‘Mum, where did my Robux go?’ The Roblox scam targeting children

Your 10-year-old son has started playing Roblox , when he realises all of his in-game currency, Robux, is gone.

When you try to find out what happened, he says he was recently promised extra Robux if he followed a link on YouTube. When he signed on at the site link, he was taken to the Roblox site as usual but there was no sign of the extra currency.

He has fallen victim to a fraud where Roblox users – many of whom are children – are being targeted for their login details. With those details criminals can steal the virtual currency and players’ personal data.

Within Roblox, players use Robux to buy virtual items, such as skins or animations for their avatar. You can earn the currency within the game, but it can also be bought. At Roblox’s online store you can buy packages costing up to £199.99 .

Using ready-made kits bought on the dark web, fraudsters create a fake login page that is identical in appearance to the legitimate Roblox site.

“The kid will enter their details and the fake website will actually redirect them to a legitimate Roblox page,” says Gerald Kasulis, the vice-president of global affairs at the cybersecurity company NordVPN. “So ultimately, the kid will get to where they want to go.”

By that stage, however, the criminals will have the details they need for defrauding.

Researchers from NordVPN say that over a seven-day period they found almost 200 addresses selling ready-made phishing pages that provided the tools to defraud Roblox users.

Often the links to the phishing sites are in comments on YouTube or TikTok videos or in chats on Discord, the chat app for gamers.

The message might say there are free Robux available if a player clicks on the link provided. Like many scams, there will often be an element of urgency attached, such as the offer apparently only being valid for a few hours, to encourage the victim to act without fully thinking through the consequences.

From that link, the child will be taken to a fake sign-in page that will probably be identical to a legitimate Roblox site in appearance. The address will usually contain the name Roblox, for example “Roblox-verify” or “login-Roblox”.

When they are on the scam site, the child will be asked for their username and password but may also be told to put in two-factor identification codes, says NordVPN. But then the child is taken to the legitimate Roblox site so they can play their games as normal, leaving little indication that anything is amiss.

Once they have the login details, the fraudster may sell them on or use them to transfer Robux to another account.

Talk to children about scams.

“One of the simplest habits is to encourage children to open Roblox directly through the official app or website rather than logging in through links they are sent,” says Marijus Briedis, chief technology officer at NordVPN.

“Two-factor authentication remains an important protection, but authentication codes and backup codes should be treated just like passwords and never handed over to somebody else.”

If your player has lost their Robux to a hacker, it seems unlikely that they will get it back. Roblox says that it is under “no obligation” to assist people whose accounts have been compromised, unless it is required to do so by law.

“Roblox does not guarantee that an individual’s account will be restored to its previous state, or that Roblox will be able to recover lost virtual items or virtual currency,” it says.

In “very limited circumstances”, Roblox says it may recover lost items or the value of them.

A spokesperson for Roblox says there are security measures in place to prevent phishing, such as two-factor authentication and a feature that stops criminals logging into your account from elsewhere.

“We continue to work on new ways to minimise the risk of account theft and actively encourage Roblox users to follow security best practices, including not clicking on links or downloading anything from unknown senders or websites,” the spokesperson adds.

Copyright for this text belongs to The Guardian.