to [what to do after clicking a phishing link](https://www.awarexone.com/research/clicked-phishing-link-what-to-do) covers that wider clean-up. ## When a Case Review Makes Sense Many Discord takeovers can be fixed with a fast password change, or with a clear ticket at dis.gd/hackedaccount, and only Discord can return an account. Outside help can make sense when the attacker changed your email and Discord's replies have stalled, when a hack and a suspension are tangled together, or when the account runs a large community you depend on. SocialSafe by AwareXone, our recovery service, reviews the case first and tells you honestly whether an official route is still open. Help is best effort, and sometimes the answer is that you already have everything you need. The [recovery hub](https://www.awarexone.com/all-types-of-social-media-problem-solutions) explains how that review works, and our [Trust Center](https://www.awarexone.com/trust) sets out what we never ask for, starting with your password and codes. ## Frequently Asked Questions ### Can someone hack my Discord just by me scanning a QR code? Yes, if you approved the login. Discord says its QR scanner is only for logging in, so scanning a stranger's code and tapping "Log in" signs the scammer in past your password and 2FA. Change your password to log them out. ### Does changing my Discord password log out the hacker? Discord says changing your password logs out all devices at once and generates a new token. If malware is still on your computer, scan it first, or the new token can be stolen too. ### My friend sent me a free Nitro link. Was their account hacked? Very likely, if the message was unexpected or asked you to log in, scan a code or download something. Tell them through another channel and do not click the link. ### Will Discord refund Nitro the hacker bought with my card? Discord asks you to report unauthorised transactions in your hacked account ticket and to request refunds through dis.gd/billing. It warns that a chargeback through your bank may lead to the account being suspended while it investigates. ### Can I get my Discord back if the hacker changed the email? Sometimes. Secure your own email inbox, then submit a ticket at dis.gd/hackedaccount with your username and when you lost access. Discord decides, and some accounts are not recovered. ## Official sources - [Discord Support: My Discord Account was Hacked or Compromised (read 5 October 2026)](https://support.discord.com/hc/en-us/articles/24160905919511-My-Discord-Account-was-Hacked-or-Compromised) - [Discord Safety: Securing Your Discord Account (read 5 October 2026)](https://discord.com/safety/securing-your-discord-account) - [Discord Safety: Protecting Against Scams on Discord (read 5 October 2026)](https://discord.com/safety/protecting-users-from-scams-on-discord) - [Discord Safety: Tips against spam and hacking (read 5 October 2026)](https://discord.com/safety/360044104071-tips-against-spam-and-hacking) - [Discord Support: QR Code Login FAQ (read 5 October 2026)](https://support.discord.com/hc/en-us/articles/360039213771-QR-Code-Login-FAQ) - [Discord Support: Share Nitro (read 5 October 2026)](https://support.discord.com/hc/en-us/articles/22567595858327-Share-Nitro) - [Discord Support: Safe Ways to Shop on Discord (read 5 October 2026)](https://support.discord.com/hc/en-us/articles/28606213995031-Safer-Ways-to-Shop-on-Discord) - [Discord Support: Setting up Multi-Factor Authentication (read 5 October 2026)](https://support.discord.com/hc/en-us/articles/219576828-Setting-up-Multi-Factor-Authentication) - [MyGOV Malaysia: NSRC 997 Hotline (read 5 October 2026)](https://www.malaysia.gov.my/en/categories/safety-and-community/cybersecurity/nsrc-997-hotline) - [CyberSecurity Malaysia: Cyber999 Cyber Incident Response Center (read 5 October 2026)](https://www.cybersecurity.my/portal-main/services/cyber999-overview) --- AwareXone is an independent Malaysia-based provider, not affiliated with any platform. The platform makes the final decision on every account. AwareXone never asks for passwords, OTP codes, backup codes or session cookies.