You join one server for a game you just picked up, and by the end of the week your inbox has a "free nitro" link, a stranger asking to "test their game," and a friend request from someone you never met. None of that is bad luck. It is what happens when Discord runs on its default settings.
The good news is that most of the protection is already built in. It just sits a few menus deep. Spend fifteen minutes on the screens below once, and the app quietly filters out a large share of the junk before it ever lands in front of you.
🔐 Have you locked the front door on your login?
Everything else in this guide matters less if someone can simply sign in as you. Start with the account itself, under User Settings → My Account (menu names shift a little between app versions, but the layout stays close).
- Turn on two-factor authentication (2FA). Use an authenticator app rather than SMS when you can. Text codes can be hijacked through SIM swaps; an app on your phone is much harder to steal remotely.
- Save your backup codes somewhere offline. A note in a password manager or a printed sheet in a drawer both work. If you lose your phone, those codes are your way back in.
- Use a unique password. If your Discord password matches the one you used on an old forum that got breached, attackers will try it here first.
- Check the email on file. Make sure it is an inbox you still control, because that is where password resets go.
Tip: Discord staff will never DM you asking for your password, your 2FA code or a QR code scan. Anyone who does is running a scam, no matter how official the profile looks.
One more thing worth knowing: logging in by scanning a QR code is convenient, but it is also a favorite trick of scammers. If someone sends you a QR code and says "scan this to verify," they are asking you to log them into your account.
It also helps to think about who else uses your devices. If you play on a shared family PC or a friend's laptop at a LAN night, log out when you leave. A browser tab that stays signed in is just as good as a stolen password to whoever sits down next, and you may not notice anything for days.
📬 Who is allowed to slide into your DMs?
Direct messages are where most scams happen, so this is the screen with the biggest payoff. Open Privacy & Safety (some versions split it into "Content & Social" and "Data & Privacy").
The first decision is whether members of the servers you share can DM you at all. By default, anyone in a common server usually can. That means joining a big public community with tens of thousands of members opens your inbox to every one of them.
You have two levels of control:
- The global toggle decides the default for servers you join from now on. Turning it off is the strongest option.
- The per-server toggle lives in each server's Privacy Settings (right-click or long-press the server icon). Use it to allow DMs only in small servers where you know people.
Next, look at message requests. When someone outside your friends list messages you, Discord can route it to a separate requests tab instead of your main inbox. Keep that on. It gives you a moment to look at a message before replying or even opening links.
Finally, check the spam and sensitive content filters. Set them to filter messages from people who are not your friends at the very least. These filters are not perfect, but they catch a lot of the obvious bait.
🤝 Who can send you friend requests?
Friend requests matter because friends get more trust from the app: their messages skip the requests folder, and you are more likely to click what they send. Under the friend request settings you will usually find three checkboxes:
| Option | What it allows | Who should keep it on |
|---|---|---|
| Everyone | Any user who knows your username can add you | Streamers who want open contact, rarely anyone else |
| Friends of friends | People who share at least one friend with you | Most players, it is a reasonable middle ground |
| Server members | Anyone in a server you are in | Only if you are in small, private servers |
For most people, unchecking "Everyone" is the single easiest win. Random requests drop sharply, and anyone you actually play with can still reach you through mutual friends or a shared small server.
A friend request is also not a reason to accept. If the profile was created recently, has no mutual friends and opens with a link, decline and move on. Blocking is always available and costs you nothing.
🧩 What have you connected to your account?
Over time most accounts collect a pile of extras: game launchers, streaming platforms, music services, and bots or apps you authorized for one server event three years ago. Each of those is a door.
Review these two areas:
- Connections shows linked accounts such as streaming or game platforms. Decide which ones you want displayed on your profile. Showing every linked account makes it easier for someone to piece together your identity across sites.
- Authorized Apps lists third-party applications that can act on your behalf. If you do not recognize one, or you stopped using it, remove its access.
Also look at Devices (sometimes listed as active sessions). It shows where your account is currently logged in. An unfamiliar location or device type is a red flag. Log it out, then change your password right away.
Checklist for your connections review:
- Remove apps you do not remember authorizing
- Hide linked accounts you do not want public
- Log out of old devices and browsers
- Confirm 2FA is still active after any change
🧑🤝🧑 How do you handle servers without regret?
Servers are the fun part of Discord, and they are also where you meet the most strangers. A few habits keep the risk low.
Check what the server can see. Your profile, your roles and your messages are visible to everyone in that server. Server owners and moderators can also see a little more, such as when you joined. Treat anything you post in a public channel as public.
Use server profiles. Discord lets you set a different nickname and, in many cases, a different avatar per server. If you play in a school club server and also in a huge public community, it can be smart to keep them looking unrelated.
Mute and leave freely. A server that floods you with pings or pushes "giveaways" is not worth staying in. Leaving is instant and nobody gets a notification.
Be careful with verification bots. Many legitimate servers use a bot that asks you to click a button or react to a message. That is normal. What is not normal is a "verification" that sends you to an outside site asking for your Discord login, or one that asks you to paste something into your browser console. That is account theft, every time.
Watch the roles you accept. Some servers hand out roles that unlock private channels, trading areas or "VIP" sections. Those spaces can be great, but they are also where people feel safe enough to drop their guard. Keep the same rules there that you use in public: no passwords, no off-platform payments, no downloads from people you just met.
🚨 What should you do when something feels off?
Sooner or later a message will slip through. Having a plan keeps you from panicking and clicking.
- Stop before clicking. Hover over or long-press links to see the real address. Lookalike domains with swapped letters are common.
- Verify through another channel. If a friend suddenly sends a strange link or asks for money, message them on a different app or ask them in voice. Compromised accounts are often used to target their friends list.
- Report and block. Use the report option on the message itself. It helps Trust & Safety spot patterns across many accounts.
- If you already clicked or logged in somewhere suspicious, change your password immediately (this also resets your login token), make sure 2FA is still on, and review authorized apps and devices.
- Tell the server moderators if the scam came through a server. They can remove the account and warn other members.
For younger players, Discord also offers a Family Center feature that lets a parent or guardian see an activity overview, such as new friends and servers joined, without reading message content. It is worth a look in households with teens who game.
🏁 The ten-minute version
If you only do a few things today, do these: turn on 2FA with an authenticator app, switch off DMs from server members by default, disable friend requests from "Everyone," and clear out apps and devices you do not recognize. That combination removes the most common paths that scammers rely on.
Discord's defaults are built for convenience, not caution. Flip a handful of switches and you keep all the fun of the platform with far fewer surprises in your inbox. Then put a reminder on your calendar to repeat this review every few months, since settings and features change.
❓ Frequently Asked Questions
Will turning off server DMs stop my friends from messaging me?
No. Friends can always message you directly. The toggle only affects people you share a server with but have not added as a friend.
Is Discord Nitro ever given away through DMs?
Official promotions show up inside the app or on Discord's own channels, not through random DMs from strangers. A message promising free Nitro with a link is almost always phishing, so delete it and report it.
Does Discord show my real name or location to other users?
Not by default. Other users see your display name, username and whatever you put on your profile. Your location is not shown, but anything you share in chats or linked accounts can reveal more than you intend.
How often should I review these settings?
Every few months is a good rhythm, and always after a big app update or after joining several new servers. A quick pass takes only a few minutes once you know where everything lives.