Lock it down, in order
Work top to bottom. Each step makes the next one count for more.
Ticks stay on this page only and clear when you leave.
Already been taken over?
- Remove malware and browser extensions first Run a full virus scan, restart, scan again, and remove any browser extensions. Roblox doesn't make browser extensions.
- Reset your password Change it to something secure that isn't easy to guess.
- Turn on 2-Step Verification Go to Settings > Security and enable it, ideally with an authenticator app.
- Contact Roblox Support if the reset fails Contact from the first email address added to the account, or the billing email used for the very first payment, to help prove ownership.
- Act within 30 days for lost items Roblox says that to seek help with lost items or currency after a compromise, you must contact it within 30 days.
Red flags to watch for
- An offer of free Robux or a prize in exchange for your login.
- An in-experience form asking for your username or password.
- A link with spaces or odd characters, or instructions to 'remove the *' to visit it.
- Someone asking you to screen share while you log in or view account details.
- A request to trade or buy items outside Roblox's official systems.
Roblox 2-Step Verification methods compared
Roblox offers several 2-Step Verification methods, but you can only have one switched on at a time. To enable one, log in, open Settings (the gear icon in the top right on the website, or the three dots and then the gear icon in the app), go to the Security tab, and turn on the toggle for the method you want. You need a verified email address first.
- Email: Roblox emails a code each time you log in with your password.
- Authenticator App: a code from an app such as Google Authenticator, Microsoft Authenticator, Duo or Twilio Authy. Roblox recommends this option.
- Security Keys: a physical key or your device's face or fingerprint unlock. You must also have the Authenticator App method enabled, so you still have a way in if you lose the key.
Roblox also uses a 'second device' check: if you're already logged in on a phone, a new login may ask you to approve or reject it there, showing the device type, location, IP address and time. If you didn't try to log in, deny it and change your password, because someone may have it.
One detail worth knowing: Roblox says that if you log in with a passkey, 2-Step Verification is bypassed, and logging in with an email one-time code bypasses email-based 2-Step Verification. So whoever controls the email inbox matters a great deal.
Recovery codes and the two-method rule
Roblox has tightened account recovery for accounts that use 2-Step Verification. If you lose access to your main method, you'll need two different verification methods on file to get back in. Roblox warns that without enough backup methods, you may be unable to regain access at all.
The backup options Roblox lists are:
- A phone number, added on the Account Info tab (13 and over).
- A passkey, added on the Account Info tab (all ages).
- Backup codes, from the Security tab (all ages).
To get backup codes, open Settings, select the Security tab, click Generate under the recovery codes section and enter your password. Roblox shows them once only, so save them straight away. Each works once, and generating new codes switches off the old ones.
Our view: for a child's account, a parent should keep the printed backup codes, not the child.
Free Robux, in-experience forms and other tricks
Roblox says the most common way players lose accounts is by sharing their login details directly or filling in online surveys. Its safety page asks players never to give out a password, browser cookies, 2-Step Verification codes, backup codes, personal details or sensitive computer information. Roblox employees will never ask for any of these.
A few specific warnings from Roblox:
- Prize and free Robux offers in exchange for account details are attempts to steal the account. Official promotions appear on the Roblox blog, your Notifications or a banner on the site. See our guide to free currency generators.
- In-experience forms: only type your login on roblox.com or the official app login screen. If an experience asks for it, leave and use Report Abuse.
- Links with spaces, odd characters or instructions to 'remove the *' are scams, even from someone you know.
- Screen sharing: don't share your screen while logging in or viewing account details.
- Browser extensions: Roblox does not make any. Be very careful with third-party ones.
Roblox also can't enforce or recover deals made outside its official systems, so trades for items or Robux elsewhere are at your own risk. Our trade and item scams guide explains the usual patterns.
Getting a hacked Roblox account back
Roblox's recovery steps start with your computer. If you downloaded something from a bad site, the account could be taken again, so run a full virus scan, restart and scan once more, and remove any browser extensions. Then reset the password to something secure and turn on 2-Step Verification under Settings > Security.
If resetting doesn't work, contact Roblox Support. To help prove you own the account, contact Roblox from either the first email address added to the account or the billing email used for the very first payment. Roblox says this helps even if a hacker changed the email, but it doesn't guarantee recovery. If the account never had an email or a card or PayPal purchase, Roblox says it can still look at other ways to verify ownership.
On lost items and Robux, Roblox is cautious: it doesn't guarantee to restore an account to its previous state or recover lost virtual items. In limited cases it may help, but only if you contact it within 30 days of the compromise. Don't wait. Our hacked? start here page can keep you on track.
Parent accounts, spending limits and notifications
Roblox's parental controls work through a parent's own Roblox account with parent privileges, linked to the child's account. Once linked, a parent can view and change controls on Roblox.com or the mobile app.
For money, Roblox offers monthly spending limits, available in most regions for children under 13. When a child reaches the limit, they see a notification and can't make more purchases that month. Roblox notes the limit doesn't apply to gift card redemptions. It won't notify you when the limit is reached, but you can opt in to spending notifications for every purchase on the child's account.
Roblox also asks that the only email verified on a child's account is the child's own or a parent's. If someone else's email is on the account, they can receive password reset emails and take it over. More in our parents' guide.
Questions
Can I use more than one 2-Step Verification method on Roblox?
Roblox says you can only choose a single 2-Step Verification method at a time, although security keys also require the authenticator app method to be on.
What do I need to recover a Roblox account that uses 2-Step Verification?
Roblox says you need two different verification methods on file if you lose your main one, such as a passkey, a phone number (13 and over) or backup codes.
Will Roblox give back stolen items or Robux?
Roblox doesn't guarantee it. In limited cases it may help, but you must contact Roblox within 30 days of the compromise.
Do Roblox spending limits cover gift cards?
No. Roblox says monthly spending limits do not affect gift card redemptions.