Free Nitro and Steam gift scams on Discord: how they spread and how to stop them
"Free Nitro for everyone" and "I'm giving away my Steam inventory" are the most common scam messages on Discord. They work because they come from friends' accounts. Here's how to recognise them and protect your server.
What the messages look like
The details change every week, but the patterns don't. The links below are made harmless on purpose (hxxps, [.]):
| The message | What it wants |
|---|---|
| 🎁 Free Nitro for everyone, claim before it expires → hxxps://dlscord-gift[.]com/claim | Your Discord login, on a fake page |
| I'm quitting the game, giving away my skins / a $50 Steam gift → hxxps://steamcommunlty[.]gift/… | Your Steam login, on a fake Steam page |
| Is this you in this video? 😳 → link | Your login, or a download that steals it |
| Can you test my game? → download link | Malware that steals your Discord token |
| Scan this QR code to verify / get your role | To log in as you through Discord's own QR login |
They often add urgency ("only 10 left", "expires in 1 hour") and a familiar look: the Nitro logo, a fake Discord embed, a Steam-style page.
How the scam spreads from one account to the next
- Someone clicks a link and logs in on the fake page, scans the QR code, or runs the download.
- The scammer now controls their Discord account. A script posts the same message in every server and channel it can reach, and DMs every friend.
- Friends trust the account, so some of them click too, and their accounts are taken over next.
This is why a compromised account in your server is a problem even if nobody falls for the message: the next victim is one click away, and the longer the message stays up, the more people see it.
How to spot a fake link
- Look at the domain, letter by letter.
dlscord,discorcl,steamcommunltyanddiscord-nitro-giftare not Discord or Steam. - Real Nitro gifts are shown by Discord itself, as a gift embed in the chat with an Accept button. They never ask you to log in on a website.
- Nobody gives away valuable items to strangers, and "I accidentally sent this to you" stories are always scams.
- Never scan a QR code to "verify" on a server or for a giveaway. Discord's QR login logs that person in as you.
- Don't download "games to test" from DMs, even from a friend: their account may already be compromised.
What server staff can do
- Catch the scripts automatically with a honeypot trap channel, so the scam is removed from every channel within a second, often before anyone sees it.
- Block the words only scams use in your community with Discord's AutoMod, and turn on its spam rules.
- Pin a short warning in your announcements: "Staff will never ask you to scan a QR code or log in through a link."
- Require 2FA for moderator actions, so a compromised moderator can't ban or delete.
- Have a plan for when it happens: see how to stop compromised accounts spamming scam links.
If you clicked the link
- Change your Discord password straight away, from a device you trust. If it's a Steam link, change your Steam password too.
- Turn on two-factor authentication on both accounts.
- Remove unknown apps in Discord's User Settings → Authorized Apps.
- If you downloaded something, scan your computer for malware before logging in again.
- Tell your friends and the servers you're in not to click anything you sent. If you lost access, contact Discord or Steam support.
More guides
- What is a Discord honeypot channel, and how do you set one up?A honeypot channel is a trap only spam scripts fall into. How it catches compromised Discord accounts, why real members stay safe, and how to set one up.
- How to stop compromised accounts from spamming scam links on DiscordHow to stop compromised accounts from spamming scam links in your Discord server: the warning signs, the settings that matter, and what to do when it happens.
- Discord anti-spam compared: AutoMod, filters, verification and honeypotsDiscord AutoMod, spam filter bots, verification gates and honeypot traps compared: what each catches, what it misses, and how to combine them.