How to secure your Roblox account: 2-Step Verification, phishing and recovery (2026)

A Roblox account is often years of playing, collected items and Robux. Most people lose it not because of movie-style hackers, but because of one clicked link or a password given to a "friend". Below is everything that really protects your account, based on Roblox's official help pages (as of October 2026).

Start with your email and a good password

The first step is boring but the most important: add your own email address (or a parent's) to the account and verify it. Without it you cannot reset your password, you cannot turn on 2-Step Verification, and it is harder for Support to confirm that the account is yours.

Never put someone else's email in your settings. Roblox warns about it directly: the person whose address is there gets the password reset emails and can lock you out of your own account.

Your password should be unique, meaning you use it only on Roblox. Things like "pass123" or a part of your username are out. If you use the same login and password in another game or on another website, a leak there means trouble here.

2-Step Verification (2SV): the strongest protection

2-Step Verification means a password alone is not enough to log in. Even if someone learns it, they still need a one-time code. Roblox offers a few methods, but you can only have one main method turned on at a time:

• Email: every time you log in with your password, you get a code in your inbox.
• Authenticator app: an app on your phone generates the code (for example Google Authenticator or Microsoft Authenticator). This is the method Roblox recommends most.
• Security keys: a physical key, or for example a fingerprint on your device. They also require the authenticator app to be turned on, so you have a plan B if you lose the key.

How to turn on 2SV step by step

1. Log in and open Settings (in a browser it is the gear icon in the top right corner, in the app it is the three dots, then the gear).
2. Open the Security tab.
3. Turn on the switch next to the method you want and follow the instructions on the screen.

Remember: without a verified email you cannot turn this option on. You can find the details in the article Add 2-Step Verification to Your Account.

Backup codes and a plan for a lost phone

In the same Security tab you can generate backup codes. Each one works only once, and Roblox shows them only one time, so save them in a safe place (for example on a piece of paper kept at home). When you generate new ones, the old ones stop working.

This matters more than it seems. If you have 2SV and lose access to your main method, Roblox requires two different verification methods to give the account back to you. That is why it is worth having something in reserve: backup codes, a passkey or a phone number (you can add a number from age 13).

What about the account PIN?

In older guides you will read about a PIN that locked changes to settings. Roblox replaced the Parent PIN with accounts that have parent permissions: a parent links their account to their child's account and manages settings from their own device. They can also see, for example, the child's daily play time and friends list.

As an extra layer of protection for the account itself, Roblox now recommends 2SV. We describe how a parent account works in our guide to Roblox parental controls.

Phishing: how to spot a fake page or message

Phishing is a fake that pretends to be something real to get your login. Roblox gives a few simple rules:

• You enter your password only on roblox.com or in the official app. If a game shows a pop-up asking for your login, even a very "official" one, leave that game and report it with Report Abuse.
• Do not click unknown links. Addresses with spaces, asterisks and strange characters are especially suspicious, and so are instructions like "remove the space and open it". It is still a scam even when a friend sends the link (their account may have been taken over).
• Never give anyone your password, 2SV codes, backup codes or browser cookies. Roblox employees never ask for them.
• Do not share your screen while logging in or when your account details are visible. On a stream or a video call it is easy to show something by accident.
• Be careful with browser extensions. Roblox does not make any extensions. Download them only from official stores and read what permissions they want.
• Do not run .exe files from unreliable sources. Roblox advises younger players to do this only with a parent's permission, because keyloggers collect passwords.

Fake "free Robux"

This one is simple: free Robux do not exist. Roblox says clearly that there are no generators, tricks or codes for free Robux or subscriptions. Every such offer in a video, on a website or in a game has one goal: to take over your account together with its Robux and items.

Real promotions are announced by Roblox on its blog, in notifications in the Messages tab or on the banner at the top of the page. If a "promotion" arrived in a private message from a stranger, it is not a promotion. Where Robux really come from is explained in our post what Robux are and how to get them.

The same rule applies to purchases and trades: nobody honest needs your password. At DzikShop, your Roblox username is all that is needed to deliver an item. You can read more about telling an honest offer from a trap in how not to get scammed when buying Roblox items.

Delayed Actions: when someone tries to change something on your account

Roblox has a feature called Delayed Actions. When someone from a new device or a suspicious session tries to do something important (for example move Robux), the action is usually put on hold for a few hours. You get a notification by email and on your other logged-in devices.

If it was not you, click "No, it's not me" in the message. Roblox will log out the suspicious session, and you should change your password right away and check 2SV.

How to recover a Roblox account

When you simply forgot your password

On the login screen choose "Forgot Password or Username?", enter the email or phone number linked to the account and follow the instructions. If the email does not arrive, check your spam folder. A new password must be really new, not an old one and not one from another account.

If neither an email nor a phone number was added to the account, this feature will not work. Then all that is left is contacting Support and proving the account is yours.

When someone took over your account

Roblox advises doing things in this order:

1. Remove whatever might have stolen your data. Scan your computer with antivirus, restart it and scan again. Remove browser extensions.
2. Reset your password to a new one that is hard to guess.
3. Turn on 2SV, preferably with an authenticator app.
4. If the reset does not work, write to Support. Preferably from the first email address added to the account or from the address used for the first payment. This helps confirm that you are the owner, even if the thief changed the email.

Important: if you lost items or Robux, you have to contact Roblox within 30 days of the account takeover. Roblox notes that it does not guarantee getting things back. It also will not help with deals made outside the official systems, which is why it is worth knowing the rules from the post how trading works in Roblox games.

Quick checklist to finish

• A verified email (yours or a parent's) is added to the account.
• Your password is unique and nobody knows it.
• 2SV is turned on, preferably with an app.
• Backup codes are kept in a safe place.
• You log in only on roblox.com and in the official app.
• You log out on other people's and school computers.
• You report "free Robux" right away with Report Abuse.

Five minutes in the settings today can save you weeks of fighting with Support later.