The fake report message that ends with a stolen Reddit account

A direct message arrives on Reddit from a stranger, and it invites a reply. That reply is the point. This scheme runs on social engineering, with no malware and no malicious links, and it has spread across Reddit, Discord, and similar platforms. The goal is a single piece of information: a login or verification code that hands your account to someone else.

“The conversation usually starts with one of two claims. Either the person says someone reported their account and it looks like it was you, or they claim they accidentally reported your account by mistake. If you deny it, the scammer doesn’t argue. They say it was probably an honest mistake and keep the conversation going. They might ask if you know who reported them or suggest you can help clear things up. The goal is simply to keep you engaged,” Stefan Dasic, Senior Malware Research Engineer at Malwarebytes, explained.

The fake proof

Then comes the “proof.” The scammer sends a screenshot of an email dressed up to look like official Reddit correspondence. It carries a formal tone, a ticket number, a line about a “formal investigation,” and a countdown, often 12 hours, before “suspension, limited features, or a ban.” Some versions route you to a Discord contact posing as a Reddit employee or moderator. Others add a fake legal warning citing laws that have nothing to do with the situation.

Paired with threats of suspension, restricted features, or a ban, it pressures you into acting quickly, before the story gets a second look.

The moment the code arrives

The report and the fake email set the stage for one request. The scammer says a Reddit employee or “supervisor” needs to verify your account to confirm you were uninvolved, and that verification means reading back a code Reddit is about to send.

During the conversation, the scammer signs in to your account or starts an account recovery. Reddit reacts by sending a login or verification code straight to you. The timing lines up with the script: the code lands moments after you were told to expect it. Read it aloud, and the scammer uses it to enter your account, change the password, and lock you out.

Some versions push further. Victims get talked into changing the email address tied to the account to one the scammer owns. A demand for a gift card or other payment follows, with threats to delete the account or turn it against other people unless the victim pays.

How Reddit handles reports

Reddit manages reports, moderation, and appeals inside its systems. People named in a report are never asked to contact each other. Verification of an account through a stranger in a direct message plays no part in the process. Appeals travel through Reddit, with no detour to a staff member’s personal Discord account. Any request that steps outside those channels is a scam.

Steps that keep an account safe

A few habits shut this scheme down. Keep every login and verification code private, even from anyone claiming to be Reddit staff. Refuse any request to change the email on your account for a stranger. Treat a demand for gift cards or money to resolve a report as proof of a scam. Turn on two-factor authentication with an authenticator app, and read any surprise login code as a sign that someone is trying to get in. Lost access calls for Reddit’s official account recovery process at reddit.com, along with a new password and a report through Reddit’s built-in tools.

Read more:

• Using Reddit to manipulate AI search results is surprisingly easy
• Reddit declares war on bad bot activity