Roblox scammers are hunting passwords: 196 phishing sites in one week

If your kid plays Roblox, read this to the end. NordVPN spotted 196 phishing sites posing as Roblox in just one week. Some are built smarter than the usual fake login page: they don't just harvest your username and password — they grab your two-factor code in real time, while it's still valid.

What actually happened

Roblox isn't a single game — it's a platform hosting thousands of games, from simulators to obbies and shooters. An account here works almost like a wallet: it holds Robux (the in-platform currency), purchased items and skins. That's exactly why accounts get stolen and resold in bulk.

According to NordVPN, 196 phishing sites impersonating Roblox were detected over one week. These aren't one-off cases but a steady stream: scammers clone the login page and spread links through Discord, YouTube, comments and direct messages.

How the scam works

The scheme is simple but effective, especially on kids and teens:

• They promise free Robux. The link leads to a page that looks like the official Roblox login.
• They ask you to 'verify your account.' You enter your login and password — and they're gone.
• They request your 2FA code. If two-factor authentication is on, the clone site asks for the code from your app or SMS and uses it immediately, while it's still active.

That last part makes these attacks more dangerous than before. A stolen password used to be useless without the 2FA code. Now the code is intercepted the moment it's typed — and the protection doesn't help.

If a site asks for your two-factor code anywhere outside the official Roblox window, it's almost certainly a theft attempt.

How to protect the account

A few simple rules that genuinely lower the risk:

• Never enter your password on third-party sites. The official login is only on roblox.com and in the app.
• Turn on 2FA — but stay alert to phishing. Codes go only inside Roblox, never on a 'free Robux promo page.'
• Check the URL. Scammers add extra letters, hyphens or different top-level domains.
• Don't click links in DMs or comments, even from a 'friend' — their account may already be hijacked.
• Don't buy Robux from resellers. Only officially, inside the platform.

If the account is already hacked

Move fast:

• Change the password if you still have access, and log out all sessions on other devices.
• Contact Roblox support through the official site — describe what happened and attach proof of ownership (Robux purchase receipts, old emails).
• If a card or payment method was linked to the account, review the payment history and block the card with your bank if needed.
• Warn friends: stolen accounts are often used to send the same phishing links onward.

Where payment comes in

Robux are bought with real money, and there's a nuance for parents. If the card linked to the account was exposed after a breach, it's safer to use a separate virtual card with a low limit — easier to control and reissue if the details leak. It won't stop phishing, but it limits the damage if a scammer reaches your payment data.

Quick checklist: what to do right now

• Check whether 2FA is enabled on your child's account.
• Explain: free Robux from a chat link don't exist.
• Unlink your main bank card if it's attached to the account.
• Review purchase history for the past month.

This article is for informational purposes only and is not financial advice.

Service, game and franchise names belong to their respective rights holders and are mentioned only to describe a payment scenario; VirtCardPay is not affiliated with them.