ESN Guardian › Guides

Scams

The Discord QR code scam, and how to stop it

By ESN Systems, makers of ESN Guardian. Updated November 3, 2026.

The QR code scam takes over Discord accounts without ever asking for a password. Here is how it works, the signs to watch for, what to do if you already scanned one, and how to keep the codes out of your server.

How the Discord QR code scam works

Discord lets you log in on a computer by scanning a QR code with the Discord app on your phone. Discord explains the feature in its QR Code Login FAQ: the code on the login screen belongs to that one login session, and when you scan it with your already-logged-in phone and confirm, that session is logged in to your account.

The scam turns that around. A scammer opens Discord's login page on their own machine, grabs the QR code it shows, and puts it in front of you dressed up as something else:

• “Scan to verify.” A fake verification bot in a server says you must scan a code to get access to the channels.
• “Free Nitro” or a gift. A DM or a post says scanning the code claims a reward.
• “Prove you're not a bot.” A message from a “staff member” or a look-alike of a big server's bot asks you to scan before you can chat.

When you scan it with the Discord app and accept, you are not verifying anything. You are logging the scammer's browser in as you. They now have a working session on your account without ever knowing your password, and the first thing most of them do is post the same scam in every server you are in, or use your roles if you are staff.

Why it catches careful people

People are taught not to type their password into strange sites, and this scam never asks for one. The phone shows a real Discord screen, because it is the real Discord app doing a real login. And because the hacked account is someone the next victim already knows, the next “scan to verify” message comes from a friend.

The rule is short: never scan a Discord QR code that you did not open yourself on Discord's own login page. Real servers do not verify you with a QR code, and real gifts are claimed by pressing a button in the app, not by scanning anything.

Signs a server or message is running the scam

• A “verification” step that shows an image of a QR code instead of a button or a captcha.
• A bot with a name close to a well-known verification bot, added recently, that is the only way into the server.
• A DM from someone you know that sounds unlike them, with a QR image and a deadline.
• Links in the same message that point to look-alike domains (paste them into our scam link checker before opening anything).

Already scanned one? Do this now

1. Change your Discord password. Changing it logs out other sessions.
2. Turn on two-factor authentication if it is off. Discord's guide: Setting up Multi-Factor Authentication.
3. Check Settings → Devices and log out of anything you don't recognise, then check Settings → Authorized Apps and remove apps you didn't add.
4. Warn the servers you're in, especially if you are staff, so nobody trusts messages sent from your account in the last hour.
5. If you can't get back in, follow Discord's own steps: My Discord Account was Hacked or Compromised.

How ESN Guardian blocks QR scams in your server

A server owner can't stop members from scanning things, but a bot can stop the code from being posted in the first place, and limit the damage when an account does get taken.

• QR and image scam scanner. Guardian reads QR codes in images posted in your server. A code that leads to a Discord login, a known scam domain or an IP logger is deleted and the poster gets a warning. It is on by default, and /security rare mode sets it to log-only or off.
• Hacked-account detector. When a long-time member suddenly posts a scam QR or scam link, Guardian treats it as a likely hacked account and quarantines it, instead of treating it like an ordinary rule break.
• Known scam images. Staff can add a scam image to the server's blocklist with /sentry image-block, so re-posts of the same picture are caught.
• Recovery for hacked members. /sentry recover quarantines a hacked member and DMs them a recovery checklist, so they can get their account back and rejoin cleanly.
• Scam DMs. Members can report a scam DM from someone in your server with /watchtower dmreport, so staff see it even though the DM never touched a channel.
• Scam links. Guardian's automod checks links against its list of known scam domains, including links hidden behind spoilers and in forwarded messages.

Set it up

1. Add Guardian and keep every permission ticked, then drag its role above the roles it should protect.
2. Run /guardian setup and pick a preset.
3. Check /security rare status to see the QR scanner and hacked-account detector and how they are set.
4. Use a real verification gate (/captcha or /gate) so members never get used to “scan to verify” in your server. See the Discord verification bot guide.

Sources: Discord's QR Code Login FAQ, Protecting Against Scams on Discord and My Discord Account was Hacked or Compromised. Checked November 3, 2026.

Questions

Running your own Discord bot? ESN Hosting runs Discord bots 24/7, from $0.50/mo →

More guides