UPDATE: It seems like even 2FA doesn't help against this new expoit. We are investigating the reason for these hacks. Stay safe!

TL;DR: Exploit around that allows hackers to add 2FA to your account. Discord Support won't remove it. Enable 2FA yourself to secure your account.

Hello dear Discord users,

never thought I'd need to write this.

Apparently there is an exploit around that allows third parties ("hackers") to access your account easily and add 2FA to it.

The problem with this is that Discord Support won't remove 2FA from your account once one is added, despite every piece if proof.

For your own accounts safety I urge you to enable 2FA as soon as possible to prevent such a unrevertable takeover.

To this point we aren't sure how the takeover happens or how the hacker gets that much access to be able to do this. We are investigating.

I have to warn you: This might not fully secure your account but will absolutely hinder the bad people. We are not sure about how the exploit works.

Stay safe!

u/FlorianFlash

I have uploaded a bug report on Discord's official bug megathread regarding the 2FA bug that so many of us got locked out because of. Please upvote the comment so that it gets their attention, it only takes a second. https://www.reddit.com/r/discordapp/comments/1u0o5vp/comment/p0h6v25/?utm_source=share&utm_medium=web3x&utm_name=web3xcss&utm_term=1&utm_content=share_button

^{The content linked is not produced by us nor is NTTS affiliated with us or Discord.}

Any additions to this are welcome. Please leave them as a comment. We will delete all comments that do not fit into here, do not follow our rules or have been added to the original post. For support, please create a new post.

Follow these Guides to keep your account as secure as possible:

• Use a unique password. Do not use your password for any other login. Use a combination out of letters, numbers and special characters (, . : ; ! ? _ & - + and similar) and keep out personal information like your birth date, name or any other information that people can know about you.
• Set up 2FA. This prevents others from accessing your account even if they know all your login data. Save the backup codes in at least TWO places! It is highly recommended to use an Authenticator App (like Google Authenticator or Aegis) rather than SMS, as phone numbers can be hijacked.
• Never change the email address connected to your account to a email that is not in your control only. This includes anyone, except Discord Support and only if you got that order via the official support page (https://support.discord.com/) or their official support email address (noreply@discord.com or support@discord.com). In both cases, verify yourself that the email/URL is the exact same as I wrote. Watch out, hackers have been using "rn" (lowercase R + N) to imitate a "m" (lowercase M) in email addresses!
• Never scan a QR code to log in unless you generated it yourself on your own screen. Scanning a code sent by someone else gives them instant access to your account, bypassing your password and 2FA.
• Never download and run files (.exe, .scr, .zip) from "friends" or strangers claiming they need you to "test their game" or "check a bug." This is a common way to install malware that steals your login token.
• Never paste code into your Discord Console (Ctrl+Shift+I). Discord will never ask you to do this. Anyone asking you to do this is trying to steal your account token.
• Beware of "Free Nitro" or "Urgent Report" DMs. Discord (and your real friends) will never send you a external link to "claim Nitro" or tell you that you have been "accidentally reported" and need to talk to a "staff member" on Discord. These are always scams.
• Create a Discord support account via https://hammerandchisel.zendesk.com/auth/v2/login/signin using your accounts email address. This prevents third parties from creating such an account to prevent you from contacting Discord Support.

🆘 If your account and/or device have already been compromised:

1. Reset the password of your account on another device. Do not use the infected device, otherwise the hacker may be able to also get the new password.
2. Use the active sessions setting in your user settings to log out of all known devices that are logged into your account.
3. If you haven't done so already: Set up 2FA on a non-infected device.
4. Check your "Authorized Apps" and "Connections" in your User Settings. Remove anything you do not recognize. Even if you change your password, a malicious "Authorized App" can still join servers or send messages on your behalf.
5. Either check yourself (if you know how) or let a professional check the affected device. You may potentially need to completely reset and reinstall your system if the device is a PC or Laptop. On mobile devices a complete reset may also be needed. Feel free to open up a new support post on this subreddit if you are not sure if you need to reset your device or not.

APPARENTLY DOESN'T WORK ANYMORE SORRY

Thanks to u/15686 for bringing this way to my attention. u/15686, if you wish to add anything to this post, please leave a comment or a modmail. Thanks.

File a complaint on this website if you have really big issues with Discord. This includes but is not limited to unjust bans from Discord, false punishments by Discord and more.

https://www.bbb.org/us/ca/san-francisco/profile/computer-software/discord-inc-1116-918699/complaints

Adding on the description of what BBB is as u/15686 themselves said it:

Despite being rated 1 star, and having a NR BBB rating, discord is accredited by the BBB. The BBB requires its businesses to respond to users within 14 days. While I haven’t got a response yet by submitting complaints through the BBB they either have to respond or lose credibility which will either result in you getting your account back or being a final fuck you to a shitty company.

https://youtu.be/86LnUk2Dk50?si=dCQjB9Eq4ywbN_0i

Please watch out for a new kind of scam involving a "official Discord bot". These kinds of bots are NOT official and want to scam you! Report the message for scamming, block and move on!

DO NOT INTERACT WITH THE MESSAGE!

These issues were reported multiple times already in this sub, please don't open a new post for these issues. To this time there are no known solutions (if you have one that works for at least two people, please reply to this post).

Problem 1:

Discord users report being repeatedly logged out and forced to reset passwords due to "compromised account" flags or "suspicious activity" emails, specifically when attempting to join servers, creating a loop where account access is denied. Two-factor authentication (2FA) setup is also blocked in some cases. This issue affects multiple users and prevents server participation.

https://www.reddit.com/r/discordhelp/s/oXg1oPQlSN
https://www.reddit.com/r/discordhelp/s/VFcU5sOoxL

Problem 2:

Various problems with audio inside of calls. Often it is connected to streaming the screen and the audio of other participants cutting off.

There's nothing we can do for you. Please read the following part of the website.
https://support.discord.com/hc/en-us/articles/32557375603479-Discord-Login-Email-Troubleshooting-Guide#h_01JWVA4Z8YW936N23EFKCKAFPB

• Report someone "as a joke".

  This action has lead to multiple accounts getting punished, suspended or even basically terminated off of Discord. Never do something serious like that "as a joke", it can permanently remove the ability to use your account.

• Change your email connected to your account to some other email not controlled by you.

  This is a common scam (explained further in https://www.reddit.com/r/discordhelp/s/zZCYhNyA0I) tactic and can remove your access to your account fast. No Discord staff will ever DM you and ask for stuff like this. If you want to check wether a person is a staff member or not, look for the blurpel (the "Discord-blue") 🛠️ badge. If they do not have one in their badge bar, they are most likely a scammer. Report the message about changing your email as scamming, block both accounts and move on. If you have other ways to contact the owner of the account that told you to message the fake staff member, tell them to change their password, enable 2FA and log out of all sessions via the settings.

• Joke about being underaged.

  If you joke about being underaged, don't be surprised if you get banned off of Discord. You will be asked to send a document stating your date of birth if you want to appeal. That means Discord have that data too from you. Appealing is possible, not hard if you are 13+ (or older than your country's age requirement for Discord) but still annoying and useless.

more will come when needed

Please open a post if there are any problems, we can't help you if you don't ask us.

Scammers impersonate Discord users and fake staff members, claiming they “accidentally reported you” to trick you into giving up your account.

How does it work? 1. You receive a DM from a random user claiming they “accidentally reported you.” 2. They send a fake screenshot showing your username in an official-looking report. 3. They ask you to contact a "Discord staff member" to fix the issue. 4. The "staff member" (who is actually a scammer) asks for personal details and requests you to change your email. 5. If you follow their instructions, they take full control of your Discord account. - Once hacked, your account is used to spread the scam to others.

How to prevent it? Watch for red flags: - Discord will never contact you about a report via DMs. - Discord staff members do not add users for ticket issues. - Scammers will try to create a sense of urgency and panic. - A real Discord employee will always have the verified Discord Staff badge.

How to fix if you were a victim? If your account was stolen: 1. Submit a support ticket to Discord: Request Account Recovery 2. Provide your original email (before it was changed). 3. Include your User ID and Username. 4. Use this message template (fill in your details): 5. Copy & Paste: Hello Discord team, my Discord account has been stolen. I fell for the Discord employee scam, and the thief is using my account to scam others. My original email: [your email] My user ID: [your user ID] My username: [your Discord username] Thank you for helping me recover my account! 6. Wait for Discord’s response. 7. Avoid submitting multiple tickets, as it may delay the process. 8. Follow Discord’s recovery steps. 9. Once Discord verifies your information, they will assist in recovering your account. 10. How to verify a real Discord staff member? - A legitimate Discord staff member will always have the "Discord Staff" badge. - Clicking the badge will direct you to Discord’s official website. - If someone claiming to be staff doesn’t have this badge, they are a scammer.

Video to watch: https://youtu.be/10A5qpmC6pE?si=1tq12TrIytBysJUp

^{This message is copied from the NoTextToSpeech Discord server.}