Check who owns a Discord account
Discord names can be copied, and accounts get stolen. A Veil card lets you check that a Discord account belongs to the person you think, from the account itself, and it keeps the keys out of reach of whoever takes the account over.
Written on
Why a name and an avatar aren’t enough#
Anyone can set the same display name and picture as someone else, and a stolen account looks exactly like the real one because it is the real one. Scammers count on that. They message the friends of a hijacked account, or turn up in a server as a moderator’s lookalike and ask people to click a link.
What can’t be copied is a signature made with a key that stays on the owner’s devices. A Veil card ties that key to the Discord account, and to the person’s other accounts, so the account and the key vouch for each other.
How to check an account#
- With the Veil app on Discord, right-click the person, open Apps and choose Veil card. You see the card that has linked their account, with its name and number, its other verified accounts and a link to check it.
- Without the app, copy their Discord ID. Turn on Developer Mode under Settings and Advanced, then right-click the person and choose Copy User ID. Paste the ID into the search on veil.pub.
- Open the card. Your browser checks it against the public log and its witnesses, and the page says In good standing only when every check passes.
Then look at the other accounts on the card. Two cards can share a name, so the name proves nothing. A GitHub profile, a domain or a Fediverse account that you already know belongs to the person is what tells you this is their card.
What the Discord proof is#
The owner links Discord by signing in to Discord from their card. Veil asks Discord only who the account is, keeps the account’s stable user ID and throws the sign-in token away. The owner’s device then signs a new version of the card with that link in it, and the version goes into the public log. The card shows when the account was linked and the log entry that proves it.
The Discord ID is what counts. A display name can change, but the ID stays with the account, so a lookalike with the same name and picture has a different ID and no card.
What a stolen account can’t do#
Suppose someone takes over the Discord account. They can post as it on Discord. They can’t sign as the owner, because signing needs a device key and those stay on the owner’s phone or computer. They can’t add a key to the card or remove the link either.
What a thief can do is ask to move the account to a new card of their own. That request waits 7 days, and the real owner can cancel it from their card without signing in to Discord. While it waits, signatures from the claimant’s card don’t count for that account. The owner can also mark the account as stolen from a date, and anyone who looks it up on Veil sees that warning first.
Ask for a signed message#
When it matters, such as before you send money or a password reset, ask the person to sign a short message with their card and paste the signature block. Paste it on veil.pub/verify. The page tells you which card signed it and checks the signature in your browser. A thief with only the Discord account can’t produce one.
Questions#
Do I need a Veil card to check someone else?
No. Looking up a card and checking it needs no account. You only need a card to link your own accounts or to sign.
Does the Veil app read my messages?
No. It answers the commands you send it and reads no messages. A server that adds it for roles needs to give it only Manage Roles.
What if the person has no card?
Then Veil can’t tell you anything about that account, and the search says so. A missing card isn’t proof of a scam. It only means you have to check some other way.
Can the server behind Veil fake a card?
It would have to fake the public log as well, which witnesses cosign. Your browser checks the card against that log, and a card the log doesn’t support fails the check.