If your Discord account is posting links you never sent, someone else is logged in as you. The usual cause is a fake "free Nitro" page, a QR code you scanned to "verify", or a file you ran. Act in this order: take the account back, lock it down, then tell the servers it spammed so they can clean up and give your roles back.

1. Take the account back (first 5 minutes)

  • Change your password. User Settings, then My Account, then Change Password. Changing it logs out most other sessions.
  • If you can't log in, use "Forgot your password?" on the login page. If the email was changed too, contact Discord support from support.discord.com with the old email address.
  • Turn on two-factor authentication (an authenticator app, not only SMS), and save the backup codes somewhere offline.

2. Remove whatever let them in

  • Devices: User Settings, then Devices. Log out every session you don't recognise, or all of them.
  • Authorized Apps: remove apps and bots you don't remember adding. Scam "verification" apps often stay here.
  • Your computer: if you ran a file someone sent you, scan the computer and change the passwords saved in your browser too. Token-stealing programs read them.
  • Your email: change the email account's password and turn on two-factor there as well. Whoever controls your email controls your Discord.

3. Clean up after the spam

  • Tell friends the links were not from you, and that nobody should click them.
  • Message the staff of servers you were kicked or timed out from. Most will restore you once you say you're back in control.
  • Check your DMs for messages "you" sent and delete them.

How hacked accounts usually happen

  • Fake Nitro or gift links: a page that looks like Discord asks you to log in. The address is close but not discord.com or discord.gift.
  • QR code "verification": scanning a Discord login QR code with your phone logs the other person in. Never scan one someone sends you.
  • "Try my game" files: a friend's hacked account sends an .exe or a zip. It steals the login token from your computer.
  • Fake staff: someone copies a moderator's name and picture and asks for your login code "to verify you".

For server owners: catch it and treat members as victims

A hacked account posts the same message in many channels within seconds. A person doesn't. Noxyr's free security bot watches for exactly that pattern:

  • It deletes every copy and times the member out, so nobody else clicks.
  • It DMs the member the same recovery steps as this page.
  • Staff get one alert with a Restore button that lifts the timeout and gives back the roles once the member is safe.
  • Lookalike scam links, fake staff names and raids have their own rules, and the server security checker scores your settings out of 100.

Common questions

Will Discord give my account back? If you still control the email on the account, a password reset is enough. If the hacker changed the email, Discord support can help when you write from the original address.

Is two-factor enough? It stops password logins, but not a stolen token or a QR code you scanned. Don't run files from strangers and don't scan login QR codes.

Why was I timed out? Servers time out accounts that spam so the links stop spreading. It's not a punishment; ask staff to restore you once you've changed your password.