How the Reddit and Discord false report scam steals accounts

A stranger messages you on Reddit. They say someone reported them, and the reporting account looks a lot like yours. Was it you? It wasn’t. That’s not really the point of the message. This version relies entirely on social engineering. There is no malware and no malicious links. It starts with a conversation, but the goal is to trick you into handing over a login or verification code so the scammer can access your Reddit account. How this scam works There are two common variants of this scam: “Someone reported me, and it looks like it was you.” “ I accidentally reported your account.” Someone claims there was a mistake involving a report. In one version, they say someone reported them and it looks like it was you. In another, they claim they accidentally reported your account and need your help to fix it. Either way, there’s no report. It’s the opening to a social engineering scam that has become common on Discord, Reddit, and other platforms. The end goal varies. Some versions try to trick you into sharing a login or verification code so the scammer can sign in to your account, change your password, and lock you out. Others persuade you to change the email address linked to your account to one they control. They then demand a gift card or other payment to “fix” the problem, threatening to delete your account or use it to scam other people if you don’t pay. If you’re still talking to them, stop and don’t share any codes or change your account details. If you’ve already done either and lost access to your account, skip ahead to How to protect yourself below. How it plays out The conversation usually starts with one of two claims. Either the person says someone reported their account and it looks like it was you, or they claim they accidentally reported your account by mistake. If you deny it, the scammer doesn’t argue. They say it was probably an honest mistake and keep the conversation going. They might ask if you know who reported them or suggest you can help clear things up. The goal is simply to keep you engaged. Then they send “proof”: a screenshot of an email made to look as though it’s from Reddit. It has a formal tone, a ticket number, a claim that a “formal investigation” is underway, and a countdown, usually 12 hours, before “suspension, limited features, or a ban.” Some versions tell you to contact someone on Discord who claims to be a Reddit employee or moderator. Others include a fake legal warning that cites laws or regulations unrelated to the situation. None of it is real. Why this isn’t how Reddit works Reddit doesn’t ask people involved in a report to contact each other, and it doesn’t ask you to verify your account through a stranger in a direct message. It doesn’t handle appeals through Discord or direct you to a staff member’s personal Discord account. Reports, moderation, and appeals all happen through Reddit itself. The countdown is there to create urgency. Combined with vague threats of suspension, restricted features, or a ban, it’s designed to make you act before you have time to question what’s happening. What they’re actually after The report and the fake email are just the setup. The scammer tells you that a Reddit employee or “supervisor” needs to verify your account to prove you weren’t involved. To do that, they say, you need to read back the code Reddit is about to send you. While you’re in the conversation, the scammer tries to sign in to your real account or trigger an account recovery. Reddit responds by sending a genuine login or verification code to you. The timing isn’t a coincidence. The code arrives just after you’ve been told to expect it. If you read it back, the scammer can use it to sign in to your account, change your password, and lock you out. The code itself is real. The story around it is the scam. Why people fall for it Whether you’ve been accused of reporting someone or told your account was reported by mistake, the scam puts you in a position where you want to fix the problem. So when you’re asked to “verify” your account, it can feel like part of resolving the issue rather than a security risk. The fake email makes the story seem more believable, especially if you don’t stop to question whether the contact method or process matches how Reddit actually works. The countdown adds a sense of urgency, encouraging you to act before you’ve had time to think it through. This isn’t about being gullible. It’s a well-rehearsed social engineering script designed to make a reasonable request seem legitimate. It’s not just direct messages While the false-report scam usually starts in a direct message, scammers also impersonate Reddit in phishing emails claiming your account has been locked or needs attention. If you receive an unexpected security email, don’t click the links inside it. Instead, sign in to Reddit directly through the official website or app. If your account is compromised, you may notice posts, comments, or messages you didn’t create. That’s a sign someone else has access to your account. If that happens, change your password, enable two-factor authentication if you haven’t already, and follow Reddit’s account recovery process. How to protect yourself Never share a Reddit login or verification code with anyone, even someone claiming to be Reddit staff or support. Never change the email address linked to your account at a stranger’s request, even to “fix” a reported issue. If someone asks you to buy a gift card or send money to resolve a report, it’s a scam. Reddit won’t ask users involved in a report to contact each other, verify their accounts through direct messages, or handle appeals through Discord. If you receive an unexpected Reddit security email, don’t use the links inside it. Sign in to your account directly through reddit.com or the official app instead. Turn on two-factor authentication using an authenticator app, and treat any unexpected login or verification code as a sign someone may be trying to access your account. If you notice posts, comments, or messages you didn’t create, secure your account immediately by changing your password. If you’ve lost access, use Reddit’s official account recovery process at reddit.com . Report the scammer and their messages using Reddit’s built-in reporting tools. Remember If someone asks you to share a login or verification code, stop there. That’s the scam. Everything before it is just the setup. About the author Passionate about antivirus solutions, Stefan has been involved in malware testing and AV product QA from an early age. As part of the Malwarebytes team, Stefan is dedicated to protecting customers and ensuring their security.