Most Roblox accounts are not lost to clever technical attacks. Roblox's own account safety page says the most common way players lose an account is by handing over login details directly to someone else or by filling in an online survey.[1] That is worth sitting with for a second, because it means the fixes are mostly things you can do yourself in a few minutes, and the things that protect you are not the things most players bother with.
What Roblox tells you to do
Straight from the support article, in the order it lists them:
- Add an email address. It lets you reset a forgotten password, it is required before you can turn on 2-Step Verification, and it makes support tickets easier to resolve.
- Never share your password, browser cookies, 2SV codes or backup codes. Roblox employees will never ask for any of that, and neither will a real moderator.
- Turn on 2-Step Verification. With it enabled, knowing your password is not enough to get in.
- Log out when you finish playing, especially on a shared computer at school or a friend's house.
- Use a unique password. Not the same one you use elsewhere, and not something like pass123 or a variation on your username.
- Never put someone else's email on your account. If you do, they receive the password reset mail and can lock you out.
- Learn to spot phishing. The only links allowed on Roblox are links back to roblox.com or links permitted by the Community Standards. Anything with spaces or odd characters in the address is not trustworthy, even when a friend sends it.
- Do not type your login into an in-experience form. Log in through roblox.com or the official app, nothing else. If an experience asks for your password, leave it and report the experience.
- Be careful with downloads and browser extensions. Roblox does not make browser extensions at all. Check the permissions before installing anything, and skip extensions with almost no installs or reviews.
- Never screen share while you are logging in or viewing account details.
Setting up 2-Step Verification
You need a verified email address on the account before 2SV will turn on at all. Then go to Account Settings, open the Security tab, and switch on the method you want. On the website the gear icon is in the upper right corner, and in the mobile app it is under the three dots menu.[2]
Roblox supports one 2SV method at a time:
- Email. A code goes to your verified email every time you log in with your password. If you log in with an email one-time code or a passkey instead, the 2SV challenge is skipped.
- Authenticator app. Roblox recommends this one. You enter a code from an app such as Google Authenticator, Microsoft Authenticator, Duo or Twilio Authy each time you log in with a password or an email one-time code.
- Security keys. This requires the authenticator app option to be enabled first, so you still have a way in if you lose the physical key. Supported keys include a Yubikey 5 or a Google Titan key, and device biometrics such as a fingerprint or face unlock count as well.
Backup codes and the recovery rule people miss
Backup codes live under Settings, then Security, then Generate in the recovery codes section. You see them once. Each code works once, and generating a new set deactivates all the old ones, so print them or store them somewhere you will still have access to in six months.[2]
The part that catches people out is the recovery requirement. If you have 2SV turned on and you lose access to your primary method, Roblox requires two different verification methods in your account details before it will return the account to you. Without enough backup methods, you may not get the account back at all. The accepted backup options are a phone number (13 and over), a passkey (all ages) or saved backup codes (all ages).[2]
Passkeys, and why they are worth adding
A passkey replaces the password with the thing you already use to unlock your device. Roblox describes it as public-key cryptography, where a key pair is generated that is unique to your account and specific to Roblox, and it syncs across your devices through your Apple, Google or Windows platform account or your password manager.[3]
To add one, open Settings, go to Account Info, find Login Methods, and press Add Passkey. You may be asked to confirm your identity with your password or an email code, and then you unlock your device to finish. After that you log in with Face ID, Touch ID or your screen lock. On a computer, you can also use a passkey that lives on your phone by choosing the nearby device option in the browser login form and scanning the QR code it shows.[3]
Two things to keep in mind. Roblox recommends only adding passkeys to devices you personally own, because anyone who can unlock a shared device can get into your account, and removing a passkey from Roblox does not remove it from your device settings. Also, logging in with a passkey bypasses the 2SV challenge by design, since possession of the device is the proof.[3]
If your account has already been taken
Roblox has a dedicated article for a hacked account, and the order it gives is worth following rather than improvising.[4] The short version: change the password immediately if you still have any access, check that the verified email is still yours, report the account activity to support through roblox.com/support, and use the Report Abuse feature on any user or experience that tried to get your details.[1]
One more habit from Roblox's own advice: never change your security settings because someone asked you to prove you own the account. Roblox will not ask for that, and neither will support.[5]
Frequently asked questions
Can I use more than one 2-Step Verification method?
Not at the same time. Roblox supports a single 2SV method per account, which is exactly why the recovery rules matter.[2]
Why does my 2SV email code not work?
Email codes expire after 15 minutes, and a code stops working if it has already been entered incorrectly for that account. Use Resend Code or Start Over on the login screen for a fresh one.[2]
Do I still need 2SV if I use a passkey?
You can keep both. Logging in with a passkey skips the 2SV challenge, but any other login method still triggers it, so 2SV remains your fallback.[3]
Are Roblox browser extensions real?
No. Roblox does not create browser extensions. If an extension claims to be official, that is a reason to avoid it, not to install it.[1]
What does a real Roblox email look like?
Roblox sends login and transaction notifications from an address ending in roblox.com. If the sender is not on that domain, treat the mail as suspicious and report it through support.[5]
What should I do if I see a 2SV prompt I did not start?
Deny it and change your password. The prompt means someone tried to log in with your password, and the prompt itself shows the device, location, IP address and time of the attempt.[2]
Sources
[1] Roblox Support: Keep Your Account Safe
[2] Roblox Support: Add 2-Step Verification to Your Account
[3] Roblox Support: Logging in with a Passkey
[4] Roblox Support: My account was hacked, what do I do
[5] Roblox Developer Forum: Securing your Account PSA