Roblox has spent much of 2026 trying to make its platform safer for children, introducing age-based accounts, tighter chat restrictions, facial age checks, and expanded parental controls.
A new phishing problem is adding to those concerns. NordVPN’s 2026 Consumer Cybersecurity Report found that Roblox was the second-most impersonated brand in phishing attacks in its dataset, accounting for 12.32% of cases. Only Microsoft ranked higher.
The scammers are going after in-game currency
A recent report by The Guardian has provided more detail on how some of these attacks are being carried out. NordVPN researchers found almost 200 addresses offering ready-made Roblox phishing pages during a seven-day period. The scam usually starts outside Roblox. Links shared through YouTube, TikTok, or Discord promise free Robux and send players to a fake login page designed to resemble the real Roblox website. Robux is Roblox’s in-game currency, which players can use to buy items such as avatar clothing, accessories, and other virtual content.
Children may be asked for their username, password, or even a two-factor authentication code. After those details are entered, the page can redirect them to the legitimate Roblox site, so there may be little immediate indication that anything has gone wrong. Stolen credentials can then be used to access accounts, transfer Robux, or obtain personal information.
Roblox scams targeting children are nothing new
Similar tricks have been circulating around Roblox for years. Internet Matters, in scam-safety guidance supported by Roblox, lists fake giveaways, phishing, and account takeovers among the threats children can encounter. Some scams promise free currency or rare items, while others first build trust before asking for login details.
Attackers have also targeted young Roblox developers through fake job offers and malware. Many of these scams originate on websites and social platforms outside Roblox, limiting how much the company can directly police them. Its supported safety guidance acknowledges that moderation and platform rules cannot prevent children from encountering every fraudster.
Parents can reduce the risk by helping children recognize suspicious offers. Roblox-supported guidance recommends strong unique passwords, two-step verification, parental controls, regular conversations about online scams, and teaching children how to block and report suspicious users. Roblox also warns that legitimate free Robux generators do not exist and that login details should only be entered on its official website.
