The signals that give it away

You do not need to spot every trick. You need to notice a handful of things, any one of which is enough to stop.

The address is nearly right. discordapp.gift, discord-nitro.com, dlscord.com, steamcommunnity.com. Attackers buy names that survive a glance. The real ones are discord.com and steamcommunity.com, and the part that matters is what comes immediately before the first single slash.

It arrived unexpectedly. Nobody sends you a year of Nitro because you are nice.

It is in a hurry. Expiring offers, threatened suspensions, a deadline. Real account problems wait for you.

It wants you to log in - from a link. This is the one that matters most. If you need to sign into Discord, type the address yourself or use the app. Never sign in from a link somebody sent you, even a link from a friend, even a link that looks perfect.

It wants you to run something. A vehicle pack, a resource to test, an anti-cheat, a screenshot tool. Executables from strangers - or from friends who have gone quiet and odd - are how the next account goes.

It asks for a code. Nobody legitimate needs your two-factor code. Not Discord, not Steam, not Cfx.re, and not AGN staff. There is no situation where a staff member needs that number, ever.

When something trips one of these, the safe move costs you nothing: close it, go to the site yourself, and see whether the thing it claimed is true. It will not be.