How to spot phishing and fake support messages

Phishing is the most common way people lose accounts. The attacker pretends to be someone you trust, such as your host, a payment company or a friend, and tricks you into handing over a password, a code or a click. Anyone can be fooled, especially when rushed, so the goal is not to be perfect but to build a few habits that catch most attempts.

What phishing looks like

Phishing arrives through many channels:

Email that appears to come from a service you use.
Direct messages on Discord or other chat apps, often from a hacked friend's account.
Text messages with a link.
Fake websites that look like a real login page.
Fake support staff who contact you first.
Ads and search results that lead to lookalike sites.

The aim is nearly always one of three things: steal a password, steal a one-time code, or get you to install something harmful.

Common warning signs

Sign	Why it matters
Urgency ("act within 1 hour or your server is deleted")	Pressure stops you thinking
Threats or too-good-to-be-true offers	Emotion beats caution
A link to log in or "verify"	Real services rarely require this by message
A request for your password, code or token	No genuine support asks for these
Slightly wrong address or spelling	Lookalike domains are common
Generic greeting such as "Dear user"	Mass-sent message
Unexpected attachment	Could contain malware

None of these proves a message is fake, and a polished one can have none of them. So check the substance as well.

Rules that always apply

Support will never ask for your password. Not by email, chat or ticket.
Nobody legitimate needs your two-factor code. If a stranger asks for it, they are trying to log in as you right now.
Never share bot tokens, API keys or panel logins. If someone needs access, give them a limited sub-user instead. See Add and remove subusers.
Do not log in through a link in a message. Open the site yourself in a new tab, or use your saved bookmark.

Checking a link safely

Look at the real domain, the part just before the first single slash. login.example.com.security-check.net belongs to security-check.net, not to example.com.
Hover over the link (or long-press on a phone) to see where it goes before you click.
Watch for lookalike characters, such as a capital I in place of a lowercase l, or rn in place of m.
Beware of shortened links, which hide the destination.
A padlock does not mean the site is safe. It only means the connection is encrypted. Criminals can get certificates too.

A password manager helps here, because it will not fill your password on a domain it does not recognise. See How to choose strong passwords and use a password manager.

Fake support on Discord

Gaming communities are full of impersonators. Typical patterns:

A "staff member" sends you a direct message first, offering help with a problem you mentioned in public.
They ask you to join a different server, share your screen or install remote access software.
They send a "verification" link or a file to "fix" your server.
They ask for payment outside the normal channels.

How to protect yourself:

Real help happens in tickets you open yourself. See How to open a support ticket.
Ignore and report unsolicited direct messages. Turn off direct messages from server members you do not know.
Check roles and usernames carefully, since display names are easy to copy.
Never run a program or paste a command a stranger gives you.

Fake billing and payment messages

Scammers pretend to be a payment processor or your host, claiming a failed payment or an overdue invoice. Before you react:

Do not use the link. Log in to your account directly and look at your invoices. See View and download invoices and Fix a failed payment.
Check that the sender and amounts match something you really ordered.
Never enter card details after following a link from a message.

If you clicked or entered something

Act quickly, and do not feel embarrassed. It happens to experienced people.

Change the password of the affected account right away, and anywhere else you reused it.
Sign out other sessions and review recent activity.
Turn on or reset two-factor authentication. See Enable two-factor authentication.
Revoke tokens and keys that may have been exposed, and create new ones.
Scan your computer with a trusted security tool if you downloaded or ran anything.
Tell the service, and if money is involved, contact your bank.
If you are locked out, follow Recover your account.

Reporting

Report phishing to the service being imitated and to your email provider, and use the platform's report feature on Discord. Sharing a warning with your community helps others avoid the same trap.

Habits that help

Slow down. Urgency is the attacker's best tool.
Verify through a second channel you already trust.
Keep software and browsers updated.
Use two-factor authentication everywhere possible.
Use unique passwords, so one mistake does not open everything. See Keep your account secure.

If you are unsure whether a message is genuine, you can check with us by opening a ticket and describing it, without clicking anything.

Still stuck? Open a ticket on Discord - run /ticket in any channel, pick a department, and include your Server ID or Invoice ID so we can jump straight in.