Copy article

Parents are being warned about scams targeting Roblox players

ended 01. October 2026

Parents are being warned about scams targeting Roblox players after cybersecurity researchers found almost 200 different phishing addresses active in the space of a week.

Researchers from NordVPN’s Threat Intelligence team found that criminals targeting Roblox users no longer need to create their own fraudulent websites or have previous knowledge of phishing scams.

Instead, ready-made services available for sale on the dark web are providing bad actors with convincing fake Roblox pages, hosting, web addresses, and tools that collect stolen login information and mask the true link that users are taken to.

NordVPN identified 196 different Roblox phishing addresses active during a seven-day period in the past month.

Researchers also examined a particular pattern in which criminals disguise fake websites using addresses containing the words “roblox.com”, even though the website is not owned by Roblox.

  • What advice do you have for parents?
  • How dangerous are these scams?
  • What can be done to avoid these scams?

Responses by tomorrow.

3 responses from the Newspage community

Copy all

Copy

Pro
Tony RedondoVerified
Founder at Cosmos Currency Exchange
iContact details are shown to logged-in members. Log in
Cybercriminals are using dark web Phishing-as-a-Service kits to churn out fake Roblox sites at scale using URLs like "roblox.com-login" that look close enough to fool a child. The aim: steal Robux, harvest linked card details or install malware. The result is direct financial loss and full account takeover. For parents who feel less tech-savvy than their kids, that's a genuine worry. Jargon overwhelms, the scams are slick, and children insist they know what they're doing. So, keep it simple. Cut bank cards out of the picture entirely and use physical gift cards. Set a 4-digit Account PIN in Roblox settings to lock the security controls. Build a no-blame home policy so mistakes get reported immediately. And one rule, no exceptions. Never click external links or enter passwords outside the app.
Copy

Pro
Mike SweeneyVerified
Vice President of Brand Protection at Corsearch
iContact details are shown to logged-in members. Log in
Mike Sweeney, VP of Brand Protection at Corsearch:

"What's striking about NordVPN's research is that criminals no longer need technical skill to run a scam like this. Off-the-shelf phishing kits sold on the dark web give inexperienced scammers a fake login page, hosting and a way to disguise the link, all in a few clicks. Our own investigations have uncovered networks of hundreds of impersonation domains built around one brand. Platforms with young users, like Roblox, are attractive targets as children are less likely to scrutinise a web address.

"Our advice to parents is to focus on the domain itself, not just what it contains. A web address can include 'roblox' and still have nothing to do with Roblox, what matters is what comes before '.com'. Only log in via the official app or roblox.com, never a link in a message or 'free Robux' offer and tell a parent if a site unexpectedly asks for a password again. Two-factor authentication and regular checks close off most scams."
Copy

Pro
Tony SanchezVerified
Founder at Bridging Loan Directory
iContact details are shown to logged-in members. Log in
My website, Bridging Loan Directory, was compromised in August. Some visitors were shown a convincing fake “verify you are human” screen that asked them to run a command on their computer. Our technical team removed the malicious code, but the experience showed me how easily a familiar-looking security check can be turned into a trap.

That is the lesson I would share with parents: talk to children about what a page asks them to do, as well as how it looks. A familiar logo or reassuring wording does not make a request genuine. If something asks them to enter login details on an unfamiliar page, download software or run commands, encourage them to stop and show you. Make it easy for them to ask for help without worrying they will get into trouble.