The Infinity Kingdom Discord Scam: How It Works and How to Stay Safe

You are browsing a Discord gaming server — Dark Souls, Skyrim, MSI, it doesn't matter — when a DM arrives. Someone says they added you by mistake and apologises. Then they keep talking. They are funny, warm, easy to chat with. A day later they suggest playing a mobile game together. You download it. Then things get very expensive, or your phone is compromised, or both.

This is the Infinity Kingdom Discord scam. It is well-organised, unusually patient, and specifically designed to bypass the instincts that would normally make you suspicious. Here is exactly how it works, what the red flags look like, and how to protect yourself — including how a disposable email from FreeCustom.Email prevents scammers from profiling you in the first place.

Quick Summary: Is the Infinity Kingdom Discord Scam Real?

Yes — and it is more sophisticated than most gaming scams. Here is what you need to know immediately:

Question	Answer
Is Infinity Kingdom itself a scam?	No. It is a real game by YOOZOO Singapore. Scammers use it as cover.
Someone DM'd me "by accident" — is that the scam?	Almost certainly yes. Block immediately.
What are the risks?	Malware (RATs), stolen credentials, 2FA bypass, financial fraud
What should I do right now?	Block the account, report in Discord, do not click any links
I already downloaded the app — what now?	Factory reset your device. Change all passwords from a clean device.

What Is the Infinity Kingdom Discord Scam?

Infinity Kingdom is a legitimate mobile MMO developed by YOOZOO Games. The scammers have nothing to do with the game's developers — they simply use it as a vehicle. The game itself is real. The person inviting you to play it is not who they claim to be.

The scam has two main payoffs for the people running it:

Malware installation — getting you to download a modified version of the app that contains a Remote Access Tool (RAT), giving them persistent access to your device
Financial pressure — getting you inside the game and socially engineering you into spending money through in-game purchases or fake external payment sites that steal card details directly

Both can happen at the same time, and the operation is run by organised groups, not lone scammers. The scripts, personas, and techniques are consistent across thousands of reported cases.

How the Infinity Kingdom Discord Scam Works: Step by Step

What makes this scam unusually effective is patience. This is not a "click this link" hit-and-run. It is a deliberate rapport-building operation that typically lasts 24 hours before the dangerous phase begins.

Stage	What Happens	Purpose
1. The Hook	"Accidental" DM from a shared server	Initiate contact with a low-suspicion opener
2. Rapport	Hours of friendly chatting — food, games, daily life	Build fake friendship and a sense of obligation
3. The Pitch	Invitation to join their Infinity Kingdom alliance	Move target into a controlled environment
4. The Trap	Malicious download link or bundle pressure	Install malware or extract payment
5. Escalation	More spend requests, or abuse if refused	Maximise extraction before target blocks them

Stage 1: The Accidental Add

The scammer sends a DM: "Hey, are you [Name] from the [Game] team? Sorry, I think I added the wrong person." When you say you do not know them, they do not leave. They use it as an opening: "Oh well, since we're both gamers maybe we can chat anyway?" Real people who message the wrong person apologise and leave. This is always a script.

Stage 2: Building the Fake Friendship

They then spend hours — sometimes a full day — in friendly conversation. What are you cooking? What games do you play? They share photos of food or daily life. They present a consistent persona: almost always 23–28 years old, based in Hong Kong, Singapore, or Malaysia, presenting as a young woman using an anime avatar or AI-generated photo.

Documented aliases from reported cases include: Sylvia, Janice, Sharon_xl, Philyy.45. New aliases appear constantly as old ones are reported and banned.

Stage 3: The Invitation

Once enough rapport has been built, they suggest playing Infinity Kingdom together. Their alliance needs one more member. It will only take five minutes. They will wait. The pressure to say yes is social, not technical — you feel like you would be letting down a new friend.

Stage 4: The Dangerous Download Link

Instead of directing you to the Google Play Store or Apple App Store, they send a direct download link — framed as a regional version, a special build, or a faster option. This link leads to a modified APK that looks and plays exactly like the real game, because it connects to the real Infinity Kingdom servers. The difference is a Remote Access Tool running silently in the background.

Never download a game or app from a link sent in a private message. If it is a real game, it is on the official app stores. A direct download link from a stranger is a serious red flag regardless of how much you trust the conversation that preceded it.

Stage 5: Financial Pressure and Abuse

Once you are in the game, the social pressure ramps up fast. The "friend" tells you the alliance needs you to buy a bundle for an upcoming battle. It starts small — under a dollar — but quickly escalates to tens or hundreds. Sometimes they direct you to an external payment site claiming the in-game store is having issues. That site is built to steal your card details. If you refuse or call them out, the tone often shifts immediately to aggression or abuse — revealing what the preceding "friendship" actually was.

The Red Flags: How to Identify an Infinity Kingdom Discord Scammer

The accidental contact opener. Real people who message the wrong person apologise and leave. Scammers use it as a calculated conversation starter.
New account, no mutual friends. Most scam accounts were created recently and share no servers or friends with you beyond the one where they found you.
Consistent demographic script. The 23–28 / Hong Kong or Singapore / female persona appears in thousands of documented reports. It is a script, not a coincidence.
Avoidance of voice or video chat. They always have an excuse — bad microphone, noisy environment, shy. This is how they maintain a fake persona that would not survive a ten-second video call.
Rigid conversation steering. Ask them about a specific mechanic in another game they claim to like. If they pivot back to Infinity Kingdom without engaging, they are working from a script.
A download link that is not the official app store. This is non-negotiable. If the game is real, it is on the App Store or Play Store. Anyone pushing a different download source is pushing malware.
Pressure and urgency. "The battle starts in an hour." "I'll wait while you download." "We really need you." Legitimate gaming friends do not pressure you to download things immediately.

Official App Store vs Scammer Download Link

Feature	Official App Store	Scammer-Provided Link
Source	Google / Apple servers	Third-party CDN or cracked APK
Security scanning	Scanned and verified by platform	Contains Remote Access Tool (RAT)
Payments	Secured by Google / Apple	External links designed to steal card details
Updates	Automatic and verified	Manual — each update can inject more malware
Appearance	Identical to scammer version	Identical to official — impossible to tell visually

What Can the Malware Actually Do?

A Remote Access Tool installed on your phone is genuinely serious. Once active, it can:

Read saved passwords stored on your device
Access your photo gallery and camera
Intercept SMS messages — including two-factor authentication codes, which means it can bypass 2FA on your email, banking, and other accounts
Give the scammer direct control over your device in some variants
Operate silently — the app plays and looks exactly like the real game

The app connects to real Infinity Kingdom servers, so gameplay feels completely normal. There is no visual indicator that anything is wrong, which is why a factory reset is the only reliable fix if you installed from a scammer link.

What to Do If You Have Been Targeted

If you chatted but have not downloaded anything

Block and report immediately. Right-click the message in Discord → Report Message → Scams or Fraud. This helps Discord's safety team remove the account.
Adjust your privacy settings. Discord → User Settings → Privacy & Safety → turn off "Allow direct messages from server members" for servers you do not fully trust.
Warn others. Post in the server where you met them. Check r/InfinityKingdom and gaming communities to flag the specific username.

If you downloaded the app from their link

Assume your device is compromised. The only reliable fix is a factory reset — this removes user-level malware including RATs.

iPhone: Settings → General → Transfer or Reset iPhone → Erase All Content and Settings
Android / Samsung: Settings → General Management → Reset → Factory Data Reset

Do not restore from a backup taken after you installed the app — the malware may be in the backup. After resetting, from a clean device, change all passwords starting with email, banking, and Discord.

If you made payments through an external site

Call your bank immediately to report the charges as fraudulent and request a new card number
File a report with the FTC at reportfraud.ftc.gov and with local law enforcement
If you paid through the official App Store or Play Store, contact Apple or Google support — legitimate in-app purchases may be refundable when fraud is explained
Screenshot all communications before blocking — this is evidence for your fraud report

How Your Discord Account Ends Up on Their Target List

Scammers do not pick targets at random. They browse member lists of popular gaming servers looking for active player profiles — avatars, status messages, recent activity. The more your real identity is attached to your gaming presence, the easier you are to research and approach convincingly.

This connects directly to email. If your Discord account email has appeared in data breaches or been sold through data brokers, scammers can cross-reference it with other records to build a more convincing approach. The data pipeline that puts you on these lists:

You sign up for a gaming service, newsletter, or community using your real email address
That service is breached or sells user data to data brokers
Brokers match your email to your username, Discord handle, and social profiles
Scammers buy enriched gaming-targeted lists and begin profiling potential victims

Using a disposable email from FreeCustom.Email for gaming sign-ups, new Discord communities, and gaming newsletters means any breach or data sale dead-ends at an address with no real identity attached. Scammers cannot cross-reference a throwaway inbox to find your Discord profile or build a convincing approach.

Generate a free disposable inbox at FreeCustom.Email → No account, no signup, instant address.

The One Rule That Stops This Scam

If someone contacts you on Discord out of nowhere and, within 24 hours, suggests you download something — it is a scam.

It does not matter how friendly the conversation was. It does not matter how genuine they seemed. The friendliness is the technique, not the relationship. The entire preceding conversation was designed to get you to that download. No real gaming friend needs you to download from a private link they sent. If the game is real, it is on the official app stores.

Reporting the Infinity Kingdom Discord Scam

Where to Report	How	What It Achieves
Discord (in-app)	Right-click message → Report Message → Scams or Fraud	Gets the account banned, protects others on the same servers
FTC	reportfraud.ftc.gov	Feeds enforcement database for coordinated action
r/InfinityKingdom	Post with the username and account details	Warns the gaming community, gets aliases documented
Discord Trust & Safety	dis.gd/report	Escalated review for organised scam operations

Frequently Asked Questions

Is Infinity Kingdom itself a scam game?

No. It is a legitimate mobile MMO developed by YOOZOO Singapore and available on the Google Play Store and Apple App Store. The scammers have no connection to the developers — they use the game's name and interface purely as cover for malware distribution and financial fraud.

Why does the scammer spend so long building rapport instead of just sending a link?

Because a sudden link from a stranger gets ignored immediately. A link from someone you have spent a day chatting with — who feels like a genuine new friend — gets clicked. The 24-hour patience specifically bypasses the instinct that would otherwise make you suspicious. The entire rapport-building phase has one purpose: make the download request feel like a favour to a friend rather than a stranger's link.

Can I report the specific usernames like Sharon_xl or Philyy.45?

Yes — report them through Discord's in-app tool (right-click the message → Report Message) and post to r/InfinityKingdom to warn other players. Scammers cycle through usernames constantly, so reporting the account itself matters more than any specific alias. The goal is account removal, not just alias documentation.

I installed the app but I'm not sure it was the malicious version. How can I tell?

You generally cannot tell by looking at it — the malicious version connects to real Infinity Kingdom servers and plays identically to the official game. If you installed it from a private link rather than the official App Store or Play Store, treat it as compromised and perform a factory reset. The risk of leaving a potential RAT on your device is not worth the inconvenience of a reset.

Can a factory reset fully remove the malware?

Yes, for the type of malware used in this scam. RATs installed via user-downloaded APKs operate at the user level and are completely wiped by a factory reset. The critical caveat: do not restore from a backup created after you installed the suspicious app, as the malware may be embedded in the backup. Start fresh.

I replied but did not download anything — am I at risk?

Replying confirms your account is active and monitored. You may receive follow-up contact from the same operation under different usernames. Block the account, report it, and review your Discord privacy settings to restrict DMs from non-friends. If you shared any personal information in the conversation, change relevant passwords as a precaution.

I feel embarrassed that I almost fell for this. Is that normal?

Very normal — and important to understand why. This scam is designed by people who study social psychology. The slow rapport-building exploits the fact that humans are wired to reciprocate friendliness and feel obligation toward people who have invested time in them. Being nearly tricked by this does not reflect on your intelligence. It reflects on how deliberately and professionally the scam was constructed. Report it, share the warning, and move on.

How does using a disposable email protect me from this scam?

Scammers profile targets by cross-referencing gaming usernames with breached or sold email addresses — building a picture of who you are before approaching you. Using a disposable inbox from FreeCustom.Email for gaming sign-ups and Discord-adjacent services means any data breach or sale dead-ends at a throwaway address with no real identity attached. Scammers cannot link it to your Discord profile, making profiling and targeted approaches significantly harder.

Conclusion

The Infinity Kingdom Discord scam succeeds because it exploits something real: the human desire to be friendly and the social obligation we feel toward people who have invested time in us. The 24-hour rapport-building is not incidental — it is the entire technique. Knowing this is the most powerful defence you have.

The rule is simple: if someone you met on Discord suggests you download something within 24 hours, it is a scam. Do not download from private links. If the game is real, it is on the official app stores. Block, report, and move on.

For longer-term protection, keep your real email out of the data pipelines that let scammers profile gaming targets. FreeCustom.Email gives you an instant disposable inbox for any gaming sign-up or Discord community you are not certain about — no account required, no credit card, no real identity attached. For more guides on staying safe online, visit the FreeCustom.Email blog.