Discord account hacked, what to do

Your Discord account is hacked when someone else is messaging your friends from it, spending money on it, or using an email address you cannot open. Discord’s hacked-account article puts the password reset and multi-factor authentication first, then the list of apps that can still act as you.

Discord is blunt about the limit. Their terms put account security on you. The same article says that if you do not secure the account, Discord may be unable to help you get it back. Do the steps you can still do yourself before you wait on a ticket.

The longer checklist is Discord account hacked. The inbox on the account matters as much as the password. If you no longer control that email, start with Personal email account hacked. Other social accounts that used the same password belong with Social media account hacked.

If the email on the account changed

Discord sends a notice to the old address after an email change is confirmed. Their undo article says the button reads Start Account Recovery. You have 48 hours. The link is generated for your account. Do not forward it, and do not paste it into a chat.

Check the address bar before you type anything. Discord says the URL always starts with https://discord.com/wasntme/. Any other address is not their recovery page.

On that page, press Start revert process. Discord says the revert does all of this:

• Puts the email back to the address that received the link.
• Logs the account out of every device.
• Makes you set a new password.
• Removes any phone number on the account.
• Removes any multi-factor methods.
• Invalidates recovery links that were created after the one you used.

You will need a password of at least 8 characters. Discord says some regions add more rules. The error for a bad password, an expired link, or an email that another Discord account already uses shows up when you set the password, not before. If the old address is now on a different Discord account, free it before the revert can finish. If the link is older than 48 hours, it is dead. A recovery that already ran also kills links that were created later.

When you are back in, add multi-factor authentication again. The revert removed it. That is the point. The other person’s codes no longer work, and neither does a phone number they added.

If you can still sign in

Change the password before you argue with anyone in a server. Discord’s password article says a password must be at least 8 characters, and that a longer password beats one that is mostly symbols. Use a password this account has never used. If multi-factor authentication is already on, Discord asks for a code before the change.

On a computer:

1. Open User Settings with the cogwheel next to your username.
2. Under My Account, choose Change Password.
3. Enter the current password and the new one.

On a phone:

1. Tap your avatar at the bottom right, then the cogwheel at the top right.
2. Tap Account.
3. Tap Password, enter the current password and the new one, then tap Change Password.

If you do not know the current password, use Forgot your password? on the login page at discord.com/login. Enter the email still tied to the account. Discord sends the reset instructions to that inbox. If that inbox is the one the other person changed, use the 48-hour link above instead of waiting on mail you cannot open.

Remove apps, then turn multi-factor authentication on

A password change does not, by itself, deauthorize apps. Discord’s hacked-account article says to review Authorized Apps and remove anything you do not want.

On a computer:

1. Open User Settings with the cogwheel at the lower left.
2. Open Authorized Apps.
3. Press Deauthorize on anything you do not recognise.

On a phone:

1. Tap your avatar at the bottom right, then the cogwheel at the top right.
2. Open Authorized Apps.
3. Remove anything you do not recognise with the x button.

Then turn multi-factor authentication on. Discord’s MFA article lists three methods. They recommend a security key or a passkey. A passkey uses your fingerprint, your face, or the device screen lock. On a computer, open User Settings, open Account, choose Security Keys, then Add.

An authenticator app is the other strong option. Discord’s authenticator article names Google Authenticator and Authy.

On a phone:

1. Tap your avatar, then the cogwheel.
2. Open Account, then Enable Authenticator App.
3. Copy the secret into the authenticator, or follow the steps in the Discord app.
4. Enter a code the authenticator generates, so Discord knows it works.
5. Download the backup codes and store them outside Discord and outside your email.

On a computer, the button is Enable Authenticator App under Password and Authentication on the My Account page. Scan the QR code, enter the 6-digit code, and tap Activate. Download the backup codes here too.

Discord says each backup code works once. If you lose the authenticator and the codes, Discord cannot get you back in. After you are safe, generate a fresh set. You can view the codes later from User Settings, My Account, View Backup Codes.

Discord does support codes by text. They say text is better than nothing, and not by much, because a SIM swap can intercept it. Text can be turned on only after an authenticator app is already on. Use the authenticator as the method you rely on. The phone number the revert removed should stay off until the account is yours again.

Tell friends, from a different app

The usual point of a stolen Discord account is the next victim. Discord says suspicious files and links often pretend to be games or free Nitro. A person in a DM may also pretend to be staff who can “appeal” a ban, or who needs a card number to finish a giveaway.

Discord staff will not contact you inside the app for support. If a DM asks for payment, personal details, or a password change, stop replying.

Message the people who got the link. Use text, a phone call, or another app. Ask them not to open the file and not to enter a password on the page it opened. If you clicked the file yourself, on Windows, Discord recommends a Windows Defender scan. Set the new password from a different device if that download is the thing that took the account.

To report one of those messages inside Discord, long-press it on a phone, or right-click it on a computer, then choose Report Message.

If you still cannot get in, or the card was charged

File one ticket at dis.gd/hackedaccount. Discord’s hacked-account article points there when you believe the account was accessed. If money moved, include the unauthorized transactions in that ticket.

The unrecognized-charge article splits the form by what you still control.

If the email changed:

1. Submit the support form.
2. Choose Hacked Account.
3. Enter your email, the original username, and the original email from before the compromise.
4. Add the user ID if you know it.
5. Answer yes when asked whether the email changed.

If you still have the email and you can see the charge on the account, choose the unauthorized-transaction type and say yes, you are using the email linked to the account. If you cannot get into that inbox and the email was not the thing that changed, the same article has a path where you answer no to both email questions.

Include the transaction date and amount, the payment method, and a payment identifier such as the last 4 digits of the card. A screenshot of the charge on the statement helps. Discord says missing payment details delay the case.

They aim to resolve these requests within 72 hours. Some cases take longer. Send one ticket per issue. Extra tickets slow the queue.

One warning from both the hacked-account FAQ and the charge article: contact Discord’s billing team before you dispute the charge with your bank. A chargeback filed with the bank for a Discord transaction may suspend the account while Discord investigates. The card issuer is still the right place for a charge that never touched a Discord account you own. If the charge is on your Discord account, start with Discord’s form.

To copy your user ID for the ticket, turn on Developer Mode first. Discord’s ID article says, on a computer, open User Settings, open Advanced, and toggle Developer Mode on. Then right-click your name and choose Copy User ID. On a phone, the toggle is under App Settings, Advanced. Tap your profile, tap the ellipsis, then Copy User ID. If you are locked out, a friend can copy it from your profile the same way, once Developer Mode is on for them.

The purchase email

Discord’s payment FAQ describes a mail with the subject “Authorize Payments for Discord Client” and a Verify Purchase button. Tap that button only when you recognise the purchase. If you did not try to buy anything, leave the button alone. Discord says that mail can mean the account is compromised. Change the Discord password, turn on multi-factor authentication, and do the same on the email account. Then use the support form.

When the account is yours again

You can sign in with the new password. Multi-factor authentication asks for a code you can produce. The email on the account is one you open. Authorized Apps has no names you do not know. A friend confirms the scam messages have stopped.

Leave any server that existed only for the scam. Do not appeal a ban through a DM. If the inbox was how they got in, finish Personal email account hacked before you treat Discord as done. Then open Discord account hacked and do the prepare list, including a copy of your user ID stored outside the app.

Related playbooks

• Discord account hacked. Your Discord account is messaging friends, spending money, or using an email address you cannot open.
• Personal email account hacked. Someone else is in your email, which means they can reset the password on almost everything else you own.
• Social media account hacked. Someone took over your Instagram, Facebook, X, or TikTok and is posting, messaging your friends, or holding it for ransom.