# Discord QR Code Scam: What to Do If You Scanned It > Scanned a Discord QR code scam? See what Discord says scanning allows, the password step it recommends and how to check your account and servers. - URL: https://www.awarexone.com/research/discord-qr-code-login-scam-scanned - Author: Md Shariar Shanaz Shuvon, Founder & CEO, AwareXone - Published: 2026-10-24 - Topics: Discord, QR code scam, Account security - Related service: Account security help: https://www.awarexone.com/services/account-security ## Short answer Discord says its QR scanner is only for logging in, and scanning a scam code lets the attacker log in without your password or 2FA. If you scanned one, change your password at once, which logs out all devices. If the login screen appears, tap Cancel. Then check your email, authorised apps and report the scam to Discord. ## Summary - Discord says its QR scanner is only for logging in to Discord, and a scam code lets an attacker log in directly, without needing your password or 2FA. - Discord says that if you accidentally scan a suspicious QR code, you should immediately change your password, which logs you out of all devices. - Discord's FAQ says never approve a QR login you did not generate yourself, and if one opens the login screen, tap Cancel right away. - Discord says you can also report these scams to Discord Trust and Safety, and submit a ticket if you believe your account was compromised. - Act calmly and in the right order, because a wrong step can make this harder to undo, so know what you are doing before you start. A message arrives from a friend or a stranger. It has a QR code, a promise of free Nitro, and short instructions to scan it with Discord. You did, and a second later you realise something is off. You want to know what you gave away and what to do now. The short answer: Discord's own safety page says scanning a scam QR code lets the attacker log in to your account directly, without needing your password or 2FA, even if you have set it up. It says that if you accidentally scan one, you should immediately change your password, because that invalidates your current account token and logs you out of all devices. Act calmly and in the right order, so know what you are doing before you start. This guide sets out what Discord says, what to do in order, how to check your account and apps, what moderators should look at, and what to avoid. Last checked: 24 October 2026. ## What Does the Scam Do? Discord's guide to [securing your account](https://discord.com/safety/securing-your-discord-account) calls this scam among the common and dangerous ones on the platform. A user or a bot sends a direct message with a QR code, saying you should scan it with Discord's QR code scanner for free Nitro, generally with instructions on how to find the scanner. Discord's reminder is that the scanner is only used to log in to Discord. Scanning the code lets the attacker log in to your account, without needing your password or 2FA. That is why a strong password and 2FA alone do not help here, since Discord says the scan gets round them. ## Did You Approve It or Only Scan It? Discord's [QR code login FAQ](https://support.discord.com/hc/en-us/articles/360039213771-QR-Code-Login-FAQ) gives a more detailed picture. It says any QR code login attempt needs to be approved before it goes through. After you scan, the mobile app gives you the option to approve by tapping Log in, or to tap Cancel. The page says that even if you scanned a code that opened the Discord app by mistake, you can prevent the login attempt right away, and that if someone sent you a QR code that opened the login verification screen, you should hit Cancel right away. The FAQ also says: "Never approve a QR code login that you didn't generate yourself." And it says that if someone you do not know asks you to log in using a QR code, they may be trying to phish your account. | What happened | What Discord's pages say | What to do | | --- | --- | --- | | You scanned the code and saw a login screen, then tapped Cancel | The FAQ says you can prevent the login attempt, and that attempts need approval | Discord says this prevents the login attempt. Change your password anyway as a precaution. | | You tapped Log in, or you are not sure | The FAQ says to change your password to log out all devices, and the safety page says scanning lets the attacker in | Change your password immediately | | You only opened a link or image and did nothing else | Neither page describes this case | Do not scan again, and check your email and apps | There is a small difference between the two pages that you should know about. The safety page says scanning the code lets the attacker log in. The FAQ says a login still needs to be approved on your phone. We cannot tell from the pages which applies in your exact case, and that is why the password step is the safe choice when you are unsure. ## What Should I Do, In Order? 1. Change your password now, from the official Discord app or website that you open yourself. Discord says this logs you out of all devices at once and invalidates your account token. 2. Check your email for any Discord message about a login or change you did not make, and do not click links in it. The securing page says to open discord.com yourself when a link asks you to log in. 3. Make sure Multi-Factor Authentication is on, and use a strong, unique password. Discord's page recommends both. 4. Review the apps that have access to your account and remove any you do not recognise, as set out in the next section. 5. Report the scam message to Discord Trust and Safety. The safety page says you can report scams directly for further action. 6. If you believe the account was compromised or accessed, submit a ticket to Discord using the form on its hacked-account page. Do these in the order shown. Resetting the password first matters because it logs everything else out. A tidy sweep of your apps before the password changes could leave an attacker still logged in. ## How Do I Review Apps With Access? Discord's [hacked or compromised page](https://support.discord.com/hc/en-us/articles/24160905919511-My-Discord-Account-was-Hacked-or-Compromised) says to review the apps that have access to your account and remove any unwanted applications. On desktop or browser, open User Settings with the cogwheel, choose the apps access list and press Deauthorize on any you do not want. On mobile, tap your avatar, tap the cogwheel at the top right, open the same list and tap the x button next to any you do not recognise. The page also suggests, on Windows, running a Windows Defender scan to check for viruses. It lists suspicious links or files, which may appear as games or promises of free Nitro, as a common threat. ## What Should Server Moderators Check? Discord's securing page says that when you are a moderator there is an additional danger. An attacker who has compromised your account may ruin the servers you moderate by banning tons of members, deleting channels and messages or more. It also lists banning users and deleting messages, channels and roles as harm that anyone with access to a moderator account could do. So, if you moderate or own a server, look at what happened after the scan. Discord's [audit log documentation](https://docs.discord.com/developers/resources/audit-log) says an entry is added to a server's audit log when an administrative action is performed, that users can see it in the server's Server Settings and that viewing it needs the View Audit Log permission. Its examples include role updates and channel creation. Discord's [caps page](https://support.discord.com/hc/en-us/articles/33694251638295-Discord-Account-Caps-Server-Caps-and-More) says an entry stays in a server's audit log for 45 days, so look soon. - Open Server Settings and read the audit log for actions you did not take. - Look for unexpected role changes, bans, channel deletions or new channels. - Check the Integrations tab. Discord's [webhooks page](https://support.discord.com/hc/en-us/articles/228383668-Intro-to-Permissions) says webhooks are created there with the Create Webhook button, so a webhook you did not create deserves a closer look. - Tell the other moderators, as the securing page suggests. They should check their own accounts too. Discord's pages we read do not list a full server clean-up routine, a vanity link check or a bot review, so we do not claim one. They do give the audit log, the apps list and the integrations tab as places to look. ## What Not to Do - Do not scan or approve another code, even if the sender says the first one failed. Discord says never approve a login you did not generate. - Do not message the sender back or click links in their message. The securing page asks questions to ask yourself before clicking: is the sender a stranger, is the message unexpected, does it urge you to act or promise a reward. - Do not give your password, codes or card details to anyone who says they are from Discord. Discord says its staff never contact users directly through the Discord app for support matters. - Do not pay anyone who offers to recover or protect the account. Discord's page describes impersonators offering to appeal actions on your account as a scam example. - Do not delay the password change. Discord says to change it immediately. Discord's hacked-account page also says that if you fail to secure your account and it is compromised, Discord may be unable to assist with recovery. Our guide to a [hacked Discord account and the Nitro scam](https://www.awarexone.com/research/discord-account-hacked-nitro-scam) covers the wider recovery. If you also lost your authenticator, see [Discord backup codes lost](https://www.awarexone.com/research/discord-two-factor-backup-codes-lost). ## What Discord Does Not Say Discord's securing page is dated 3 June 2022 and its QR code login FAQ shows an update date of 16 April 2024, so check Discord's pages for newer advice. The pages do not say how long a ticket takes, and they do not say what an attacker may have done while logged in. We cannot tell you either. ## When It Is Safer to Get Expert Help Some people handle this alone, and the official steps above are complete. The risks are worth stating. A scam like this targets people who are online, trusting a friend's message, and in a hurry. Discord warns that an attacker can get in without needing your password or 2FA, so a late or partial clean-up can leave a way back in. If you moderate a server, the damage can include banned members and deleted channels. And Discord says that if you fail to secure your account, it may be unable to help recover it. If you are unsure about any step, or the account matters for your income, community or business, handing the case to an experienced team such as AwareXone is the safer choice. We can help you sequence the steps, check apps and servers and avoid fake helpers. See our [account security help](https://www.awarexone.com/services/account-security) page, and use the Apply for Case Review button at the end of this guide. ## When a Case Review Makes Sense If you approved the login, you lost access, you manage a community or you cannot tell whether anything changed, a review can help you work through it step by step. SocialSafe by AwareXone is a Malaysia-based service, independent of Discord, that helps you use official routes. We never ask for your password or login codes and we cannot change Discord's decisions. See how we work on our [trust page](https://www.awarexone.com/trust). ## Frequently Asked Questions ### What does a Discord QR code scam do? Discord says scanning a scam code lets the attacker log in to your account directly, without needing your password or 2FA, even if you have configured it. ### I scanned it. What should I do first? Discord says to change your password immediately. That invalidates your current account token and logs you out of all devices. ### Can I stop the login if I only scanned it? Discord's FAQ says a QR login needs approval, and that if the login screen opens you should tap Cancel right away. ### Where do I report the scam? Discord says you can report scams to Discord Trust and Safety, and submit a ticket if you believe your account was compromised. ### How long do server audit log entries last? Discord's caps page says an entry stays in a server's audit log for 45 days. ### Can AwareXone recover my account for me? No outside service can override Discord. AwareXone can help you order your steps and check apps and servers without asking for your password. ## Official sources - [Official: QR Code Login FAQ - Discord (read 24 October 2026)](https://support.discord.com/hc/en-us/articles/360039213771-QR-Code-Login-FAQ) - [Official: Securing Your Discord Account (read 24 October 2026)](https://discord.com/safety/securing-your-discord-account) - [Official: My Discord Account was Hacked or Compromised - Discord (read 24 October 2026)](https://support.discord.com/hc/en-us/articles/24160905919511-My-Discord-Account-was-Hacked-or-Compromised) - [Official: Audit Logs Resource - Documentation - Discord (read 24 October 2026)](https://docs.discord.com/developers/resources/audit-log) - [Official: Discord Account Caps, Server Caps, and More - Discord (read 24 October 2026)](https://support.discord.com/hc/en-us/articles/33694251638295-Discord-Account-Caps-Server-Caps-and-More) - [Official: Intro to Webhooks - Discord (read 24 October 2026)](https://support.discord.com/hc/en-us/articles/228383668-Intro-to-Permissions) --- AwareXone is an independent Malaysia-based provider, not affiliated with any platform. The platform makes the final decision on every account. AwareXone never asks for passwords, OTP codes, backup codes or session cookies.