Discord DM Safety: Lock Down Messages, Friend Requests and Fake Nitro Links
Discord is where many young people talk with friends, join gaming communities and hang out after school. It is also a place where scammers hunt for easy targets. The pattern is usually the same: a stranger, or a hacked account that looks like a friend, sends a private message with something too good to be true, such as free Nitro, a "test my new game" link or a "you've been selected" offer.
Discord includes settings that cut off many of these tricks before they reach you. This guide covers the ones that matter most.
Why direct messages are the main danger
In a public server, moderators and other members can often spot and remove scam posts. In a direct message (DM), nobody else is watching. Scammers like this because they can pressure you one-on-one, rush you and push you to click a link before you think.
Common DM tricks include:
- Fake gift offers: a link promising free Nitro or in-game items that leads to a copycat login page.
- "Help me vote" or "test my game" links: often sent from a friend's hacked account, with a file or website designed to steal your login.
- QR code requests: someone asks you to scan a code, which can approve a login on their device instead of yours.
- Fake job or giveaway offers: they ask you to move to another app or to share personal details.
Step 1: Turn on Safe Direct Messages
Open User Settings, then go to Privacy & Safety. Look for the Safe Direct Messages option, which lets Discord scan DMs for explicit or harmful content. Choose the strictest option available to you. Menu names and choices can change slightly between updates, so choose the one that offers the most protection.
Step 2: Control who can contact you
In the same Privacy & Safety area, you can limit:
- Direct messages from server members: switch this off for new servers, or turn it off for specific servers you do not know well.
- Friend requests: restrict who can send them, for example only friends of friends or people in shared servers, and turn off "Everyone" if you see it.
If you never need strangers to message you, closing these doors removes the easiest route for scammers.
Step 3: Check apps and devices
Some attacks do not need your password. If you click "Authorize" on a shady app or bot, it may get access to parts of your account.
- Go to User Settings and open Authorized Apps.
- Remove anything you do not recognise or no longer use.
- Open Devices and log out of any device that is not yours.
- If anything looks wrong, change your password straight away.
Spot the scam before you click
Settings help, but your habits matter too. Pause if a message:
- Offers something free that normally costs money.
- Creates urgency, like "claim in 10 minutes."
- Comes from a friend but sounds strange, or does not match how they usually talk.
- Asks you to log in again through a link.
- Asks for a code, a QR scan or your password.
Never share your password or login codes with anyone, including people who claim to be Discord staff. If a friend sends a strange link, message them on another channel, such as in person or by phone, to check whether their account was hacked.
What to do if you clicked
- Change your password on Discord and on any other account that uses the same one.
- Log out of all devices and remove unknown authorized apps.
- Turn on two-factor authentication if you have not already.
- Tell a trusted adult. You are not in trouble, and help works faster when someone else knows.
- Warn your friends if their messages might have come from your account.
Report and block
If someone sends a scam or makes you uncomfortable, block them, then report the message to Discord. Do not reply or argue. Reporting helps moderators remove accounts that target other young people as well.
For official guidance, visit Discord's Safety Center at discord.com/safety. It explains reporting, privacy controls and tips for families, and it is the best place to check current settings, since apps change their menus over time.
The quick checklist
- Safe Direct Messages set to the strictest option.
- DMs from server members limited or off.
- Friend requests restricted.
- Authorized Apps and Devices reviewed.
- Two-factor authentication on.
Five minutes in your settings can save you hours of recovering a hacked account. Do it today, and share it with a friend.