Roblox account hacked: steps to take and what Roblox says

If someone took over your Roblox account, or your child's, the first hours matter. Roblox has a help page for this, and it is direct about what it can and cannot do. This guide walks through that page, adds the FTC's general advice for hacked accounts, and covers what to check afterward.

What Roblox's own page tells you to do

Roblox's "My account was hacked" page lists steps in a specific order. The first one surprises many people, because it is about your computer, not your account.

Remove off-site downloads and browser extensions. The page says you need to get rid of any malware before recovering your account. If you downloaded something from a bad site, it could let your account be compromised again. Roblox says to run a full virus scan, restart your computer, and run the scan one more time. It also says to remove any browser extensions you installed, and to use only extensions from safe, verified websites.

Reset your password. Change it to something secure that is not easy to guess. Roblox links to its own steps for resetting a password.

Turn on 2-Step Verification. Roblox says to enable it as an added security measure, in Settings under Security. It later recommends doing it with an authenticator app, so the account stays safer even if your password or email is stolen.

The FTC's guide to hacked accounts agrees with the order. It says to update your security software, run a scan, delete anything suspicious, and restart, then follow the provider's recovery instructions.

If a password reset does not work

Hackers often change the email on the account. Roblox's page covers that case. If resetting does not work, you contact Roblox Support. To help it confirm you are the original owner, Roblox says to use one of two things:

• The first email address added to the account.
• The billing email address used for the very first payment.

Roblox says that even when the email has been changed, this original information is still valuable for verification. It also warns that it does a thorough review of account details, and that supplying this information does not mean recovery will happen. If the account never had an email or a card or PayPal purchase tied to its creation, Roblox says it can still explore other options to verify ownership.

Use the support link on Roblox's own page. Do not use links sent to you in direct messages, comments, or emails you did not ask for.

Items, Robux, and the 30-day window

This is the part many players dread. Per Roblox's page, unless required by law, Roblox is under no obligation to assist users whose accounts have been compromised. It does not promise that an account will be restored to its previous state, or that lost virtual items or currency can be recovered.

Roblox adds that only in very limited circumstances may it offer compromised account owners a way to recover lost inventory, or the approximate value of that inventory. It also says that if your account is compromised and you seek assistance, you must contact Roblox within 30 days of the compromise.

Plan around that. Do not wait to see if the problem fixes itself. Contact Support early, and treat any restoration as a possibility rather than something to count on.

Trades, deals, and scams

Roblox says it does not support and cannot enforce or recover inventory for players making deals for items or currency outside its official systems. Its advice is not to make a trade or purchase outside the system, because the other person could trick you and back out.

Roblox says to report players who try to make these deals with the Report Abuse feature. Its page also states that stealing accounts, items, or currency is a severe violation of its Terms of Use.

Many hacks of young players begin with an offer: free Robux, a "trade," or a "verification" link. If your child clicked something like that, ask them calmly what they entered and where. They are usually relieved to tell someone.

Cleaning up after you get back in

Once you can sign in, use the FTC's checklist for hacked accounts:

• Change the password to one that is hard to guess, and use one you do not use anywhere else.
• Sign out of all devices so anyone else logged in is removed.
• Turn on two-factor authentication if the account offers it.
• Check that your recovery email addresses and phone numbers are ones you control.

Roblox's page also lists Keep Your Account Safe and Verifying Your Email Address or Phone Number as related articles. They are worth a look.

If the email tied to the account is also compromised, secure that first. An attacker who controls the email can often reset passwords on other accounts too. Check for forwarding rules you did not create, as the FTC advises.

If the password came from a breach

Many takeovers start with a password exposed in a data breach somewhere else and reused on Roblox. A free scan can show whether your email appears in known breaches, with any passwords shown masked. It cannot show how your account was accessed, and an empty result does not mean your accounts are safe. Still, if it finds a reused password, change it everywhere it was used.

IdentityTheft.gov has a page on what to do after a breach, with a section on passwords and account logins. If a parent's card or PayPal was used, call the card issuer. IdentityTheft.gov also says that if you experienced a fraud, scam, or bad business practice, you can tell the FTC at ReportFraud.ftc.gov.