A Roblox player clicks a link promising free Robux, signs in, gets redirected back to the real Roblox website — and thinks everything worked.

Except the Robux never arrive. Instead, the player’s account details are already in the hands of a scammer.

That is the trick behind a growing phishing scam targeting Roblox players, many of them children, with criminals using convincing fake login pages to steal usernames, passwords and even two-factor authentication codes. The scam has been detailed by The Guardian, which found that attackers are using ready-made phishing kits to make fraudulent Roblox login pages that can look almost identical to the real thing.

The scam often starts somewhere young players already spend time online. Links promising free Robux can appear in YouTube or TikTok comments, Discord chats and other places where Roblox players gather. The pitch is deliberately simple: click the link, sign in and collect your free currency.

There is often a little pressure added, too. The offer may supposedly expire within a few hours, encouraging players to act before they stop and think about where the link actually leads.

The fake website can then ask for the player’s Roblox username and password. In some cases, scammers also request two-factor authentication codes.

And here is the particularly nasty part: after collecting the credentials, the scam site can redirect the player to the legitimate Roblox website.

So, from the child’s perspective, Roblox suddenly works exactly as expected. There is no obvious error message screaming, “Congratulations, you just handed your account to a stranger.”

According to cybersecurity company NordVPN, researchers found almost 200 addresses selling ready-made phishing pages designed to help scammers target Roblox users during a seven-day period. The stolen credentials can then be sold or used to access accounts and transfer Robux elsewhere.

Robux are not exactly meaningless digital points, either. Players use the virtual currency to purchase items such as avatar skins and animations, and Roblox sells Robux directly, with some packages costing as much as £199.99. That gives compromised accounts something immediately valuable for scammers to take.

Roblox has been warning users about this exact category of scam for years. The company says there are no legitimate free-Robux generators and warns users never to enter their password anywhere except the official Roblox login page. It also specifically warns against suspicious off-platform links and says players should never share passwords, cookies, two-step verification codes or backup codes.

The advice sounds obvious until you remember who these scams are targeting. A child who sees a video promising 10,000 free Robux is not necessarily going to inspect the URL like a cybersecurity researcher before clicking it.

That is precisely why the fake redirect is so effective. The player gets what appears to be a normal Roblox experience immediately after entering their information, while the actual theft happens quietly in the background.

Roblox says it has security measures designed to prevent phishing and account theft, including two-factor authentication and protections against suspicious logins. The company also continues to encourage users to avoid unknown links and downloads.

For parents, the simplest rule is probably the most useful one: don’t let a Roblox login begin from a random link.

Open Roblox directly through the official app or website instead. And if a supposed free-Robux offer requires a password, authentication code or anything else that looks like account credentials, that’s not a bonus waiting to be claimed. It’s the scam.

The particularly frustrating part is that recovering what was stolen may not be easy. Roblox says it does not guarantee that a compromised account will be restored to its previous state or that lost virtual currency and items can be recovered. In very limited circumstances, the company may recover lost items or their value.

In other words, that “free Robux” button can end up being a remarkably expensive click.