A 10-year-old boy who lost all his Robux after following a YouTube link promising extra currency is one victim of a fraud targeting Roblox users, many of them children, for their login details. With those details, criminals can steal the virtual currency and players' personal data.
Within Roblox, players use Robux to buy virtual items such as skins or animations for their avatar. The currency can be earned in the game or bought at Roblox's online store, where packages cost up to £199.99.
How the scam works
Fraudsters use ready-made kits bought on the dark web to create a fake login page identical in appearance to the legitimate Roblox site. When a child enters their details, the fake website redirects them to a legitimate Roblox page, so they end up where they wanted to go, according to Gerald Kasulis, vice-president of global affairs at cybersecurity company NordVPN.
By that stage, however, the criminals have the details they need for defrauding. Researchers from NordVPN say that over a seven-day period they found almost 200 addresses selling ready-made phishing pages that provided the tools to defraud Roblox users.
What it looks like
Links to the phishing sites often appear in comments on YouTube or TikTok videos or in chats on Discord, the chat app for gamers. The message might say there are free Robux available if a player clicks on the provided link. Like many scams, there is often an element of urgency attached, such as the offer apparently only being valid for a few hours, to encourage the victim to act without fully thinking through the consequences.
From that link, the child is taken to a fake sign-in page that is probably identical to a legitimate Roblox site in appearance. The address will usually contain the name Roblox, for example “Roblox-verify” or “login-Roblox”. When on the scam site, the child is asked for their username and password but may also be told to put in two-factor identification codes, says NordVPN. The child is then taken to the legitimate Roblox site so they can play their games as normal, leaving little indication that anything is amiss.
Once they have the login details, the fraudster may sell them on or use them to transfer Robux to another account.
What to do
Talk to children about scams. “One of the simplest habits is to encourage children to open Roblox directly through the official app or website rather than logging in through links they are sent,” says Marijus Briedis, chief technology officer at NordVPN. “Two-factor authentication remains an important protection, but authentication codes and backup codes should be treated just like passwords and never handed over to somebody else.”
If a player has lost their Robux to a hacker, it seems unlikely that they will get it back. Roblox says that it is under “no obligation” to assist people whose accounts have been compromised, unless it is required to do so by law. “Roblox does not guarantee that an individual's account will be restored to its previous state, or that Roblox will be able to recover lost virtual items or virtual currency,” it says. In “very limited circumstances”, Roblox says it may recover lost items or the value of them.
A spokesperson for Roblox says there are security measures in place to prevent phishing, such as two-factor authentication and a feature that stops criminals logging into your account from elsewhere. “We continue to work on new ways to minimise the risk of account theft and actively encourage Roblox users to follow security best practices, including not clicking on links or downloading anything from unknown senders or websites,” the spokesperson adds.
