Fake MrBeast giveaway scams are among the most widespread social engineering attacks targeting gamers and young internet users in 2026. They arrive through Discord DMs, YouTube ads, TikTok deepfake videos, and compromised friend accounts, all built around the same premise: MrBeast is giving something away, and you've been selected.
MrBeast has nothing to do with any of it. His name and likeness are used without his consent, and every one of these giveaways is fraudulent.
A Discord message arrives from someone on your friends list. It says MrBeast is running his biggest giveaway yet: $2,500 in cash, a free iPhone, a Roblox gift card, and you have been selected. There's a link. There's a timer. All you have to do is click and claim.
Your friend did not send that message. Their account was hijacked. And if you click the link, the same thing is about to happen to you.
This guide covers how the fake MrBeast giveaway scam operates across every platform it appears on, the warning signs to look for at each stage, and the specific steps to take whether you've just received one of these messages or already interacted with one.
This Is Spiking Right Now
The volume of this specific scam has surged sharply in mid-2026. Security researchers tracking Discord account takeovers report that the number of hijacked accounts identified in these campaigns has doubled within a single month. The associated image and screenshot library used across the campaigns has grown by more than 70% in the same window, a sign that scammers are producing new visual material rather than recycling a static set of fakes.
That growth lines up with what's changed under the hood. Earlier waves of this scam leaned on obvious bot accounts and static image spam. The current wave runs mostly on information-stealing malware, often bundled inside cracked software, game mods, cheat tools, and fake installers, that lifts a victim's Discord session token straight off their device without a sound. A stolen token lets an attacker operate the real account without ever knowing the password. That's why so many people first learn their account is compromised when a friend messages back asking about the giveaway they just "sent."
Who Is MrBeast and Why Do Scammers Use His Name?
MrBeast, real name Jimmy Donaldson, is the most-subscribed individual creator on YouTube, with well over 400 million subscribers across his channels. He built his following on real, large-scale generosity: giving away cars, houses, cash, and life-changing experiences to strangers on camera.
That reputation is exactly why his name has become the most commonly impersonated identity in creator-based scams. A message claiming MrBeast is giving something away doesn't feel absurd, because it matches exactly what he does on camera every week. Scammers are exploiting a decade of real goodwill.
MrBeast himself called out this problem publicly in 2023, posting a warning to his followers after an AI-generated deepfake of him circulated on TikTok, seemingly offering an iPhone 15 Pro to 10,000 selected winners. He is a victim of this scam too. His name and likeness are used without his knowledge or consent, and he has no connection to any of the fake giveaway sites, fake Discord servers, or gambling platforms bearing his name.
What the Fake MrBeast Giveaway Scam Actually Looks Like
The scam arrives in several different forms, but they all follow the same underlying pattern: a message claiming you have won or been selected for a prize, with a link to claim it.
Direct messages from compromised accounts
The most common variant involves scammers compromising Discord accounts and using them to mass-send fake screenshots claiming that MrBeast or a "gaming partner" is giving away large bonuses, typically $2,500 or more, sometimes with fabricated dashboards showing withdrawal amounts to make it seem real.
The critical detail here is that the message comes from someone you already know. Your friend's account, or an account from a server you trust, sends you the link. Because it appears to come from a real person you have interacted with, the message feels far more credible than an approach from a stranger.
In more advanced cases, attackers fully hijack a Discord account, impersonate the victim, and distribute malicious links to their entire contact list. That single takeover creates a chain reaction that expands the scam's reach fast.
Fake MrBeast Discord servers
Fraudsters create Discord servers that closely mimic the branding of MrBeast's legitimate community. They use the same logos, colour schemes, banner images, and channel names. Once a user joins through an invite link, they may be prompted to verify their identity, link their account to a website, or provide personal information to "claim" a prize.
AI-generated deepfake videos
The scam has also spread through AI-generated YouTube videos, fake articles, and fabricated offers, alongside a major Discord hack that caused thousands of compromised accounts to spread the scam on their own. These videos use synthetic versions of MrBeast's voice and face to announce giveaways, with editing that matches his production style well enough to pass on a quick scroll.
Fake gambling and casino sites
The scam also appears through deceptive ads posted on social media that claim gambling sites are working in partnership with MrBeast, often providing a "promo code" that supposedly unlocks a bonus. These sites are fraudulent. They show fake wins to draw users in, then demand real deposits for "verification" before any payout can happen, which never comes.
MrBeast Scam on YouTube, TikTok, and Other Platforms
While Discord is the most common delivery mechanism, the fake MrBeast giveaway scam runs across every major platform. Understanding where else it appears helps you recognise it regardless of where you encounter it.
YouTube. Scammers run paid ads using AI-generated deepfake footage of MrBeast announcing giveaways. The synthetic voice matches his tone and delivery well enough to fool a casual viewer. The ads link to external giveaway sites that harvest personal data or card details. Separately, fraudulent YouTube channels upload full-length deepfake videos and optimise them for search, targeting queries like "MrBeast giveaway 2026."
TikTok and Instagram Reels. Short-form deepfake clips circulate on these platforms, often clipped from longer AI-generated videos. They tend to show MrBeast announcing a prize and directing viewers to a link in bio or a comment. The short format makes it harder to notice the synthetic audio and video artefacts that would stand out more in a longer clip.
Facebook ads. The fake MrBeast casino scam shows up here most often. Ads claim that MrBeast has partnered with a gambling platform and offer a promo code for a free bonus. The sites behind these ads are fraudulent and built to extract real deposits under the guise of verification.
Email. Less common but documented: phishing emails impersonating MrBeast or "Beast Games" that claim the recipient has won a prize and must verify their identity to claim it. These follow the same survey and sign-up chain as the web-based variants.
Every version shares the same structure: fake authority (MrBeast's name and face), artificial urgency (timers, limited spots), and a data or money extraction mechanism dressed up as a prize claim. The platform changes. The pattern doesn't. For a broader look at recognising this structure across phishing attacks generally, see how to spot a phishing email.
How the Scam Works Step by Step
Understanding the full sequence helps you recognise the scam at each stage, including the moments when it pivots from seeming harmless to actively dangerous.
Step one: The initial message
You receive a Discord DM or server message from what appears to be a friend, a bot, or a server announcement. The message uses MrBeast's name, branding, or profile image. It tells you that you have been selected for a giveaway, that MrBeast is celebrating a milestone, or that a gaming partner is distributing prizes to active Discord users. There is a link.
Step two: The landing page
Once you land on the website, you are met with an array of alluring gift cards from popular games like Roblox, Fortnite, and Minecraft. A countdown timer ticks away, urging you to decide before time runs out. The page looks polished and professional, using MrBeast's name, colours, and sometimes a photo or video of him.
Step three: The "verification" trap
After choosing a gift card or prize, you are guided to a so-called human verification process, working through a maze of misleading offers and deals. This stage may ask you to complete surveys, sign up for services, or "verify" your identity by entering personal information including your name, email address, phone number, and sometimes date of birth or payment details. A newer variant skips the survey chain entirely and instead asks you to scan a QR code or connect a cryptocurrency wallet to "receive" the prize. Scanning the code or approving the connection is the step that hands the attacker access. It isn't a step toward claiming anything.
Step four: Account compromise or data theft
These links redirect users to malicious websites built to steal sensitive information or infect devices with malware. Depending on the variant, clicking through can capture your Discord login credentials on a fake login page, harvest personal data for sale or future scams, download malware if you're prompted to install anything, or hand over your Discord account so it can send the same scam to everyone in your friends list.
Step five: The self-replicating spread
Attackers use hijacked accounts to distribute the links further, and the account owners often don't realise their accounts have been compromised. They keep using Discord normally, unaware they're spreading the scam. Each new victim becomes an unwitting vector for the next wave, which is why these campaigns grow so fast.
How Discord Accounts Get Hijacked in the First Place
To send convincing messages from a real account, scammers first have to get inside one. The main methods used to compromise Discord accounts include:
Token theft via malware. This is the dominant method behind the current spike. Discord stores a local authentication token on your device that keeps you logged in without entering your password every time. Malware targeting gamers, often disguised as game mods, cheats, cracked software, or free tools, is built to extract this token, giving attackers access to the account without needing the password at all. Because the attacker is operating a real, already-logged-in session, Discord's own systems have no reason to flag it.
Phishing links in other messages. An earlier round of scam DMs directs users to fake Discord login pages. The URL looks similar to discord.com but is a spoofed domain. Entering your credentials hands them directly to the attacker.
Malicious bots and OAuth apps with excessive permissions. Bots and third-party applications that request excessive permissions can access account data they should not have. When users add a bot to their server or authorise an application without reading what it is asking for, they may be granting access to read messages, send messages on their behalf, or extract account tokens directly.
Credential stuffing from data breaches. If you use the same email and password combination across multiple services, and one of those services has suffered a breach, attackers can try those credentials on Discord automatically. Unique passwords stop this cold.
Expired Discord invite links. Research from Check Point has found that cybercriminals are exploiting a lesser-known flaw in Discord's invitation system, registering previously valid invite links with custom URLs to redirect users to servers they control.
Warning Signs: How to Spot a Fake MrBeast Giveaway
These are the specific signals to look for when any message, server invite, or website claims to offer something from MrBeast.
It arrived unsolicited. Real giveaways from MrBeast are announced on his verified YouTube, Instagram, and X accounts, not through Discord DMs from friends, random server announcements, or bots. If you did not enter something and are being told you won, you did not win.
There is a countdown timer. Artificial urgency is the scammer's primary tool. A legitimate prize does not expire in ten minutes. The timer exists to stop you pausing to verify whether the offer is real.
The URL is not an official MrBeast domain. MrBeast's actual websites and social accounts are easy to verify. Scam sites use domains that sound related, including variations of "beast," "mrbeast," or "beastgames," but they aren't the real thing. Check the full URL before clicking anything.
It is asking you to complete surveys or sign up for services. No real giveaway requires you to subscribe to five other services, enter your card details for a "small shipping fee," or complete a chain of offers. These are all mechanisms for monetising your data or charging you directly.
It involves a casino, gambling site, or crypto bonus. MrBeast has no official casino, no crypto giveaway, and no gambling site. He launched a gaming business called Beast Games, but it is a legitimate entertainment venture with no connection to any of the scam sites. Any site claiming otherwise is fraudulent.
A friend sent it out of nowhere. If a friend sends you a giveaway link with no context, especially through a DM rather than in the middle of an existing conversation, their account has almost certainly been compromised. Contact them through a different channel before clicking anything.
The bot or site asks for unusual permissions. If a Discord bot wants to read your messages, DM your friends, or access your account data, decline and check what the application does before proceeding.
How to Report a Fake MrBeast Giveaway Scam
Reporting takes a few minutes and helps platforms remove the accounts and infrastructure behind these campaigns.
Report on Discord. Right-click the scam message and select Report Message, then choose Spam or Scam. You can also right-click the sender's username and report the account directly. For server-level scams, submit a report to Discord's Trust & Safety team at discord.com/safety.
Report on YouTube or TikTok. Use the three-dot menu on any ad or video to select Report, then choose Scam or Fraud. For YouTube ads, click the info icon (ⓘ) on the ad and select "Report this ad."
Report to Action Fraud (UK). If you lost money or had personal data stolen, file a report at actionfraud.police.uk. Keep any screenshots, URLs, or transaction records, since they strengthen the report.
Report to the FTC (US). File at reportfraud.ftc.gov. The FTC uses these reports to identify and pursue scam operations at scale.
Warn others. Post the scammer's Discord username, server invite link, or website URL in relevant communities: r/discordapp, r/Scams, or MrBeast fan communities on Reddit. The goal is to get the specific account or site flagged before more people are caught by it.
What to Do If You Receive One of These Messages
The correct response is the same whether the message arrives from a stranger or from a friend's account.
Do not click the link. Even visiting a phishing site without entering any information can in some cases execute tracking scripts or attempt to exploit browser vulnerabilities. The safest approach is to not click at all.
Do not reply, react, or engage with the message. Any engagement tells scammers that your account is active and responsive, which may result in further targeted attempts.
Report the message in Discord. Right-click the message and select Report. Choose the spam or scam category. Discord uses these reports to take action against accounts and bots operating malicious campaigns.
Contact your friend outside Discord. If the message came from someone you know, they probably don't know yet. Send them a message through a different channel such as text, phone call, or another platform, since their Discord DMs may still be sending scam messages. Alert them so they can secure their account before more of their contacts are affected.
Block the sender. Whether it was a compromised friend's account or a fake bot, blocking prevents further messages and reduces the chance of follow-up scam attempts.
What to Do If You Already Clicked the Link
If you clicked but did not enter any information on the resulting page, run a full malware scan using Malwarebytes or another reputable security tool, and monitor your accounts for unusual activity over the following days.
If you entered your Discord username and password:
Change your Discord password immediately from a device you trust. Go to User Settings → My Account → Change Password. Enable two-factor authentication if it is not already active, since this stops attackers from accessing your account even if they have your password. Go to User Settings → Privacy & Safety → Two-Factor Authentication.
Review your authorised apps. Go to User Settings → Authorised Apps and revoke access for anything you do not recognise or did not intentionally add.
Log out all other sessions. Go to User Settings → My Account and click "Log Out All Known Devices." This invalidates any tokens the attacker may have captured.
Check what was sent from your account. Review your recent DM conversations to see whether the scam was distributed to your contacts, and send them a warning message to let them know.
If you entered personal information such as your name, email, phone number, or date of birth, watch for follow-up phishing attempts on those channels. Scammers often sell or use harvested data for secondary attacks by email, phone, or other platforms.
If you entered payment details or made any deposit on a fake gambling site, contact your bank immediately to flag the transaction and dispute the charge. These deposits are built to be non-refundable, but your bank's fraud team will have seen similar cases and can advise on your options.
How to Protect Yourself Going Forward
For a broader look at how this type of social engineering scam works across platforms, including the Discord friend request variant that uses mobile games as a vehicle rather than celebrity names, see our guide to the Discord gaming scam and how it operates. A related technique worth knowing: the Discord "See More" scam, which disguises phishing links as platform interface elements to bypass your instinct to be cautious. A fourth variant swaps the celebrity name for a fake Nitro gift; see the Discord gift scam for how that one works, including the QR-code hijack version. A fifth skips the fake prize entirely and uses fear instead, the Discord Steam scam opens with a stranger claiming they accidentally reported your account, then hands you off to a fake Valve employee. The underlying technique is the same across all variants, and recognising the pattern in any form is the best defence.
For advice on protecting your personal information across all the platforms where these scams find their targets, see how to protect your personal information online.
Enable two-factor authentication on Discord. This is the single most effective protection for your account. Even if an attacker obtains your password through a breach or phishing page, they cannot log in without the second factor. Set it up under User Settings → My Account → Enable Two-Factor Auth.
Use a unique password for Discord. If your Discord password is the same as the one used on any other service, change it now. Password managers make maintaining unique passwords across every account practical without asking you to memorise anything.
Be selective about which bots and apps you authorise. Every application you authorise to access your Discord account is a potential attack surface. If you are unsure what a bot does or why it needs the permissions it is requesting, do not authorise it. Audit and remove applications you no longer use from the Authorised Apps page in settings.
Treat any unsolicited prize message with scepticism by default. This applies regardless of who appears to have sent it. Real giveaways from real creators are announced on verified accounts, not through private Discord messages.
Use a disposable email address for Discord and gaming sign-ups. Your Discord account, game forums, and community sign-ups are all surfaces where your real email address can end up in databases that scammers eventually access. Using a disposable email address for these sign-ups means that when a platform is breached or sells its data, your primary email address is not part of what leaks. VanishInbox generates a working inbox in about thirty seconds with no account required, keeping your real address out of the data pipelines that power these campaigns. For more on how that pipeline works, see what happens when a website sells your email address. For the exact signup steps, see our guide on using a temp email for Discord.
Enable spam filtering in Discord settings. Go to User Settings → Privacy & Safety and set the "Safe Direct Messaging" option to filter direct messages from people you do not share a server with. This alone removes a large share of unsolicited scam DMs before they reach your inbox.
Why the Scam Is So Effective Right Now
The MrBeast Discord scam works better in 2026 than it did in 2023, for a few specific reasons.
The scam has moved from bot-driven spam to malware-driven account takeover, and the numbers reflect it: hijacked-account volume tied to these campaigns has doubled in a single recent month. A message from a stolen real account clears a trust bar that a bot account never could.
AI deepfake technology now produces convincing video and audio of MrBeast announcing giveaways. Earlier versions of this scam relied on text and static images that careful observers could identify as fake. Current AI-generated content takes closer scrutiny to catch.
The scam now spreads through real accounts rather than bots alone. A message from a genuine friend's compromised account crosses the trust threshold that an obvious bot profile never would, since most people extend at least some benefit of the doubt to someone they know.
MrBeast's audience skews young: many of his viewers and Discord community members are teenagers and young adults who have grown up with creator giveaways as a normal part of online culture. That familiarity makes the premise feel less suspicious than it might to someone older.
The scale of the audience means the numbers work in scammers' favour even with a low conversion rate. A message sent to millions of potential targets only needs a small fraction to click in order to compromise thousands of new accounts, which then send the message to their contacts, and so on.
Frequently Asked Questions
Can you get scammed just by clicking a link on Discord?
In most cases, clicking a link alone isn't enough to compromise your account. The real risk comes from what happens next: entering your Discord credentials on a fake login page, downloading a file, or authorising a bot. That said, some links can execute tracking scripts or attempt browser exploits on load, so the safest approach is to avoid clicking entirely. If you did click but didn't enter anything or download anything, run a malware scan and monitor your accounts for unusual activity.
Is the MrBeast.com website real?
MrBeast does have an official website, but his legitimate online presence runs mainly through his verified YouTube, Instagram, and X accounts. Any site claiming to run a giveaway on his behalf, however official the domain looks, should be checked against those accounts before you interact with it. If his verified social channels haven't announced it, it isn't real.
Is MrBeast aware of these scams?
Yes. MrBeast warned his followers about deepfake scams using his likeness, asking whether social media platforms were ready to handle the rise of AI deepfakes. He has no connection to any of the fake giveaway sites, bots, or casino platforms using his name.
My friend sent me a MrBeast giveaway link. Does that mean it's real?
No. It means their account has almost certainly been compromised. The message came from their account, but they didn't send it: malware or an attacker sent it on their behalf. Contact your friend through a phone call, text, or other platform and let them know their Discord account may have been hijacked.
I won a prize and they asked me for a small shipping fee. Is that normal?
No legitimate giveaway charges a fee to deliver a prize. Requesting a "small" payment, whether framed as shipping, processing, or verification, is one of the oldest forms of advance-fee fraud. The fee is the actual product. There is no prize.
The Discord server has thousands of members. Doesn't that mean it's real?
Not necessarily. Discord servers can be populated with bots to inflate member counts, and real members may have joined the server before realising it was fraudulent. Member count is not a reliable indicator of legitimacy. The only verification that matters is whether MrBeast's confirmed, verified accounts have announced and linked to that server.
Can I get my money back if I deposited on one of the fake casino sites?
Possibly. Act quickly and contact your bank or card provider immediately to dispute the transaction. Explain that you were directed to the site through fraudulent means. Some banks have fraud reimbursement policies that cover this situation, particularly where social engineering was involved. File a report with Action Fraud in the UK (actionfraud.police.uk) or the FTC in the US too, since this creates a record that can support a dispute.
How do I check whether my Discord account has already been compromised?
Go to User Settings → My Account and look at your authorised apps for anything unfamiliar. Check your DM history to see whether any messages were sent without your knowledge. If you notice anything suspicious, change your password and enable two-factor authentication immediately, then log out all other sessions.
For a broader look at how phishing and social engineering work across platforms, see how to spot a phishing email. If you want to understand how your contact details end up in the databases that scammers draw from, what happens when a website sells your email address explains the full picture.
