GoKawiilBrady Frey did not realize that his daughter lied about her age when she set up her Discord account. He only found out after her account got hacked and he got trapped in a spiraling support nightmare while trying to stop the hacker from targeting dozens of her young friends with financial extortion scams.
When Frey’s daughter signed up for Discord, she was 12 and technically not old enough to have an account. But like many kids whom regulators have found commonly lie about their age to access social media platforms, she didn’t want to wait another year to join her friends on the messaging app. Hiding her age, she created an account that listed her as over 18 years old.
Now 13, the teen had been happily using the app for months when she suddenly got locked out of her account after clicking on a link from an attacker posing as Discord support. Since she didn’t enable two-factor authentication, the attacker was able to commandeer the account. Frey only found out what was happening when the attacker asked the teen to share her parents’ banking information if she wanted to get her account back.
Once Frey realized his daughter had been hacked, he assumed that Discord would promptly intervene, recognizing that many minor victims on her friends list could be harmed the longer the attacker kept control. Instead, Discord’s chatbot, Clyde, and a seeming human support member, Nelly, automatically closed her support tickets after telling her it would be best to report the issue from inside the app, which she could not access.
Frey told Ars he was shocked to see a platform as big as Discord relying on such poor support infrastructure.
“There’s no pathway for a parent to step in and advocate for a minor whose account has been compromised,” Frey told Ars.
Discord won’t update age setting
Eight days passed, as Frey attempted to evade the support forum’s irrelevant auto-responses and abrupt ticket closures by clearly explaining that “we’re requesting priority handling given this involves a minor, and this account is actively communicating with other minors who may also be targeted by the same social engineering tactics.” But the ticket was ignored, and the hacker wasn’t booted until Ars intervened.