Discord Account Hacked? How to Get It Back, Step by Step

If your Discord account was hacked and the email address was changed, the fastest fix is in your original inbox: Discord emails the old address when an email change is confirmed, and its Start Account Recovery button works for 48 hours. That one link can switch the email back, log the account out everywhere, force a new password and remove any phone or multi-factor authentication the attacker added. If you can still log in, change your password immediately, turn on MFA, remove unknown Authorized Apps and then file a report with Discord.

We checked this against Discord's Help Center articles on hacked accounts, undoing email changes, password resets, MFA recovery, QR code login, official messages and unauthorized charges, plus Discord's Safety Center pages on scams and account security, in November 2026.

Signs Someone Else Is in Your Account

Takeovers rarely announce themselves. More often a friend asks why you sent them a strange link, or you notice an email from Discord about a change you never made. Discord's Safety Center explains why attackers bother: a compromised account gives them your username, password, linked email and personal details, and lets them impersonate you or go after the servers you belong to.

Watch for these warning signs:

• An email from Discord saying your email address or password was changed.
• Messages in your DMs or servers that you did not write, usually "free Nitro", a game to test or a link to click.
• Apps under Authorized Apps that you do not recognize.
• Charges or gifts in your billing history that you did not buy.
• Being logged out of every device at once, or a new MFA method you never set up.

Any one of these is reason to act now rather than wait. A hijacked account is often used to send the same scam to everyone you know, because a message from a trusted friend is far more convincing than one from a stranger.

If the Email Was Changed: Use the 48-Hour Recovery Link

Discord treats an email change as a big deal, so after one is confirmed it sends an extra notification to the previous address with a way to undo it. Discord's article says the real link always starts with https://discord.com/wasntme/, and anything else is fake. Here is how the recovery works:

1. Open the email Discord sent to your old address and press Start Account Recovery.
2. On the Account Recovery page, follow the prompts after pressing Start revert process.
3. Set a new password. Discord will not accept one shorter than eight characters.
4. The email reverts to the address the link was sent to, and the account is logged out of all devices.

The recovery also removes any phone number and every MFA method on the account and invalidates recovery links for email changes made after this one, so an attacker who added their own phone or authenticator loses it. Afterward, add your own phone and MFA back.

Discord lists the reasons the process can fail: more than 48 hours have passed, a recovery was already performed with an earlier link, the email the link went to is now used by another Discord account, or the new password is invalid. If the link has expired, Discord says its support team cannot send a new one, which is why checking your inbox comes first.

If You Can Still Log In: Lock It Down in This Order

When the attacker has your password but you still have access, speed matters more than anything else. Discord's own guidance boils down to a short sequence, and the order is deliberate.

1. Change your password. On desktop open User Settings, stay on My Account and choose Change Password; on mobile go to Account, then Password. Discord's Safety Center says changing your password invalidates your current token and logs you out of all devices, which kicks out an active session.
2. Turn on multi-factor authentication. A passkey or authenticator app stops anyone who only has your password; our Discord 2FA guide walks through setup and backup codes.
3. Review Authorized Apps. On desktop open User Settings, then Authorized Apps, and press Deauthorize on anything unwanted. On mobile, tap your avatar, the cogwheel, then Authorized Apps, and tap the x beside anything you do not recognize.
4. Scan your computer. Discord recommends running a Windows Defender scan on Windows to check for malware, since a malicious download is a common way in.
5. Secure your email. Discord's recovery tools all run through your email address, and Discord says its support team cannot change the email on an account for you.

Do these from a device you trust. If you suspect the computer itself is infected, change the password from your phone first, then clean the computer before logging in there again.

If You Cannot Log In at All

If the password was changed but your email is still yours, use Forgot your password on the login page. Discord sends reset instructions to the email tied to the account, and if MFA is enabled you will be asked for a code. Discord's support team cannot reset a password for you, so the email route is the main path back.

If you no longer control the email, Discord says you need access to it to change anything, and suggests asking your email provider about temporary access. Its support team also will not tell you which email address is tied to an account. When none of the self-service routes work, submit a ticket at dis.gd/hackedaccount and include everything the form asks for, especially any unauthorized transactions.

A few honest limits are worth knowing in advance. Discord's hacked account article reminds users that its Terms of Service make you responsible for your account's security, and that if you fail to secure your account and it is compromised, Discord may be unable to assist in its recovery. Discord's X support account cannot help with hacked accounts either, so tagging it on social media will not speed things up. If an attacker set the account to be deleted, Discord's restore article gives a 15-day window and asks anyone who suspects a compromise during that time to contact support.

Unauthorized Purchases and Chargebacks

If you find purchases you did not make, such as Nitro gifts bought with your saved card, tell Discord in your hacked account ticket that there were unauthorized transactions, and use dis.gd/billing for refund requests. Gift card balances have their own path: on the billing form choose Refunds, Cancellations and Payments, then the option for an unauthorized transaction.

Be careful with your bank. Discord warns that filing a chargeback or refund request directly with your financial institution for Discord transactions may result in your account being suspended pending investigation. Also know that Discord's gifting article says it cannot refund a Nitro gift once another user has claimed it, so report suspicious purchases quickly instead of waiting to see what happens. Our Discord Nitro gift guide explains how real gifts and claims work.

How Accounts Actually Get Taken

Knowing the methods is what keeps it from happening twice. Discord's help and safety pages describe the same handful of tricks again and again:

• Suspicious links and files dressed up as games or "free Nitro", designed to steal your login credentials.
• Fake Discord staff offering to "appeal actions on your account". Discord says staff will never contact users directly through the app for support matters. Genuine system notices from Discord carry an OFFICIAL badge and cannot be replied to, and Discord will never ask for your password or account token.
• QR code logins. Scanning a code someone sends you with your logged-in app can approve their session. Discord's rule: never approve a QR login you did not generate yourself, and hit Cancel right away if one appears.
• "Special access" software. Discord says downloading and running programs someone sends you unprompted is almost always a bad idea, and its Safety Center lists malicious files and fake login sites among the usual ways in. Discord also says never to share or screenshare your authorization token.
• Scam bots that DM you offers. Discord says it has never created a bot designed to offer free products.

Accounts with something rare on them, such as a legacy badge or an old username, get targeted more often; Discord's scam page names the Early Supporter badge specifically, and our Early Supporter badge guide explains why.

After You Are Back In

Recovery is not finished when you can log in again. Tell your friends and any servers you are active in that messages sent during the takeover were not from you, so nobody clicks the links. If you moderate a server, check its audit log and member list, since Discord notes a compromised account can be used to ruin servers by banning members. Re-add your own phone number if the recovery stripped it; our Discord phone verification guide covers the waiting period and number rules. Then set up MFA, save fresh backup codes and turn on Safer Direct Messaging under Privacy & Safety, which scans DMs from non-friends for harmful content. Our Discord account safety checklist is a good final pass.

When an Account Is Gone for Good

Sometimes recovery is not possible, for example when the 48-hour link expired and the email went with it, and the history on that account cannot be rebuilt. For people starting over, the store's Discord section shows account listings from marketplace sellers, including aged 2015 to 2018 accounts, short usernames and accounts with Nitro, badges or verified contact details. Discord's position is clear, though: its Terms of Service say users agree not to license, sell, lend or transfer an account without the company's prior written approval, so read them and decide for yourself. Whatever you use next, secure it with the steps above on the first day rather than the day after something goes wrong.

Frequently Asked Questions