Why does the message really come from a friend's account?

Because that friend's account was likely already compromised by the same scam. Once a Discord token is stolen, the attacker can send messages from that account to all its friends and servers, spreading the scam further down the chain.

I scanned the QR code or entered my login on the fake site, what now?

Change your Discord password immediately from a trusted device, and log out of all active sessions in your security settings. Enable two-factor authentication if you haven't already, and warn your contacts that your account may have been compromised.

Discord Nitro Scam: QR Code That Steals Accounts (2026)

The QR code trap: scanning a QR code sent by a "friend" with the Discord mobile app doesn't grant access to an exclusive server — it authorizes the scammer's browser session directly, giving them full access to your account without needing your password or 2FA code.

How the scam works

Step 1

A friend's compromised account

The message comes from an already-compromised account, which makes it credible — it really is your friend's identity, just not your friend typing.

Step 2

The link or QR code

A promise of free Nitro, a gift, or exclusive server access, with a link or QR code to scan.

Step 3

The fake Discord login

The link opens a page that perfectly mimics the Discord login, or the QR code directly authorizes a hijacked session.

Step 4

The stolen token

Once the token is stolen, the attacker uses your account to send the same scam to all your friends and servers — the chain continues.

How to spot it

An unsolicited offer of free Nitro or a gift, even from a friend.
A QR code to scan to "join" or "unlock" something — Discord doesn't work this way for gifts.
A link that opens a Discord login page outside the official app.

What to do

Don't click, don't scan any QR code sent this way.
Verify directly with your friend through another channel before trusting the message.
Enable two-factor authentication on your Discord account.
If you've already clicked, change your password immediately and log out of all active sessions.

Egidio: your automatic phishing detector

This scam spreads by text and messaging as much as through Discord itself. Egidio flags known fraudulent links before you click.

Egidio screens incoming calls and scans links arriving through your messaging apps in real time and blocks known fraudulent pages the moment they're recognised.

Install Egidio