What the user sees
The lure as presented
- A DM arrives with a staff-like name, avatar, or title.
- The message cites policy violations, reports, verification, or server administration.
- It may request personal information, codes, email changes, or external link actions.
What happens behind the scenes
What the attacker is trying to obtain
1Staff-like DM
2Urgency
3Code or action request
4Account compromise
- Authority and urgency are used to reduce scrutiny.
- A convincing profile does not make a normal user account an official support channel.
If you fell for it
What to do first
- 1Review what actions were taken, then change passwords, revoke sessions, and check connected apps.
- 2If codes or recovery details were shared, contact official support.
- 3Report the account and block further contact.
How to avoid it
Where to stop before damage
- Do not trust ordinary DMs claiming to be Discord staff.
- Never share verification codes, passwords, or backup codes.
- Verify through official help pages or in-app system notifications.