A social engineering scam is targeting users on Reddit and Discord, aiming to steal account credentials and lock users out of their accounts. The scam typically begins with a direct message from a stranger claiming that their account has been reported, and that the reporting account appears to be yours. Alternatively, the scammer might claim they accidentally reported your account and need your help to rectify the situation.
These messages are designed to initiate a conversation and build trust, with no malicious links or malware involved. The ultimate goal is to trick the victim into revealing login credentials or verification codes. In some variations, scammers persuade victims to change the email address associated with their account to one they control. They then demand payment, often in the form of gift cards, to restore access, threatening to delete the account or use it for further scams if the demands are not met.
The scam plays out through a series of carefully crafted steps. After the initial contact, if the victim denies making any report, the scammer will not argue but instead suggest it was an honest mistake and continue the conversation. They may inquire about who might have reported them or propose that the victim can help resolve the issue.
To add credibility, the scammer presents a fabricated email that mimics official communications from Reddit. This fake email often includes a ticket number, states that an investigation is underway, and imposes a countdown, typically 12 hours, before account suspension or feature limitations are enacted. Some versions of the scam direct victims to contact an individual on Discord who purports to be a Reddit employee or moderator. Fake legal warnings citing irrelevant laws may also be included.
These tactics are not representative of how Reddit operates. The platform does not facilitate communication between users involved in a report, nor does it require account verification through direct messages or Discord. All reporting, moderation, and appeal processes are handled directly within Reddit's own systems. The countdown is a psychological tactic to create a sense of urgency, prompting victims to act impulsively before questioning the legitimacy of the situation.
The core of the scam involves the verification code. After establishing the false report scenario, the scammer will claim that a Reddit employee or supervisor needs to verify the victim's account to confirm they were not involved in the alleged report. To facilitate this, the scammer instructs the victim to read back a verification code that Reddit will send. When the victim receives a genuine login or account recovery code from Reddit, they are tricked into sharing it with the scammer. This code allows the scammer to gain access to the victim's account, change the password, and effectively lock them out.
Victims often fall for the scam because the situation is designed to make them feel a need to resolve a perceived problem. The fake email lends an air of authenticity, and the countdown timer pressures them to act quickly. This is a sophisticated social engineering tactic that makes a seemingly reasonable request appear legitimate.
While the scam commonly begins with direct messages, scammers also use phishing emails that impersonate Reddit, claiming account issues or lockouts. Users are advised not to click links in unsolicited security emails but to log in directly through the official Reddit website or app. Signs of a compromised account include unfamiliar posts, comments, or messages.
To protect against this scam, users should never share Reddit login details or verification codes with anyone, regardless of their claimed affiliation. Changing account email addresses at a stranger's request or sending money to resolve a report are also clear indicators of a scam. Users should be aware that Reddit does not handle reports or appeals through external platforms like Discord.
Enabling two-factor authentication, preferably using an authenticator app, is a crucial security measure. Any unexpected login or verification code should be treated as a potential sign of unauthorized access. If an account is compromised, users should immediately change their password and utilize Reddit's official account recovery process. Reporting the scammer and their messages through Reddit's built-in tools is also recommended.
