- Which situation are you in?
- The recovery order I'd follow
- How the 48 hour email undo link works
- Locked out of MFA: the backup code dead end
- If you only forgot the password
- Clearing out what the hacker left behind
- Charges you didn't make: don't start with your bank
- How accounts usually get taken
- My verdict
- Frequently asked questions
If your Discord account was hacked, go to the inbox of the email address the account used and look for the 'Discord Email Address changed' message: its Start Account Recovery button works for 48 hours. Then reset your password, deauthorize any apps you don't recognise and file Discord's hacked-account report, mentioning any charges you didn't make.
Here's the catch, and it's why speed matters. As of October 2026, Discord says it can't remove Multi-Factor Authentication or issue new backup codes if you've lost yours, and support can't send a fresh undo link once those 48 hours have passed. Under Discord's Terms of Service, keeping your account secure is your responsibility, and if it's compromised because it wasn't secured, Discord may be unable to help you recover it. So your saved backup codes and that 48 hour window decide most outcomes, not a support ticket.
Which situation are you in?
Find your row first. Each one has a different route back in, and a different dead end:
| Situation | What Discord says to do | Dead end |
|---|---|---|
| You can still log in | Reset your password, check MFA is on, deauthorize unknown Authorized Apps | None |
| Your email was changed | Press Start Account Recovery in the email sent to your old address | After 48 hours, support can't resend the link |
| You forgot the password | Login page, then Forgot your password?, then the emailed link | Support can't reset it for you |
| Locked out of MFA | An 8-digit backup code or an SMS code, then Remove Authenticator App | No backup codes: Discord can't remove MFA |
| Charges you didn't make | Say so in the hacked-account report | A bank chargeback can suspend the account |
The recovery order I'd follow
- Check your old inbox for 'Discord Email Address changed' and press Start Account Recovery within 48 hours.
- Reset the password and make sure Multi-Factor Authentication is on.
- Open User Settings, then Authorized Apps, and deauthorize anything you don't recognise.
- On Windows, run a Windows Defender scan, as Discord suggests, to check the device for viruses.
- If you still need help, submit Discord's hacked-account report from its support site, and include any unauthorized charges.
How the 48 hour email undo link works
When someone confirms a change to your account email, Discord sends a notice to the original address with a Start Account Recovery button. That link lasts 48 hours and is unique to your account. Discord says the real one always opens a discord.com page with 'wasntme' in the address, and anything else is fake, so check before you click.
The recovery page lets you change the email back, log out every device, set a new password, remove any phone number and remove any Multi-Factor Authentication methods. That last part surprises people: you'll need to add your phone number and MFA back afterwards. My guide to turning on 2FA on Discord walks through that part without getting locked out.
Discord lists four reasons the link fails:
- More than 48 hours have passed.
- Another recovery has already been used.
- The email address is now in use by another Discord account.
- The new password isn't valid, either under 8 characters or caught by extra regional rules.
If several recovery links exist, using one cancels any that were created after it. And if yours has expired, Discord support can't send a new one.
Locked out of MFA: the backup code dead end
If you can't log in and you're not logged in on any other device, your backup codes are the way back. Look for a file called discord_backup_codes.txt or a screenshot you saved when you set MFA up. Then:
- On the login screen, tap Verify with something else.
- Choose Use a backup code and enter the 8-digit code.
- Once you're in, go to User Settings, then My Account, then Remove Authenticator App.
If you set up SMS for MFA, pick Use a code sent to your phone instead, then remove MFA after you log in.
With no backup codes, Discord is unable to remove MFA or issue new codes, and support can't generate them for you. If you're still logged in somewhere, open My Account, then View Backup Codes, enter your password and save them now. If you're replacing your authenticator, here's my comparison of authenticator apps.
If you only forgot the password
A forgotten password isn't a hack. On the login page, enter the account email, choose Forgot your password? and follow the emailed instructions. The new password needs at least 8 characters, and with MFA on you're asked for the code first. Discord Support can't reset a password for you. If Discord's emails aren't reaching you, start with these fixes for missing Discord emails.
Clearing out what the hacker left behind
Apps you authorised, or that someone else authorised on your account, keep their access until you remove them. On desktop, open User Settings with the cogwheel at the bottom left, choose Authorized Apps and press Deauthorize. On mobile, tap your avatar at the bottom right, then the cogwheel at the top right, then Authorized Apps, and tap the x next to each one.
Want AI doing the heavy lifting in your marketing?
I build the systems that handle the boring 80 percent, so you get your week back. Done properly, with the human kept in.
Charges you didn't make: don't start with your bank
If the hacker spent on your account, say so in the hacked-account report. Discord warns that filing a chargeback or refund request with your bank for Discord transactions may lead to account suspension while it investigates. Refund requests go to Discord's billing team instead.
How accounts usually get taken
Discord names two common threats. The first is suspicious links or files posing as games or 'free Nitro'. The second is social engineering: scammers pretending to be Discord employees who offer to 'appeal actions on your account' or ask for card details to 'win a giveaway'. Discord Staff never contact users directly through the Discord app for support. If anyone asks for personal information or payment, or tells you to change your login details, don't do it.
For the next step, see this walkthrough of how to remove a phone number from Discord.
My verdict
Go to your inbox before anything else, because that 48 hour link is the fastest official route back, and it's gone for good once it expires. Ignore anyone in your DMs offering to recover the account for you. And if you're still logged in today, save your backup codes now: they're the one thing Discord says it can't replace.
Related reading: my Discord Family Center breakdown.
Frequently asked questions
How do I recover a hacked Discord account?
Check the email address the account used for a 'Discord Email Address changed' message and press Start Account Recovery within 48 hours. Then reset your password, deauthorize unknown apps and submit Discord's hacked-account report if you still need help.
How long does Discord's email undo link last?
48 hours. If it expires, Discord support can't send a new one, and using one recovery link cancels any created after it.
Can Discord support remove 2FA if I lost my backup codes?
No. Discord says that without backup codes it's unable to remove MFA or issue new backup codes, and support can't generate them for you.
Will Discord message me about my hacked account?
No. Discord Staff never contact users directly through the Discord app for support, so treat any such message as a scam.
Should I ask my bank for a chargeback after a hack?
Discord warns that a bank chargeback for Discord transactions may get the account suspended while it investigates. Mention the charges in the hacked-account report and send refund requests to Discord's billing team.
