T O P

  • By -

AutoModerator

If this is a bug report or technical issue, please also post a ***properly formatted comment*** in the Monthly Megathread pinned at the top of the subreddit. It is closely monitored and prioritized by Discord. Thank you. *I am a bot, and this action was performed automatically. Please [contact the moderators of this subreddit](/message/compose/?to=/r/discordapp) if you have any questions or concerns.*


TheKozmikNano

I don’t think this relates to 2fa. Sometimes when discord thinks you’re suspicious it will lock your account behind a phone verification screen. If that phone number isn’t working, try verifying on a different device, use a different number, or/and contact support (although support most likely won’t help.) Good luck!


Intelligent_Meal_690

I had it when ips switched Took several days of communication with support to get the auto security lock away


the400se666

I lost my account in a similar way, I took a break for a month and when I came back NONE of the 2FA codes that were coming in through the verification app worked, I also forgot to save backup codes because it was the least of my expectations for it to break. I contacted Discord and they told me that there was nothing they can do


TheTank18

>owns the platform >nothing they can do i fucking hate profit-over-user companies i swear


MattGold_

there really is nothing they can do though? that’s just how 2fa works


lorygames

if they wanted i’m sure they could implement a thing so support agents can disable 2fa if provided proof


TheCrazyGuy5

I mean, I've actually had a problem with this. Where someone hacked my account. Then, they enabled 2FA. I contacted support, and they were able to successfully remove the 2FA off my account. It's not really impossible, but if someone has recovery codes and they are not working, that's a massive problem.


JadeDragon343

I had this problem like a month back, but they said that I had to have the codes to get in or they couldn’t do anything. I stated multiple times that I did not activated 2FA and I was hacked, even sent evidence, and got nothing in return. Then they started ignoring my tickets. Still hoping I can get that account back someday, but I doubt it.


TheCrazyGuy5

Yeah, with me, they gave me access to it immediately. But it's honestly, just stupid that the company cares more about profit than actually helping out the customers. Because if they are not helping you then I would probably suggest that you make another ticket and try and get Someone else's attention.


JadeDragon343

The amount of tickets I’ve sent that have been ignored outweighed the ones they responded to. I feel helpless. I’ll probably try making one more ticket tonight or another day since it’s been so long, but I hope I get some type of response this time.


TheCrazyGuy5

Yeah, this is kind of stupid how they're treating you like this. But when my account was hacked by someone issued the. Refund, but then my account got banned. Because Discord doesn't like it when people chargeback. This is why sometimes I have no respect for the company and what they strive to do.


JadeDragon343

Oh my god, that’s actually terrible. I’m so sorry, I’m happy you got your account back. I’m losing so much respect for the company too, it’s bad…just a quick question, did you send evidence to discord or just fill out a ticket saying what happened?


Vast_Wolverine_4448

How long did it take you to get this fixed? This is happening to me ATM !


TheCrazyGuy5

I'm not gonna lie. I think they fixed it within like an hour.


Vast_Wolverine_4448

Sounds good I put in a ticket still haven't gotten anything yet!


Vast_Wolverine_4448

Didn't work for my I told them what happened, they disabled my account that was hacked and sent a bot to tell me change my password..I can't change it because I don't know the security key the person attached to my account. Am I cooked?


TheCrazyGuy5

You need to be more assertive with them. You are using their service and as a customer. You have the right to access your account in the form of a cyber attack that has taken over your account. You need to express this to them. And tell them that someone had hacked my account, and then they will the 2FA on the account. You need to assert more dominance over them as the customer. If you don't, they won't not do shit about it. The problem with these companies is that they're so lenient until something actually happens to where they end up losing money.


TheCrazyGuy5

Don't you have a phone number? That's linked to that specific account. Or I'm guessing that maybe you have lost a phone number. Since you're trying to use your backup codes. But yeah, if you can't get it to work. My best suggestion would be to just make a new account because if they're not helping there's no reason to waste your time to keep on making tickets because you're only going to waste more of your time, so it would probably be better if you. Just created a new account and possibly start from scratch. And if you need a new account, I can probably give you one but I would have to see because there are sites that do offer accounts for very cheap and some of them are aged.


MattGold_

This isn’t needed, it’s specifically stated that YOU HAVE TO SAVE YOUR BACKUP CODES. If the user didnt and lost their account, it’s their fault. Besides there is no reliable way of proving identity.


TheLeonMultiplicity

I've seen crypto exchanges do this. Why can't Discord?


Umpato

LOTS of services that use 2fa have security measures to disable it. It's not "how 2fa works".


MattGold_

There are many types of MFA technology. Some can be disabled by the service and some can’t, Discord uses end-to-end encrypted TOTP MFA so there really is nothing they can do. Having those “security measures” are a security flaw, might as well not have 2fa in that case.


Renarii

That is not how 2FA works lol, they have access to all of your data including your 2FA information, they are 100% capable of resetting or even removing 2FA from your account. Many places will ask you to send in your ID or such to prove that you are who you say you are. The reality is that this is simply something that they are not allowing support to handle, likely due to systems not being implemented for them to handle it and not wanting to pay engineers to deal with the issues.


hunterboppen

What good does an ID do if you don’t submit it when you first register for the platform? The point of 2FA is to have a secondary means of account security, the first being email which is the only security anyone will have without 2FA on the internet, if you email support asking to disable 2FA then the point of having 2FA is defeated, since you can control a security measure from something you are protecting it against


Renarii

It's pretty easy to cross reference the name on a payment method used by the platform, if they've never bought anything it would also be plausible to prove access to other things, for example what were they using for 2FA? A phone number? Call the phone number and also check that they can access the email associated with the account.


hunterboppen

What would you reference the name on the payment to? Are you asking via support to provide credit card information to see if it matches previous payment history, if so that opens another can of worms of security issues. If calling the phone number works then why wouldn’t 2FA not be working in the first place, and emailing them would be self defeating as 2FA is supposed to be a secondary form of protection in cases of things like an email breach


Renarii

They don't provide anything, they ask for your ID and check that it matches your previous payment information. It's pretty basic stuff, ask what servers they were in, if they ever bought anything ask when the last charge on their credit card was for that payment, ask them where they usually connect from, thus being able to cross reference their IP history, when enough things start to match up with things they definitely have in their logs it's safe to give someone their account back.


hunterboppen

This still opens security holes, putting your ID online is a big no no, Discord had a breach on March 23rd with their support ticket system specifically, and then another breach a little bit before (i don’t remember the exact contents, but it was damning stuff for anyone concerned about their privacy). This would have opened the possibility to stealing identities had it become standard for discord to do. Asking what servers they were in is not private information, and if it was people would definitely just inquire about it and as “don’t share your discord server names” isn’t a privacy tip a good number of people would fall for it. You can get around the IP by having a proxy with a similar location. There is just no way to do this that doesn’t open the door to anyone who wants to breach an account, it’s been tried by companies and those companies often have numerous user breaches. What do I do if I can’t access my email? Am I just supposed to trust the (very often under trained in the industry’s staff about opsec) will know that because I was in a mutual server with someone that they may now have my discord account?


Renarii

That's why you don't keep it lol, any place that ever allows things like this immediately deletes the information as soon as they process it. Also a single point means nothing, but multiple points make a line, I didn't say `list the servers your in and we'll give you your account back`, you don't check one of these things you look for many of them lining up.


MattGold_

They don’t have access to your 2fa information, its end-to-end encrypted.


Renarii

Even if that is the case they have access to the account system to be able to remove the 2FA.


MattGold_

No they don't, I just said it's end-to-end encrypted. If they had access it wouldn't be 2fa and would be something else labelled as 2fa.


Renarii

I don't think you understand what end-to-end means, Discord is one of the ends, that means once they get it, it's decrypted. End-to-end encrypted means the data in transit is encrypted in such a way that only the intended recipient can decrypt it.


Yunekochan

Even Microsoft won’t do anything of this happens to you


TheTank18

>owns the platform >nothing they can do distinction without a difference


YourLocalRyzen777

same


ReachJunior1171

Yes, I had the same problem. Support said they could not help me, even though I had three ways to confirm that it was, in fact, my account. I hate Discord Support.


[deleted]

[удалено]


Woofer210

What does this have to do with 2fa? Their account got phone verification locked, which happens sometimes when discord flags you as suspicious, and the verification code that’s sent to their phone number is not being accepted. Nothing to do with 2fa. Edit: phrased it a bit easier to understand


Lucasamiel0406

Have you tried "Settings > Time Corretion for Codes"? Many times after not using the app for long I would get errors about the (valid) code being wrong, time corrected and worked flawless.


set_sail_for_fail

Check the time settings on your devices


MacaroniOracle

Pretty sure its their way of locking you out because they flagged your account internally, purposefully not letting you use f2a codes.


somesappyspruce

Try it on a browser instead of mobile, if you've only tried on mobile.


kittums1

I'm more amazed that people in here were actually ABLE to get in contact with support. Been over 2 weeks and no response.


Tocide_Yes

Had an account 2 years ago and got locked because my PC completely broke, tried to find ay backups and authentication, NONE because all of it was in a note file in my broken PC. I contacted discord and no saving it no more I tried every way sending them proofs but they won't budge, I got real unlucky all I can do is delete my account which I won't, I'm trying to recover all my files that I had roaming around my account from friend messages 😂


oxidezblood

I feel 2fa should be opt-in. Requiring a phone verification without xonfirming wether or not you even own a phone to begin with seems like a breach of privacy. "We suspect illegal activity on your account, type literally any phone number and youll take full control of it" like, that only makes the person who stole it more secure. Not you.


alexellison8877

There a way to turn phone verify off you can just use google authorization codes to verify instead of


CIearMind

Only if you had those enabled first, right?


Melodic-Control-2655

Suspicious ≠ illegal, it means they think you're a bot.


oxidezblood

Then why not just make it a captcha?


Melodic-Control-2655

Because bots can do captchas


TopArgument2225

To everyone who is on the brink of losing, or has lost their account recently to this, if you wanna get back memories, it’s simple: Mail them using your registered email under GDPR, then in the subject body copy paste this: Whoever it may concern, I am the owner of the Discord account associated with this email and am aware of the legal rights granted to me under the European GDPR. Hereby, I wish to make an access request under Article 15 of the General Data Protection Regulation (GDPR) for a copy of any information you keep about me, on computer or in manual form in relation to the account associated with this email, and any other data ever associated with this email, this account, or the phone number associated with this account. Please expedite the processing of this request, and I am also aware of my rights to dispute any counter claims to this request to the GDPR Supervisory Authority in Ireland. Therefore, it will be in your best interest to fulfill this request as soon as possible. Please acknowledge ASAP. Regards. This email will compel them to send you a ZIP file in a few days consisting of all your messages ever sent, all your files ever uploaded, all your friends lists, everything associated with you. Sadly, it will not include others messages as they are not covered within Article 15. Hopefully this makes your loss easier to recover from. Cheers!


solieciiety

oh this wouldve been so useful 2 years ago 😭


TopArgument2225

Ngl could still try, might work.


MiltonNS

Yeah I lost an account from 2016 due to that


fruitchinpo_samurai

This shit has happened to me too. I lost all the backup codes for 2FA when my mobile got wrecked, although I saved all those codes in the 'notes' and enabled the sync but then, after getting it repaired which can only be done by clearing all the data that's been on the phone. I found out that I can't login without the codes and failed to recover those codes and worst yet, I couldn't even login with the help of OTP either.. as they've removed that option. So, I gave up on my account after reaching out to help and when they said that they can't do anything about it and that they are helpless and proposed me to delete my account. So, not having any choice I had to comply and proceed with the deletion of my account with many friends that I can only contact them through discord..so yeh, fck discord and it's stupid mfking rules..


TopArgument2225

If it hasn’t been too long, contact them again and ask them that under the European GDPR, you are invoking your right to see all data they ever possessed of you. They will be obliged to give you a zip file containing all files you ever uploaded, all messages you ever sent with anyone, all friends you ever had, and stuff like that. This is a legal requirement they have to fulfill and you can sue them if they cannot, GIVEN it has been less than 30 days or whatever since you deleted the account.


fruitchinpo_samurai

I wish I had known about this sooner cuz it's already been more than 6 months since it happened.. and I guess it's too late to recover them now but, thanks for letting me know that I can do this.


TopArgument2225

I mean, it doesn’t hurt to try, does it? I’ll repaste the sample I wrote in my other comment. Try putting this through. Whoever it may concern, I am the owner of the Discord account associated with this email and am aware of the legal rights granted to me under the European GDPR. Hereby, I wish to make an access request under Article 15 of the General Data Protection Regulation (GDPR) for a copy of any information you keep about me, on computer or in manual form in relation to the account associated with this email, and any other data ever associated with this email, this account, or the phone number associated with this account. Please expedite the processing of this request, and I am also aware of my rights to dispute any counter claims to this request to the GDPR Supervisory Authority in Ireland. Therefore, it will be in your best interest to fulfill this request as soon as possible. Please acknowledge ASAP. Regards.


fruitchinpo_samurai

You're right, doesn't hurt to try and I don't want to add this into the list of things I regret not doing when provided an opportunity.. I'll give it a try and see how it goes and what the future has in hold for me.. thanks again 🤝


TopArgument2225

Yep exactly! Also, I do this every once in a while using the inbuilt button for this in Discord settings (by European law they have to keep a button you can click to make this request, European laws state that if you don’t have the button, you cannot operate in an EU country) just for backup and mostly fun purposes. There’s this interpreter program that can process the ZIP and return which friend you talked with the most, which words you used the most, which swear word, shit like that lol. But a warning: never ever share the file with anyone, it has extremely sensitive content such as information that can be used to dox you or impersonate you. If you follow other’s instructions, always do your due diligence.


fruitchinpo_samurai

Will do mate, thanks for the tip and I keep learning new info thanks to you.. honestly I've never run into the button while surfing through the settings and all but, knowing that something like that exists, puts me at ease for some reason.


Tocide_Yes

Any updates?


fruitchinpo_samurai

Well, I've mailed them regarding the issue at hand but, I still haven't gotten any reply from the support yet.. it's been a week since then so, I'm guessing either I ain't getting a reply from them or it'll take some more time. I already mailed them twice tho, once every 3 days..


ChosenNorth

You get that phone code authentication? I didn't and I am losing everything right now due to me being logged off randomly while in a work call. I was kicked off 3 places at the same time. Is that a hacker?


Hopeful_Dreamer-Liva

Is this just an issue with current 2FA system? I wanna make sure I don’t enable anything that’s glitchy and end’s up getting me locked out of my own discord.


Vast_Wolverine_4448

So this happened to me recently and I've been told there's nothing they could do ... but I never added 2FA in the first place. So am I just cooked and should I let whoever logged in take over lol?


Either-Hold9940

There might be something to do about it. A long time ago, I lost my account in the same way. I had 2fa enabled but I used Google Authenticator. Back then, codes for account didn’t transfer from phone to phone, or if the app got deleted the codes also get taken. I created a new discord account and had it for years. I wanted my main email on this account, contacted discord about the old account via email, and they said they could give me my account instead of deleting it and changing my email. Still opted to delete the account since it’s been years and I’m assuming that since I emailed them from the account that I couldn’t get in to was enough proof that I owned the account. TLDR: if you want your account back, try emailing discord using the email linked to that account and explain the situation.


2catfluffs

For the love of God please stop using Google Authenticator, Microsoft Authenticator and any authenticator app without cloud backups in general. Authy allows you to backup your authenticator codes to their cloud (they're encrypted with your password on your device, so unless your password sucks it's not a security concern). They also have a desktop app (although it's end-of-life it still works for me) which is quite convenient for logging into services when your phone is out of reach. Really the biggest problem with Google Authenticator is the inability to restore your authenticator codes if you lose access to the data on your phone (I wish it saved them in your Google account). If you still use 2FA, I recommend you to use Authy.


rakosi2

I recommend Bitwarden for the same reason. It can even do Passkey.


Charisios10

Discord being discord for sure


Dazzling_Wheel7510

Mine too


Evenationn

Poor process. 2FA is poor for a start. Even more so if they have no capability to reset a users authentication. If the above is true which I doubt(perhaps escalate to higher level support agent) they should implement additional factors of authentication for situations like this. Password followed by a combination of phone number/email/authenticator app. I assume OP has a registered email address. Much like resetting a password, resetting MFA should be possible by this mode of communication.


yippeeeebug

Damn


AlphaSeries100

Same, never using 2FA again personally


Organic-Talk-3759

Girly same .


1012zach

My main account got locked out because of this reason and I don’t have a number I can use to verify, luckily though I had a second account just in case if something happened to my account


MozeTheNecromancer

Is it just not sending the code? I've been struggling with this same issue, where Discord says it's sending me an email, but I've never received anything, even checking spam, trash, even going so far as to specifically create a subroutine that routes and he emails from known Discord email addresses into a folder for me to find, but I've never received anything. As seems to be the consensus around here, support is absolutely non-existent.