Roblox Delayed Actions Explained (October 2026): the 6-Hour Payout Wait, Group Ownership Holds, and How to Bypass It

Fri Oct 23, 2026 10:42 am

Quick Summary

Delayed Actions is Roblox's mandatory waiting period on the most sensitive account and group changes, including group payouts and group or experience ownership transfers.[1][2]
The default hold is 6 hours. During that window the action is rejected, and Roblox sends a security notification to your registered email and to other active devices.[1][2]
The delay is not a punishment for anything you did. It triggers when a sensitive action comes from an unfamiliar device or location, or when the session looks like it belongs to malware or a phishing extension.[2]
You can usually bypass it by clearing the security challenge with a trusted passkey or a hardware security key, or by acting from a device and connection you use all the time.[1][2]
A very large group payout can have the bypass removed entirely, which means waiting out the timer is the only option in that case.[2]

What Delayed Actions is
Roblox introduced Delayed Actions in late April 2026 as a way to stop an attacker who has briefly gained access to a creator account from moving Robux, a group, or an experience out the door before the real owner notices.[1]

The mechanism is simple. When you attempt a highly sensitive action, Roblox first asks you to complete a security challenge. If you clear that challenge with a standard method such as an email code or an authenticator app code, the action is blocked for 6 hours, after which you can try again.[1]

The delay is not a ban and it is not an error. It is a window. Roblox sends security notifications to the registered email address so the account owner gets alerted, and if you did not start the action you can click "No, it's not me" to log the suspicious session out immediately.[1]

All users are automatically protected. There is no toggle to switch it off and no eligibility requirement to be covered by it.[1]

Which actions get the delay
For the initial launch, Roblox applied delays to three things: group payouts, group ownership changes, and experience ownership changes. Roblox said at the time that those three would roll out over the following one to two months.[1]

The support article describes the scope more broadly. Roblox applies the delay to actions that involve significant account changes, the movement of assets such as Robux or game ownership, or irreversible damage to an account, and it names a request to be forgotten as an example of the last category.[2]

Roblox also says it may expand Delayed Actions to cover more sensitive account settings and financial transactions in the future, which means the list above is the floor rather than the ceiling.[2]

Two details are worth flagging. The default delay is 6 hours but it can vary with the risk level of the action, so a single account can see different timers.[1] And the delay is not limited to creators. The same protection applies to a player moving Robux between accounts or changing ownership of something they own.[2]

Why your action got flagged
Roblox's security systems look at various signals to decide whether the person performing an action is really you. The support article names three that commonly trigger a delay:[2]

You are attempting the action from a new device or location.
The system detects activity that appears to originate from malware or a malicious extension.
The system detects activity that is inconsistent with your usual patterns.

The first one explains most of the confusion. A creator who pays out from a laptop they have used for years will sail through. The same creator paying out from a fresh install on a new PC, or from a hotel connection, can land in a 6-hour hold even though nothing is wrong.[2]

The third one matters for people who manage several accounts. If you move between a personal account and a group owner account from the same machine, that pattern is normal to you, but a burst of unusual activity can still trip the check.[2]

Roblox does not publish the exact thresholds behind these signals, so a delay can land on a legitimate action without an obvious reason. That is the part that frustrates people, and it is documented behaviour rather than a bug in your setup.[2]

How the bypass works
Roblox does not make you sit through the wait if you can prove who you are with a method that resists phishing. Two things typically bypass the delay:[1][2]

A trusted passkey or a hardware security key, such as a YubiKey, that has been added to and used on your account for a while.
A trusted session, meaning you perform the action from a device and internet connection you use frequently.

The reason an authenticator app code does not work is spelled out in the announcement. Authenticator apps are secure, but they are still vulnerable to advanced phishing, so a passkey or a hardware security key is required to skip the wait.[1]

Passing the delay does not automatically make your session trusted. Roblox considers a variety of actions before enabling trust on a session, and the staff answer to that question was explicit that bypassing once does not whitelist you.[1]

There is one case where the bypass is switched off. When a very large group payout is requested, Roblox may disallow any bypass, so the timer has to run.[2]

What to do when a delay hits
If the action was yours, you wait. Once the timer expires you return to the page and complete the action, and Roblox recommends setting up a passkey so you do not have to wait next time.[2]

If the action was not yours, the delay is your window to take the account back:[2]

Open the email or the in-app notification about the delayed action.
Click the "No, it's not me" link. This logs the suspicious session out.
Change your password.
Check that your 2-Step Verification settings are up to date.

You can also see any active delays in Session Management. The announcement points to the Security tab on your Settings page, where the "Devices where you're logged in" section shows your login sessions.[1]

If you lose access to your passkey, the recovery path is a multi-step process that requires you to prove ownership, and if you cannot complete it you may be blocked from the account. That is why Roblox requires a verified email plus either a verified phone number or backup codes before it lets you switch on the highest security tier.[3]

The numbers that matter [b]Item[/b] | [b]What Roblox says[/b] | [b]What it means for you[/b] Default delay | 6 hours | Plan around a hold on payout day Delay length | Can vary by risk level | One account can see different timers Initial scope | Group payouts, group ownership, experience ownership | The three big transfers are all covered Who is covered | All users automatically | No opt-in and no opt-out Authenticator app code | Does not bypass the delay | Use a passkey or a hardware key Trusted device | Usually bypasses the delay | Pay out from your usual setup Large group payout | Bypass may be disallowed | The timer is your only option Enhanced Protection | Requires a passkey to turn on | Email codes and authenticator codes stop working for 2SV

Enhanced Protection is the reason some people lose email one-time codes. It is an advanced version of 2-Step Verification that mandates phishing-resistant methods such as device-bound passkeys or hardware security keys for both sign-in and 2SV challenges, and it disables traditional email OTP and authenticator app codes for those challenges.[3]

The requirements to switch it on are strict: at least one passkey, a verified email, and a secondary layer for identity verification in the form of either a verified phone number or backup codes.[3]

If you are on a device that has no passkey support, such as an Xbox, Roblox points to Quick Login instead. That feature lets you log into a new device from one you are already logged into, using a one-time code that is only valid for 5 minutes, and it requires your devices to be near each other. It is also unavailable on Xbox.[5]

FAQ
How long is a Roblox Delayed Action?
The default is 6 hours, but Roblox says the length can vary based on the risk level of the action, so a single account can see different timers for different actions.[1][2]

Can I skip the wait with my authenticator app?
No. Authenticator app codes are secure but still vulnerable to advanced phishing, so Roblox requires a trusted passkey or a hardware security key to bypass the delay.[1]

Does Delayed Actions apply to regular players or only creators?
It applies to all users automatically. The support article describes the affected actions as significant account changes, movement of assets such as Robux or game ownership, and irreversible damage such as a request to be forgotten.[2]

Why did my payout get held when I was using my own computer?
Roblox flags an action when it comes from a new device or location, when the session looks like it came from malware or a malicious extension, or when the activity is inconsistent with your usual patterns. Roblox does not publish the exact thresholds, so a delay on your own machine can happen without an obvious reason.[2]

Will splitting a payout into smaller amounts avoid the delay?
Roblox staff said the system tracks cumulative amounts and is considering more than just the raw payout figure, so smaller amounts are not a reliable way around it.[1]

What happens if I lose my passkey?
You go through a multi-step recovery process to prove ownership. If you cannot complete it, you may be blocked from the account, which is why a verified email plus a phone number or backup codes is required before you enable the highest security tier.[3]

Sources