A promise of free Robux can leave Roblox players — many of them children — without their in-game currency and with their personal data exposed after scammers lure them to fake sign-in pages.
According to NordVPN researchers, scammers use links shared on YouTube, TikTok, and Discord to steer Roblox players to fake sign-in pages built to harvest usernames, passwords, and personal data.
Here's what to know
The Guardian reported that some "free Robux" offers work by sending players to a counterfeit login screen. When a user clicks through and signs in to claim what looks like a limited-time reward, the page can capture account details before sending the player on to the real Roblox site.
Because the bogus page passes users to Roblox afterward, the scheme can seem legitimate. "The kid will enter their details and the fake website will actually redirect them to a legitimate Roblox page. So ultimately, the kid will get to where they want to go," Gerald Kasulis, the vice president of global affairs at NordVPN, a cybersecurity company, explained.
Once those details have been entered, attackers may control the account. According to The Guardian, researchers identified nearly 200 addresses over seven days that offered phishing pages to scam Roblox users. Once a scammer gains access to an account, they can transfer Robux to another account or sell the login details.
Because Robux can be purchased, losing them is not just a virtual inconvenience. Players can earn the currency in-game, but families can also buy it directly, with Roblox offering packages priced as high as £199.99 (about $226.81).
TCD Picks » Quince Spotlight
💡These best-sellers from Quince deliver affordable, sustainable luxury for all
More background
These scams often work because of the pressure to act fast. A child may see a comment or message promising free currency for only a short time, making them more likely to click before checking whether the link is genuine.
One clue can be the web address. Fraudulent pages may closely copy Roblox's sign-in screen while using URLs that still include the word Roblox, such as "Roblox-verify" or "login-Roblox." NordVPN said some of the sites also asked users for two-factor authentication codes, creating another route for criminals to access accounts.
Roblox says it has no duty to help people with compromised accounts unless the law requires it, and it does not promise to restore lost items or currency.
What can be done?
Offers of free currency, especially those shared in YouTube or TikTok comment sections or over Discord chats, should be treated with caution.
"One of the simplest habits is to encourage children to open Roblox directly through the official app or website rather than logging in through links they are sent," Marijus Briedis, chief technology officer at NordVPN, said, per The Guardian.
He also urged families to guard security codes the same way they would passwords. "Two-factor authentication remains an important protection, but authentication codes and backup codes should be treated just like passwords and never handed over to somebody else," he said.
A Roblox spokesperson said anti-phishing protections are in place, including two-factor authentication and a feature that can block logins to accounts from other locations.
"We continue to work on new ways to minimise the risk of account theft and actively encourage Roblox users to follow security best practices, including not clicking on links or downloading anything from unknown senders or websites," the spokesperson added, according to the newspaper.
Where can I learn more?
These stories discuss the same concerns about online scams and child safety.
• Online "crypto faucets" have a real cost for users when scam offers demand risky clicks.
• Roblox faces a class action lawsuit after a 13-year-old alleged unpaid labor.
• The Salvation Army and Roblox debuted a digital thrift store inside the gaming platform.
Get TCD's free newsletters for easy tips, smart advice, and a chance to earn $5,000 toward home upgrades. To see more stories like this one, change your Google preferences here.
