The Roblox scam that steals Robux and leaves no trace behind

According to Guardian News and Media, a fraud targeting Roblox players, many of them children, works by stealing login details rather than currency directly, and the child rarely notices anything wrong until the Robux is already gone.

The scam runs on a simple trick. A child sees a message on YouTube, TikTok or Discord promising free Robux if they click a link. The link leads to a fake sign-in page built to look identical to the real Roblox site. The address usually contains the word Roblox, something like "Roblox-verify" or "login-Roblox". The child types in a username, a password, sometimes a two-factor code. Then the fake page redirects them to the real Roblox site, where everything looks normal. By the time anything is missing, the fraudster already has what they need.

Why the redirect matters

The redirect is the part of the scam that does the real work. It is not there to trick the child into believing the free Robux was real. It is there to remove the moment where a victim would normally get suspicious. A fake page that dead-ends, or throws an error, invites a second look. A fake page that quietly hands the child back to a working, familiar Roblox session does not. The theft happens invisibly, in the gap between the click and the redirect, and the child walks away thinking nothing happened at all.

Once the fraudster has the login details, they can sell them on or use them to move the Robux to another account. Robux is not pocket change built entirely inside the game. Roblox's own store sells packages of the currency for up to £199.99, so what looks like a game currency scam is really a theft of something with a direct cash value attached to it.

NordVPN researchers looked at a seven-day period and found almost 200 addresses selling ready-made phishing kits built specifically to defraud Roblox users. That number says something about scale. This is not a handful of opportunists building fake pages by hand. It is a supply chain, with kits bought and sold on the dark web, aimed at a platform whose users are disproportionately children.

Gerald Kasulis of NordVPN describes the redirect mechanic directly: the child ends up where they wanted to go, so there is little reason to suspect anything went wrong. Marijus Briedis, also of NordVPN, points to one habit that interrupts the whole chain: get children into the habit of opening Roblox only through the official app or website, never through a link someone else sent them. That single habit removes the fake page from the equation entirely, because there is no click for the scam to hijack.

Patterns like this, the same fake page structure, the same urgency language, the same redirect trick, showing up across hundreds of sites at once, are exactly what automated scam-detection is built to catch before a child ever clicks.