How to stop hacked accounts from spamming scam links in your Discord

You have probably seen it: a member who has been around for months suddenly posts "free Nitro" in every channel, all within a few seconds. They did not decide to scam your server. Their account was taken over, and the attacker is using its reputation to reach as many people as possible.

This guide covers how it happens, how to stop most of it before it starts, and what to do when it gets through anyway.

How accounts get hacked

Most compromised Discord accounts fall for one of a few tricks:

• Fake login pages. A link to a "free Nitro" or "verify your account" page that looks like Discord and asks for a password or a QR code scan.
• "Try my game" downloads. A friend (often already hacked) asks you to test their game. The file steals the login session from your computer.
• Fake giveaways and fake staff. Someone claiming to be from Discord or a popular bot asks you to log in somewhere to claim a prize or avoid a ban.

Once the attacker has the account, they use it to post the same scam to every server and DM it can reach. That is why the messages arrive in a burst, and why they come from someone your members trust.

Settings that stop a lot of it

None of these cost anything, and together they make your server a much harder target.

1. Set a verification level. In Server Settings, under Safety Setup, set verification to at least Low. Higher levels slow down brand-new accounts, which helps against throwaway spam accounts.
2. Turn on Discord AutoMod. The built-in rules for mention spam and suspected spam catch some of these messages out of the box. You can also add keyword rules for phrases like "free nitro".
3. Require 2FA for moderators. If an account with moderator powers is hacked, the attacker can do far more damage. Requiring two-factor authentication for moderation actions makes that much harder.
4. Give staff only what they need. Most moderators do not need Administrator. The fewer accounts that can delete channels or ban members, the less a single hacked account can wreck.
5. Limit where links can be posted if your server does not need them everywhere. Slowmode on busy channels (Flo has /slowmode) also blunts a burst of spam.

Add an anti-scam bot

Discord's built-in tools are a good base, but they were not designed specifically for a trusted account that suddenly goes rogue. That is the gap an anti-scam bot fills.

Flo's anti-scam protection watches for the pattern of a hacked account: the same scam link or scam image fired into channel after channel. When it sees it, it deletes the messages and can time the account out, so the spam stops at the source. Each action lands in your log with the reason and the message that triggered it, so your team knows what happened.

To turn it on:

1. Add Flo to your server.
2. Sign in to the dashboard and switch on hacked-account protection.
3. Choose the response (delete, time out, or both) and pick a log channel.

Automatic hacked-account protection, scam image detection and tripwire trap channels are on the Pro and Ultra plans ($5.99 and $19.99 a month). Free servers get hacked-account alerts, along with automod and phishing link blocking. See pricing for the full lists.

Time out, do not ban

It is tempting to ban a hacked account on sight. Usually a timeout is better. The person behind it is a real member who has had a bad day. A timeout stops the spam immediately, and when they recover their account, they can carry on without needing an unban.

When it happens anyway

No filter catches everything. When a scam gets through:

1. Time the account out so it cannot post anything else.
2. Delete the messages. A bulk delete of that member's recent messages is faster than deleting them one by one. Flo's /purge does this.
3. Warn your members with a short message: do not click the links, and if you did and entered your login, change your password.
4. Reach the member another way if you can, and tell them their account was compromised. They should change their password, turn on two-factor authentication, and log out of all devices from Discord's settings.
5. Remove the timeout once they confirm they have their account back.

The short version

Turn on a verification level, Discord AutoMod and 2FA for moderators. Keep powerful permissions to a few trusted people. Add an anti-scam bot to catch hacked accounts in the act. And when one slips through, time out first, clean up, and help the member recover.

For the wider picture of keeping a server safe, see our Discord moderation bot page. If you are also setting up a new server, the gaming community guide covers roles and safety settings together.

Add Flo to your server and turn on hacked-account alerts today.