It begins with a comment beneath a YouTube video — a promise of free Robux, Roblox's in-game currency, if a player simply clicks a link. For a ten-year-old who has spent weeks accumulating virtual coins to buy a new avatar skin, the offer is almost irresistible. What follows, however, is a meticulously engineered theft. The child lands on a page that appears, in every visual detail, to be the official Roblox sign-in screen.

The address bar even contains the word "Roblox" — in variants such as "Roblox-verify" or "login-Roblox" — lending the site a surface legitimacy that most adults would struggle to question, let alone a child. The mechanics behind these attacks are neither improvised nor technically demanding. Researchers at cybersecurity firm NordVPN identified nearly 200 web addresses, found within a single seven-day monitoring period, that were actively selling ready-made phishing kits specifically designed to impersonate Roblox. These kits, which are purchased on the dark web, allow criminals with limited coding knowledge to deploy convincing fake login pages at scale.

Once a child enters their username, password, and even a two-factor authentication code, the fraudulent site quietly forwards the stolen credentials before redirecting the victim seamlessly to the real Roblox platform — leaving no obvious sign that anything has gone wrong. The financial stakes are not trivial. Robux can be purchased legitimately through Roblox's official store in packages priced as high as £199.99, meaning that a compromised account can represent a meaningful real-world loss for families.

The scam links spread primarily through YouTube comments, TikTok videos, and Discord chats — platforms where young players congregate — and are frequently dressed in artificial urgency, with offers framed as expiring within hours to suppress critical thinking.