A Discord message arrives from someone on your friends list. It says MrBeast is running his biggest giveaway yet — $2,500 in cash, or a free iPhone, or a Roblox gift card — and you have been selected. There's a link. There's a timer. All you have to do is click and claim.
Your friend did not send that message. Their account was hijacked. And if you click the link, the same thing is about to happen to you.
The MrBeast Discord scam has been active for several years and has grown significantly more sophisticated in 2025 and 2026. It now combines compromised accounts, AI-generated deepfake videos, fake casino and gambling sites, and large-scale phishing infrastructure — all built around the most recognisable name in online entertainment.
This guide explains exactly what the scam is, how it spreads, what happens when someone clicks, and the specific steps to take whether you have received one of these messages or already interacted with one.
Who Is MrBeast and Why Do Scammers Use His Name?
MrBeast — real name Jimmy Donaldson — is the most-subscribed individual creator on YouTube, with well over 400 million subscribers across his channels. He built his following on genuinely extraordinary acts of generosity: giving away cars, houses, cash, and life-changing experiences to strangers on camera.
That reputation is precisely why his name has become the most commonly impersonated identity in creator-based scams. When a message claims MrBeast is giving something away, it does not feel absurd — it feels consistent with exactly what he does. Scammers are exploiting a decade of real goodwill.
MrBeast himself publicly called out this problem in 2023, posting a warning to his followers after an AI-generated deepfake of him circulated on TikTok, seemingly offering an iPhone 15 Pro to 10,000 selected winners. He is a victim of this scam too — his name and likeness are used without his knowledge or consent, and he has no connection to any of the fake giveaway sites, fake Discord servers, or gambling platforms bearing his name.
What the MrBeast Discord Scam Actually Looks Like
The scam arrives in several different forms, but they all follow the same underlying pattern: a message claiming you have won or been selected for a prize, with a link to claim it.
Direct messages from compromised accounts
The most common variant involves scammers compromising Discord accounts and using them to mass-send fake screenshots claiming that MrBeast or a "gaming partner" is giving away large bonuses — typically $2,500 or more, sometimes with fabricated dashboards showing withdrawal amounts to make it seem real.
The critical detail here is that the message comes from someone you already know. Your friend's account, or an account from a server you trust, sends you the link. Because it appears to come from a real person you have interacted with, the message feels far more credible than an approach from a stranger.
In more advanced cases, attackers fully hijack a Discord account, impersonate the victim, and distribute malicious links to their entire contact list — creating a chain reaction that rapidly expands the scam's reach.
Fake MrBeast Discord servers
Fraudsters create Discord servers that closely mimic the branding of MrBeast's legitimate community. They use the same logos, colour schemes, banner images, and channel names. Once a user joins through an invite link, they may be prompted to verify their identity, link their account to a website, or provide personal information to "claim" a prize.
AI-generated deepfake videos
The scam has also spread through AI-generated YouTube videos, fake articles, and fabricated offers — alongside a major Discord hack that caused thousands of compromised accounts to spread the scam automatically. These videos use synthetic versions of MrBeast's voice and face to announce giveaways, complete with editing that matches his production style closely enough to be convincing on a quick scroll.
Fake gambling and casino sites
The scam also appears through deceptive ads posted on social media that claim gambling sites are working in partnership with MrBeast, often providing a "promo code" that supposedly unlocks a bonus. These sites are fraudulent — they show fake wins to draw users in, then demand real deposits for "verification" before any payout can happen, which never comes.
How the Scam Works Step by Step
Understanding the full sequence helps you recognise the scam at each stage, including the subtle moments when it pivots from seeming harmless to actively dangerous.
Step one: The initial message
You receive a Discord DM or server message from what appears to be a friend, a bot, or a server announcement. The message uses MrBeast's name, branding, or profile image. It tells you that you have been selected for a giveaway, that MrBeast is celebrating a milestone, or that a gaming partner is distributing prizes to active Discord users. There is a link.
Step two: The landing page
Once you land on the website, you are met with an array of alluring gift cards from popular games like Roblox, Fortnite, and Minecraft. A countdown timer ticks away, urging you to make a decision before time runs out. The page looks polished and professional. It uses MrBeast's name, colours, and sometimes a photo or video of him.
Step three: The "verification" trap
After choosing a gift card or prize, you are guided to a so-called human verification process — navigating through a maze of misleading offers and deals. This stage may ask you to complete surveys, sign up for services, or "verify" your identity by entering personal information including your name, email address, phone number, and sometimes date of birth or payment details.
Step four: Account compromise or data theft
In reality, these links redirect users to malicious websites designed to steal sensitive information or infect devices with malware. Depending on the specific variant, clicking through can result in your Discord login credentials being captured on a fake login page, personal data being harvested for sale or future scams, malware being downloaded to your device if you are prompted to install anything, or your Discord account being taken over and used to send the same scam to everyone in your friends list.
Step five: The self-replicating spread
Hijacked accounts are then used to distribute the links further, and the account owners often do not even realise their accounts have been compromised — they continue using Discord normally, unaware that they are unknowingly spreading the scam. This is why these campaigns grow so quickly. Each new victim becomes an unwitting vector for the next wave.
How Discord Accounts Get Hijacked in the First Place
To send convincing messages from a real account, scammers first have to get inside one. The main methods used to compromise Discord accounts include:
Phishing links in other messages. An earlier round of scam DMs directs users to fake Discord login pages. The URL looks similar to discord.com but is a spoofed domain. Entering your credentials hands them directly to the attacker.
Malicious bots with excessive permissions. Bots that request excessive permissions can access account data they should not have. When users add a bot to their server or authorise an application without reading what it is asking for, they may be granting access to read messages, send messages on their behalf, or extract account tokens.
Token theft via malware. Discord stores a local authentication token on your device that keeps you logged in without entering your password every time. Malware targeting gamers — often disguised as game mods, cheats, or free software — is specifically designed to extract this token, giving attackers access to the account without needing the password at all.
Credential stuffing from data breaches. If you use the same email and password combination across multiple services, and one of those services has suffered a breach, attackers can try those credentials on Discord automatically. This is why unique passwords matter.
Expired Discord invite links. Research from Check Point has found that cybercriminals are exploiting a lesser-known flaw in Discord's invitation system, registering previously valid invite links with custom URLs to redirect users to servers they control.
Warning Signs: How to Spot a Fake MrBeast Giveaway
These are the specific signals to look for when any message, server invite, or website claims to offer something from MrBeast.
It arrived unsolicited. Real giveaways from MrBeast are announced on his verified YouTube, Instagram, and X accounts — not through Discord DMs from friends, random server announcements, or bots. If you did not enter something and are being told you won, you did not win.
There is a countdown timer. Artificial urgency is the scammer's primary tool. A legitimate prize does not expire in ten minutes. The timer exists to stop you from pausing to verify whether the offer is real.
The URL is not an official MrBeast domain. MrBeast's actual websites and social accounts are easily verifiable. Scam sites use domains that sound related — including variations of "beast," "mrbeast," or "beastgames" — but are not the real thing. Look at the full URL carefully before clicking anything.
It is asking you to complete surveys or sign up for services. No real giveaway requires you to subscribe to five other services, enter your card details for a "small shipping fee," or complete a chain of offers. These are all mechanisms for monetising your data or charging you directly.
It involves a casino, gambling site, or crypto bonus. MrBeast has no official casino, no crypto giveaway, and no gambling site. He launched a gaming business called Beast Games, but it is a legitimate entertainment venture with no connection to any of the scam sites. Any site claiming otherwise is fraudulent.
A friend sent it out of nowhere. If a friend sends you a giveaway link with no context — especially through a DM rather than in the middle of an existing conversation — their account has almost certainly been compromised. Contact them through a different channel before clicking anything.
The bot or site asks for unusual permissions. If you are being asked to authorise a Discord bot that wants to read your messages, DM your friends, or access your account data, decline and investigate what the application actually is before proceeding.
What to Do If You Receive One of These Messages
The correct response is the same whether the message arrives from a stranger or from a friend's account.
Do not click the link. Even visiting a phishing site without entering any information can in some cases execute tracking scripts or attempt to exploit browser vulnerabilities. The safest approach is to not click at all.
Do not reply, react, or engage with the message. Any engagement tells scammers that your account is active and responsive, which may result in further targeted attempts.
Report the message in Discord. Right-click the message and select Report. Choose the spam or scam category. Discord uses these reports to take action against accounts and bots operating malicious campaigns.
Contact your friend outside Discord. If the message came from someone you know, they probably do not know yet — send them a message through a different channel such as text, phone call, or another platform, since their Discord DMs may still be sending scam messages. Alert them so they can secure their account before more of their contacts are affected.
Block the sender. Whether it was a compromised friend's account or a fake bot, blocking prevents further messages and reduces the chance of follow-up scam attempts.
What to Do If You Already Clicked the Link
If you clicked but did not enter any information on the resulting page, run a full malware scan using Malwarebytes or another reputable security tool, and monitor your accounts for unusual activity over the following days.
If you entered your Discord username and password:
Change your Discord password immediately from a device you trust. Go to User Settings → My Account → Change Password. Enable two-factor authentication if it is not already active — this prevents attackers from accessing your account even if they have your password. Go to User Settings → Privacy & Safety → Two-Factor Authentication.
Review your authorised apps. Go to User Settings → Authorised Apps and revoke access for anything you do not recognise or did not intentionally add.
Log out all other sessions. Go to User Settings → My Account and click "Log Out All Known Devices." This invalidates any tokens the attacker may have captured.
Check what was sent from your account. Review your recent DM conversations to see whether the scam was distributed to your contacts, and send them a warning message to let them know.
If you entered personal information such as your name, email, phone number, or date of birth, be alert for follow-up phishing attempts on those channels. Scammers frequently sell or use harvested data for secondary attacks by email, phone, or other platforms.
If you entered payment details or made any deposit on a fake gambling site, contact your bank immediately to flag the transaction and dispute the charge. These deposits are designed to be non-refundable, but your bank's fraud team will have seen similar cases and can advise on your options.
How to Protect Yourself Going Forward
Enable two-factor authentication on Discord. This is the single most effective protection for your account. Even if an attacker obtains your password through a breach or phishing page, they cannot log in without the second factor. Set it up under User Settings → My Account → Enable Two-Factor Auth.
Use a unique password for Discord. If your Discord password is the same as the one used on any other service, change it now. Password managers make maintaining unique passwords across every account straightforward without requiring you to memorise anything.
Be selective about which bots and apps you authorise. Every application you authorise to access your Discord account is a potential attack surface. If you are unsure what a bot does or why it needs the permissions it is requesting, do not authorise it. Regularly audit and remove applications you no longer use from the Authorised Apps page in settings.
Treat any unsolicited prize message with scepticism by default. This applies regardless of who appears to have sent it. Real giveaways from real creators are announced publicly on verified accounts, not through private Discord messages.
Use a disposable email address for Discord and gaming sign-ups. Your Discord account, game forums, and community sign-ups are all surfaces where your real email address can end up in databases that scammers eventually access. Using a disposable email address for these sign-ups means that when a platform is breached or sells its data, your primary email address is not part of what leaks. VanishInbox generates a working inbox instantly with no account required — it takes about thirty seconds and keeps your real address out of the data pipelines that power these campaigns. For more on how that pipeline actually works, see what happens when a website sells your email address.
Enable spam filtering in Discord settings. Go to User Settings → Privacy & Safety and set the "Safe Direct Messaging" option to filter direct messages from people you do not share a server with. This alone removes a significant volume of unsolicited scam DMs before they reach your inbox.
Why the Scam Is So Effective Right Now
The MrBeast Discord scam is more effective in 2026 than it was in 2023 for a few specific reasons.
AI deepfake technology has made it possible to generate convincing video and audio of MrBeast announcing giveaways. Where earlier versions of this scam relied on text and static images that careful observers could identify as fake, current AI-generated content requires closer scrutiny to detect.
The scam now spreads through real accounts rather than bots alone. When a message comes from a genuine friend's compromised account rather than an obvious bot profile, the trust threshold is crossed automatically. Most people extend at least some benefit of the doubt to someone they know.
MrBeast's audience is disproportionately young — many of his viewers and Discord community members are teenagers and young adults who have grown up with the idea of creator giveaways as a normal part of online culture. That familiarity makes the premise feel less suspicious than it might to someone older.
And the scale of the audience means the numbers work in scammers' favour even with a low conversion rate. A message sent to millions of potential targets only needs a small fraction to click in order to compromise thousands of new accounts, which then send the message to their contacts, and so on.
Frequently Asked Questions
Is MrBeast aware of these scams?
Yes. MrBeast publicly warned his followers about deepfake scams using his likeness, asking whether social media platforms were ready to handle the rise of AI deepfakes. He has no connection to any of the fake giveaway sites, bots, or casino platforms using his name.
My friend sent me a MrBeast giveaway link. Does that mean it's real?
No. It means their account has almost certainly been compromised. The message came from their account, but they did not send it — malware or an attacker is sending it on their behalf. Contact your friend through a phone call, text, or other platform and let them know their Discord account may have been hijacked.
I won a prize and they asked me for a small shipping fee. Is that normal?
No legitimate giveaway charges a fee to deliver a prize. Requesting a "small" payment — whether framed as shipping, processing, or verification — is one of the oldest forms of advance-fee fraud. The fee is the actual product. There is no prize.
The Discord server has thousands of members. Doesn't that mean it's real?
Not necessarily. Discord servers can be populated with bots to inflate member counts, and real members may have joined the server before realising it was fraudulent. Member count is not a reliable indicator of legitimacy. The only verification that matters is whether MrBeast's confirmed, verified accounts have announced and linked to that server.
Can I get my money back if I deposited on one of the fake casino sites?
Possibly — act quickly and contact your bank or card provider immediately to dispute the transaction. Explain that you were directed to the site through fraudulent means. Some banks have fraud reimbursement policies that cover this situation, particularly where social engineering was involved. File a report with Action Fraud in the UK (actionfraud.police.uk) or the FTC in the US as well, as this creates a record that can support a dispute.
How do I check whether my Discord account has already been compromised?
Go to User Settings → My Account and look at your authorised apps for anything unfamiliar. Check your DM history to see whether any messages were sent without your knowledge. If you notice anything suspicious, change your password and enable two-factor authentication immediately, then log out all other sessions.
For a broader look at how phishing works across email and other platforms, see how to spot a phishing email. If you want to understand how your contact details end up in the databases that scammers draw from, what happens when a website sells your email address explains the full picture.
