Roblox phishing scams are targeting young players across platforms like YouTube, TikTok, and Discord, draining accounts of valuable Robux and personal data using sophisticated fake login pages. Cybersecurity researchers from NordVPN identified almost 200 addresses selling ready-made phishing kits over a seven-day period, putting millions of children at risk of digital theft.
How the Fake Roblox Login Scams Work Online
Fraudsters use ready-made kits purchased on the dark web to replicate the official Roblox login page down to the last pixel. Victims are often lured through comments on YouTube and TikTok videos or direct chat messages on Discord. These messages promise free Robux if users click an external link, frequently adding a false sense of urgency—such as a time-sensitive deadline—to bypass critical thinking.
“The kid will enter their details and the fake website will actually redirect them to a legitimate Roblox page,” says Gerald Kasulis, the vice-president of global affairs at cybersecurity company NordVPN. Because the site eventually drops the user onto the real gaming platform, children rarely suspect that their credentials have been compromised.
What Happens After Accounts Are Compromised
Once a child inputs their username, password, and sometimes even two-factor authentication codes into the fraudulent portal, cybercriminals gain complete control over the account. Attackers typically sell the credentials on illicit marketplaces or transfer the victim’s Robux balance directly to external accounts. Within the platform, players use Robux to purchase virtual items like avatar skins and animations, with official packages costing up to £199.99.
Recovering stolen virtual currency remains remarkably difficult for affected families. According to official platform policies, Roblox states it is under “no obligation” to assist users whose accounts have been compromised unless legally required to do so. The company maintains that it does not guarantee account restoration or the recovery of lost virtual items, reserving refunds for very limited circumstances.
How to Protect Children From Roblox Phishing
Security experts advise parents to establish strict digital habits to safeguard young gamers from credential theft. “One of the simplest habits is to encourage children to open Roblox directly through the official app or website rather than logging in through links they are sent,” explains Marijus Briedis, chief technology officer at NordVPN. Families should also reinforce that two-factor authentication codes and backup codes require the same strict confidentiality as passwords.
Pro Tip: Account Security Best Practices
A Roblox spokesperson emphasizes that users should never click links or download files from unknown senders or unverified websites. Enabling platform security measures, such as two-factor authentication and anti-phishing features, helps prevent unauthorized logins from external devices.
Frequently Asked Questions
Can I get stolen Robux back from Roblox?
No, Roblox states it is under no obligation to recover lost virtual currency or items, and account restoration only occurs in very limited circumstances.
How do scammers steal Roblox login details?
Fraudsters use fake login pages bought on the dark web that look identical to the real site, often distributing links via YouTube comments, TikTok, and Discord.
What should I do if my child clicks a suspicious link?
Change the account password immediately, enable two-factor authentication if not already active, and instruct your child to only access the game via the official app or website.
Stay Safe Online
Have you or your family encountered suspicious gaming links online? Share your experiences in the comments below, and subscribe to our newsletter for the latest cybersecurity alerts and digital safety guides.