A common scenario reported by parents involves a child being promised extra Robux — the virtual currency used in Roblox — after clicking a link on social media or a video-sharing site. The player is taken to a page that appears to be the legitimate Roblox login, signs in as usual and later discovers the promised currency never arrived and their balance has been depleted.
Security researchers and guardians describe the tactic as a phishing-style scam in which attackers create imitation login pages to capture account credentials. Once scammers obtain usernames and passwords they can access accounts, withdraw or transfer Robux and may also collect other personal data stored in the account or linked services.
Children are particularly vulnerable because they are more likely to follow enticing offers and may not recognise subtle differences in web addresses or page design. Parents who investigate after an incident frequently find that the initial lure came from an apparently trustworthy source such as a YouTube video or a social post that contained a link to the fraudulent site.
The incidents highlight broader challenges for platforms and families: digital goods have real value, and criminals are adapting traditional cybercrime techniques to target younger users. Guardians are advised to treat unsolicited offers of free currency with caution, verify the URL of any login page before entering credentials, and supervise children’s use of links shared in videos and chats.
As these schemes continue to circulate, awareness and basic account security practices — including strong, unique passwords and enabling any available account protections — are likely to reduce the risk of loss. Keeping lines of communication open with children about online offers can also help families spot and prevent these scams early.