The short version.
The pattern: scammer befriends a kid inside a Roblox game (usually a popular hub like Brookhaven, Adopt Me, MM2), the kid adds them on Discord because Roblox chat is filtered, the scammer sends a phishing link disguised as a Roblox URL — robux-claim.com, rblx-rewards.net, ro-tester.app. The kid logs in to 'claim' the offer. The login form posts directly to the scammer's server. The scammer immediately changes the email + password and offloads everything tradeable to a holding account before the parent notices.
The platforms and contexts.
Originates inside any popular Roblox game's chat or community Discord. The phishing pages are hosted on cheap domains turned over within hours — Roblox can't keep up with takedowns. Same pattern operators target Fortnite, Minecraft, Valorant accounts.
The timeline.
Active since at least 2017; matured into an organized industry by 2020. Reddit's r/RobloxHelp gets dozens of fresh account-takeover threads per week. Roblox has hardened login with 2FA but most kid accounts never enable it.
The core facts a parent needs.
- The fake login pages are good. They reproduce Roblox's exact look — font, button colors, even the floating wave animation. An adult can spot the wrong URL; an 8-year-old typically can't.
- Most kid Roblox accounts don't have 2FA. The recovery email is sometimes the kid's, sometimes a parent's — and scammers swap it immediately, locking everyone out.
- The social cost is real. If the account had OG status, rare items, friend list, or a popular custom avatar, the kid feels 'erased' — and may try to recover via a SECOND scam offering 'account recovery service.'
What's actually at stake.
- Total account loss including years of Robux purchases, rare items (worth hundreds or thousands on grey market), in-game friends, and the kid's reputation in the games they played.
- Cascade: same password reuse on Discord, Snapchat, email → all of those follow. Especially bad if the email was the parent's billing email.
- Predator pipeline: the same actors who run takeover scams also run grooming. A kid in panic over their lost account is easier to manipulate.
The talk that lands — try it now.
Imagine you just learned your teen brushed up against this. You have 60 seconds before the conversation begins. What you say first decides whether the next 20 minutes opens the door — or slams it.
"What were you thinking? Give me your phone — now."
Panic + punishment in the same breath. The teen reads it as "every honest detail will be used against me." The phone comes; the truth doesn't.
What would you open with instead? Picture it for a beat — then…
"I want to ask about something — no trouble, I just want to understand it. Can we sit for five minutes?"
Curiosity, not court. Promise of safety in the first sentence. Time-bounded so it doesn't feel like a trap. Almost every teen says yes to five minutes.
Then, in those 5 minutes:
- Enable 2FA on the Roblox account TODAY: Settings → Security → Two-Step Verification (authenticator app, not SMS). Do this on every gaming account in the house. Five minutes per account.
- Frame the rule the way kids will remember: 'No login pages from links. Ever. Real Roblox login is roblox.com — type it yourself. Anyone offering free Robux or items in a link is a thief, no exceptions.'
- If the account is already taken: support.roblox.com → Account Hacked. Have the original purchase receipts and creation-date evidence ready. Some accounts recover in days, some never. Manage expectations.
Try saying it out loud once before you close this tab. Cool parents rehearse — yelled parents wing it.
Practice 200 more parent–teen scripts →Concrete next steps.
- Enable 2FA on the Roblox account TODAY: Settings → Security → Two-Step Verification (authenticator app, not SMS). Do this on every gaming account in the house. Five minutes per account.
- Frame the rule the way kids will remember: 'No login pages from links. Ever. Real Roblox login is roblox.com — type it yourself. Anyone offering free Robux or items in a link is a thief, no exceptions.'
- If the account is already taken: support.roblox.com → Account Hacked. Have the original purchase receipts and creation-date evidence ready. Some accounts recover in days, some never. Manage expectations.
Roblox support (support.roblox.com) · If real money was on the card: contact card issuer + check statement for unauthorized charges · NCMEC CyberTipline if predator contact was involved.
