My Kid's Roblox Account Was Hacked: What Parents Should Do Next

If your child's Roblox account was hacked, start with the email address linked to it, because whoever controls that inbox can reset the password. Next, recover the account through Roblox's official support, check purchases and payment methods, and turn on two-step verification, which adds an extra check when someone signs in. Most stolen kids' accounts start with a scam like a free Robux offer, and many can be recovered.

Take a breath. If you just typed "my kid's Roblox account was hacked" into a search bar, you are not alone. It is rarely anyone's fault but the scammer's.

How do I know if my kid's Roblox account was hacked?

Sometimes it is obvious. Other times your child just says the game "isn't working." Watch for:

• A password that suddenly stops working.
• Emails from Roblox about password, email, or security changes nobody at home made.
• Missing Robux or items, or purchases you don't recognize.
• Friends asking about strange messages or trade requests from your child's account.

If any of these fit, act now, even if you're not sure.

How kids' game accounts usually get stolen

Kids' accounts are rarely "hacked" in the movie sense, though your child may call it getting "beamed." Usually someone tricked the child, guessed the password, or tried one that leaked from another site.

• Scams that ask for the login. Your child types their password into a fake page or gives it to someone in chat.
• Reused or weak passwords. Pet names and birthdays are easy to guess. If a password leaked in a data breach, which is when a company's customer data gets stolen, criminals try it on games too. Have I Been Pwned shows whether an email address was in a known breach.
• Fake cheats and add-ons. Downloads and browser extensions that promise free Robux, cheats, or script "executors" can hide malware, which is harmful software that steals saved logins.
• Someone they know. A friend or classmate who knew the password, sometimes after a falling-out.

The free Robux scam and other fake login pages

The most common trap is the free Robux scam. It shows up as videos, chat messages, and websites promising free Robux, rare items, or a "generator."

Every version is phishing, meaning a trick to get your child to hand over their login. A page that looks like Roblox asks them to sign in to "claim" the prize, and the scammer takes the account. Some also ask for the code Roblox just sent, which lets the scammer get past two-step verification.

Watch for these variations too:

• Fake "moderator" messages warning that the account will be banned unless your child verifies it.
• Trade offers or "item checks" that lead to a lookalike website.
• Giveaway links sent from a friend's account that was already stolen.

Roblox staff will never ask for your child's password. Our guide to verification code scams explains why sign-in codes need the same protection.

Step 1: secure the email address on the account

Secure the email before you do anything else. If a thief can still read that inbox, they can reset the Roblox password again as soon as you change it.

1. Find out which email is on the Roblox account. It might be your child's, yours, or an old one.
2. On a device you trust, change that email's password to one you have never used anywhere else.
3. Remove any recovery phone number, backup email, or forwarding rule you don't recognize.
4. In the email's security settings, sign out of all other devices.
5. Turn on two-step verification so a code on your phone is needed on top of the password.

If the email itself was taken over, follow our step-by-step plan for a hacked email account first.

Step 2: recover the account through official Roblox support

Go to roblox.com or open the official Roblox app yourself. Don't use a link from a message or a search ad, because scammers run fake "support" pages.

1. Try "forgot password" first, using the email you just secured. If the reset works, you may not need to contact anyone.
2. If the thief changed the email or password, use Roblox's official support form and explain that the account was hacked.
3. Share the username, the original email, and proof the account is yours, such as purchase receipts or Roblox emails about the changes. If you can, add the user ID. That's the number in the profile's web address, and it never changes.
4. Be patient, and follow the current instructions on the official page.

Never pay anyone who offers to "recover" the account. Never give a password or code to anyone claiming to be Roblox staff.

Once you're back in:

• Change the password to a new, unique one.
• In the security settings, sign out of all other sessions. This kicks out anyone who is still signed in.
• Check that the email, phone number, and parental controls are what you expect.
• If your child downloaded cheats or "free Robux" tools, scan that device for malware and remove browser extensions you don't recognize.
• If the thief messaged friends, let them or their parents know it wasn't your child.

Step 3: check payment methods and purchases

Next, check what the thief may have touched. Many parents skip this step.

• Purchase and trade history. Look for Robux spent, items traded away, or gifts sent to other players, and tell support about them. Don't promise your child everything will come back.
• Saved payment methods. Remove any saved card, and check whether gift card balance was spent.
• Bank, card, and app store statements. Your bank or card company can often dispute charges you don't recognize. If Robux were bought through the App Store, Google Play, or a console store, ask that store about a refund.

From now on, keep cards off your child's account. A gift card, a Roblox spending limit, or purchase approvals like Apple's Ask to Buy or Google Family Link will limit the damage if it happens again.

Turning on two-step verification for game accounts

Two-step verification, also called two-factor authentication or 2FA, asks for a second proof, like a code, when someone signs in on a new device. A scammer who has only the password usually can't get in.

Roblox offers it, and so do most big game and console accounts, including Xbox, PlayStation, Nintendo, Epic Games, and Steam. You'll find it in each account's security settings.

Which method to pick:

• An authenticator app on a parent's phone is a strong choice for younger kids. The app shows a new code every 30 seconds, and since it's on your phone, your child needs you whenever they sign in on a new device.
• Email codes are better than nothing, but they're only as safe as the email account. That's why Step 1 matters.
• Text message codes work, but an app is generally safer. Our comparison of authenticator apps and SMS codes explains why.
• Passkeys, where offered, are even stronger. They replace the password with Face ID, a fingerprint, or a screen lock, so there is nothing to type into a fake page.

Keep any backup codes somewhere safe, like a password manager. A text message or a screenshot is easy for your child to lose.

Pinzen is a family password manager that keeps passwords and secure notes in an encrypted vault. You can start a free Pinzen vault with up to 1,000 items on one trusted device at a time. Syncing across devices takes Pinzen+.

How to protect your kid's other gaming accounts

One hack is a good reason to check the rest. For parents, Roblox account security comes down to a few habits that protect every other game too. The steps above also work when any child's gaming account is hacked, from Fortnite and Minecraft to consoles.

• Give every account its own password. A few random words strung together are easy for kids to remember and hard to guess. Our guide to easy passwords for kids has ideas by age.
• Replace reused passwords. If the old Roblox password was used anywhere else, change it there too. Start with email, consoles, and anything with saved payment details.
• Let a tool spot the weak ones. Pinzen's free password health check flags weak, reused, and exposed passwords. It checks for exposed passwords through Have I Been Pwned without sending your passwords.
• Set up parental controls. Roblox lets you limit chat, spending, and who can contact your child. Parents can also link their own account to manage those settings remotely.

Talking to your child without blame

How you react now decides whether your child tells you next time. Kids who feel safe come to you quickly, and the faster they tell you, the less damage a scammer can do.

• Start with: "I'm not upset. Adults fall for these scams too. Let's fix this together."
• Ask what they clicked, typed, or downloaded, and listen before you explain.
• Teach one rule: no real offer ever needs your password or a code. Not for free Robux, a trade, or a "moderator."
• Agree that if anyone asks for a password or code, they come to you first.
• If you add new rules, present them as safety steps, not punishment for being tricked.

For an age-by-age approach, see how to teach kids about passwords.

Frequently asked questions

How do I get my child's hacked Roblox account back?

Secure the linked email first, then try Roblox's password reset. If the thief changed the email or password, use Roblox's official support form and include the username, user ID, original email, and purchase receipts. Never pay anyone who promises to recover it for you.

How did my kid's Roblox account get hacked?

Most often, your child entered their login on a fake page or gave it to someone promising free Robux or a trade. Other common causes are a reused or easy-to-guess password, a fake cheat download that stole saved logins, or a taken-over email. Knowing which one happened tells you what else to fix.

Should my child's game account use my email address?

For younger children, a parent's email is often the better choice, because security alerts and password resets come to you. Whichever email you use, protect it with a unique password and two-step verification, since it can reset the game account. As your child gets older, you can move the account to their own email together.

How do I protect my kid's gaming accounts from hackers?

Give every account its own strong password, turn on two-step verification, and keep the linked email secure. Add parental controls, keep saved cards off the account, and teach your child that no real offer needs their password or a code. A password manager such as Pinzen can keep the logins and backup codes in one place.