How scammers use ready-made Roblox phishing services
These services give scammers a shortcut — they can create convincing fake Roblox login pages without having to build a website themselves.
These phishing services operate much like website builders. Scammers can sign in through Discord or Telegram, generate a fake Roblox page, and share its link with potential victims. The service handles the website design, hosting, and collection of stolen credentials. Some services also help scammers disguise suspicious links, making fake websites harder for your child to recognize. They even provide backup web addresses and instructions for scammers.
One platform claimed to have processed more than 6 million stolen login records and reported over 239,000 registered users. These figures come from the service's own claims, but researchers also saw its displayed user count rise by 547 in just over 42 hours.
NordVPN researchers also discovered a separate provider supplying infrastructure to these phishing services. This provider helps conceal where fraudulent websites are hosted, making them harder to shut down. Two scam sites even displayed a “Subscription expired” message from the provider, indicating that their operators had been using a paid service.
How fake Roblox pages trick children
Roblox phishing scams often begin with a seemingly harmless invitation. Your child might receive a link promising a new game, an exclusive item, or another player's profile through Discord, Roblox chat, YouTube, or TikTok. But the link could lead to a fake Roblox website designed to steal their login details.
NordVPN's threat intelligence team discovered fake Roblox websites that copy real player profiles and game pages. Some imitate the pages for popular games like "Grow a Garden," "Blox Fruits," and "Steal a Brainrot," including their descriptions and play counts. These aren't copies of the games themselves but fake web pages designed to trick children into entering their login details.
The web addresses can be just as deceptive. For example, roblox.com.ug might look like the official Roblox address at first glance, but it's a completely different domain. Some phishing pages also use HTTPS, which encrypts the connection but doesn't guarantee that the website is legitimate.
Scammers also impersonate trusted verification tools. Researchers identified fake pages mimicking RoVer, a tool that helps players connect their Roblox and Discord accounts. If your child encounters names and tools they recognize, they may trust a fake request to verify their account.
If your child enters their login details on one of these pages, the scammer receives that information. Some fraudulent pages then redirect victims to the genuine Roblox website, making the theft harder to notice. Criminals can use the stolen accounts to access Robux, transfer valuable items, or target other players through compromised accounts.
Why two-factor authentication isn’t always enough
Two-factor authentication (2FA) adds another security check, such as a one-time code, when your child signs in. However, some phishing websites can trick them into sharing that code with scammers. NordVPN researchers analyzed fraudulent login pages that collect more than just usernames and passwords.
After your child enters their login details, a fake page may ask for a six-digit verification code or a backup code. Scammers can then use those details to access your child’s Roblox account.
Scammers can also hide malware in unofficial Roblox tools, such as game enhancers. This malware may steal login session data, allowing scammers to access your child’s account without a password or verification code.
Although 2FA remains an important security measure, the techniques described above show why it cannot prevent every account takeover. Explain to your child that they should only enter verification or backup codes when signing in directly through the official Roblox website or app. They should never share these codes with other players or enter them through links someone sends them.
How to protect your child from Roblox scams
Protecting your child’s Roblox account starts with understanding where these scams happen. Suspicious links can appear in Roblox chat, Discord servers, YouTube comments, or messages on other platforms. Talking to your child about these risks can help them recognize scams before giving away their account details.
You can reduce the risk of account theft by helping your child follow these precautions:
- Use the official Roblox website or app. Encourage your child to open Roblox directly instead of following login links, even if they come from friends.
- Be careful with free Robux offers. Websites promising free Robux, rare items, or exclusive rewards may be trying to steal account details.
- Never share passwords or verification codes. Explain that legitimate Roblox staff will never ask for passwords or security codes through messages or inside games.
- Avoid unofficial Roblox tools. Game enhancers, cheats, and other downloads from unfamiliar websites may contain malware that steals account information.
- Enable two-factor authentication. It adds another layer of security, even though it cannot stop every scam.
You can also use NordVPN’s Link Checker to identify potentially malicious links before opening them. NordVPN’s next-gen antivirus can help block malicious websites and scan downloads for malware.
Most importantly, encourage your child to tell you when something suspicious happens, even if they’ve already clicked a link or shared information. If your child has shared their login details, help them change their password immediately to reduce the risk of account theft.
Methodology
NordVPN’s threat intelligence team investigated Roblox phishing scams by analyzing suspicious websites, their web addresses, and the services used to create them. Researchers tested nearly 4,000 web address combinations and monitored Roblox-related phishing activity, identifying 196 active phishing addresses during the seven days ending July 29, 2026.
To verify the findings, the team manually reviewed a sample of 24 suspicious websites and confirmed 22 as fake Roblox pages. Researchers also examined how these websites collected login details and security codes.
The investigation included reviewing phishing services, tracking changes in their displayed user counts, and examining the hosting infrastructure used to keep scam websites running.
Online security starts with a click.
Stay safe with the world’s leading VPN
