3. Remove spam across all channels
Once the member is stopped, it is time to clean up. Depending on the amount, there are three ways.
Single channels with purge: in each affected channel, delete only that person's messages:
/channel purge amount:50 member:@Name
Lizbot searches the last 100 messages in the channel and deletes only the matching ones. With the contains option you can also filter by text, for example part of the link. That way you also remove spam that came from several hijacked accounts with the same text:
/channel purge amount:100 contains:gift-nitro
Discord only allows bulk deletion for messages that are less than 14 days old. Older messages can only be deleted by hand. All purge options are covered in the guide deleting many messages at once.
Find spam with Discord search: in the search bar at the top right, the from: filter finds all of the person's messages across the whole server. This shows you which channels are affected, so you can clean up exactly there. Check threads and forum posts as well.
Many channels at once with a softban: if the spam is spread across twenty channels, a softban is quicker:
/mod softban member:@Name reason:Account hacked, spam cleanup
Lizbot briefly bans the person, deletes their messages from the last 7 days across the whole server and lifts the ban straight away. The person is no longer on the server afterwards, but can come back with a new invite. Their roles are lost, and if DM notifications are on, the account gets a message here too. A softban is therefore better suited to members without many roles, or when clean channels matter more to you.
If the hijacked account mostly spams images across many channels, Lizbot often detects this automatically. How that works is shown in the guide Stop image scams from hacked accounts.
4. Warn members and report links
If someone has already clicked the link, information matters more than cleanup. Post a short message in a busy channel, for example:
"@Name's account was hacked and has been sending links. Please don't click them. If you logged in there: change your password and log out all unknown devices in your User Settings under Devices."
Your members report spam on the server through Lizbot: with /report member:@Name reason:... or by right-clicking a message and choosing Apps and Report message. The report goes to your team under Reports. This does not cover spam by DM: your server can neither see nor delete private messages. So ask your members to report suspicious DMs directly to Discord, through the message's context menu.
5. Help the affected person
As soon as the person gets in touch, often through a second account or a friend, pass on these steps. They come from Discord's official help article:
- Reset the password and turn on two-factor authentication.
- Check email: if the attacker changed the email address, Discord sends a "Discord Email Address Changed" email to the old address. The link in it lets you undo the change.
- Review Authorized Apps in User Settings and remove anything unfamiliar.
- Scan the computer for malware, because many hacks use sessions stolen from the browser.
- If the person can no longer log in, the only option is a ticket with Discord support at support.discord.com. Your server team cannot recover the account.
Important for the return: get confirmation that the person is back in control of the account. Ideally they speak in a voice channel or reach you through a known second channel. An attacker writing "I'm back, I got hacked" is a well-known trick.
6. Wrap up the return properly
Once the account is back, undo everything:
/mod untimeout member:@Name or /mod quarantine remove member:@Name- After a softban: send a new invite and give the roles back by hand or through a role menu.
- After a ban:
/mod unban user_id:... or accept the appeal in the dashboard under Appeals.
Then check the person's cases with /case list member:@Name. If AutoMod handed out warnings during the spam, they would otherwise count towards your automatic escalation. You delete a case with /case delete number:.... If you want to keep the record, add to the reason instead with /case reason number:... reason:Account was hacked, not intentional. You create an internal note for the team with /mod note.
Prevention: keep the next hack from doing much damage
AutoMod with spam filter: in the dashboard under AutoMod, in the Spam & raid tab, you set how many messages in how many seconds trigger Lizbot. Choose Delete and Timeout as actions and set a timeout duration. Also turn on Also delete the earlier spam messages. Then, on a hit, Lizbot cleans up not just the last message but also the person's other spam messages from the time window, across all channels. A hijacked account is often caught after just a few messages, before a mod is even online.
Phishing protection: in the Phishing tab, turn on Use public scam lists. Links to known scam sites, such as fake Nitro or Steam pages, then disappear instantly. Under Custom blocked domains, add addresses that have shown up on your server. Both are included in the Free plan.
AI scam shield (Pro): new bait is often not on any list yet. The AI scam shield in the Scam shield tab catches many scam messages that fixed rules miss, for example disguised links or free Nitro texts. It starts with a 7-day learning phase in which it only reports. It needs the Pro plan with 500 checks per day, Studio has 3000.
Link filter: in the Rules tab, choose a mode in the Links section: blacklist for individual blocked domains, whitelist so only known domains get through, or block all links. Channels where links are welcome can be excluded under Exempt channels. Everything else about AutoMod is in the guide Set up Discord AutoMod.
2FA for the team: in Server Settings you can require everyone with moderation permissions to have two-factor authentication turned on. This is the single most important step against hijacked team accounts. More on building a secure team is in the guide Build a moderation team.
Backup: for the worst case, a hijacked admin account deleting channels, an up-to-date backup helps. Lizbot backs up channels, roles and permissions, more on that under Backups.
Checklist
- Timeout or quarantine applied, reason entered
- Admin and moderation permissions removed from the account, if it had any
- Spam removed from all channels, threads and forums
- Members warned not to click the link
- Person pointed to Discord's help article
- Return confirmed through a safe channel
- Timeout or quarantine lifted, cases cleaned up
- Spam filter with earlier-message deletion and phishing protection active
Common mistakes
- Banning right away: the person loses roles and community, even though they are the victim. A timeout is almost always enough.
- Cleaning up first, stopping second: while you delete, the account keeps posting. Always apply a timeout or quarantine first.
- Lizbot is too low in the role list: then Lizbot can neither remove roles nor restrict the person.
- Leaving AutoMod warnings in place: at the next small offence, escalation kicks in as if the person had spammed themselves.
- Letting them back without checking: someone writing "it's me again" is not automatically the real owner.
