Roblox Account Hacked: The Recovery Steps That Actually Work
If someone else is in your child's Roblox account, the order you do things in decides whether you get it back. Recovery steps, what Roblox will and won't restore, and how it happened.
The short answer
Recover a hacked Roblox account in this order: change the password from a device you are still signed in on, then use Settings to sign out of all other sessions, then enable two-step verification, then check for a changed email address, then contact Roblox Support with your account details and purchase history. Roblox can usually restore account access but rarely restores stolen Robux or traded items, which is why speed matters more than anything else.
Verified and last updated August 12, 2026.
- Time needed
- 20 min
- Difficulty
- Beginner
- Read time
- 5 min
If you are reading this because someone else is in the account right now, skip the explanation and go to step one. The first fifteen minutes matter more than everything that follows, because an intruder in a Roblox account is usually there to liquidate it — trade the limiteds away, spend the Robux — and once those transactions complete, they are effectively permanent.
Explanation of how it happened is at the bottom. Recovery is at the top, where it should be.
Do this first if you can still sign in
If you still have a signed-in session anywhere — the phone, a tablet, the console, the PC client — use it now. A live session lets you change the password without needing email access, which is the fastest route available and the one that closes if the attacker changes the email.
Step 1: Change the password right now
From any device where the account is still signed in: Settings → Account Info → Password → Change Password.
Use something new and unrelated to anything else. If the child has used the same password on other sites — and most have — those need changing too, but later. Right now, just this one.
If you cannot sign in anywhere, use the password reset link on the login page. That sends a reset to the registered email, which works if the attacker has not changed it. If it has been changed, go to step 5.
Step 2: Sign out every other session
This is the step people skip and it is the reason recoveries fail.
Changing a password does not automatically kick out an existing session on Roblox. The attacker's client stays authenticated. You have to explicitly evict them.
Settings → Security → Log Out of All Other Sessions.
Do this immediately after the password change, in the same sitting. A password change without this is a lock changed while the intruder is still inside the house.
Step 3: Turn on two-step verification
Settings → Security → Two-Step Verification.
Two options: authenticator app or email. Choose the authenticator app if the child has a phone that can run one. Email 2SV is better than nothing, but it fails in the common scenario where the email account shares a password with the Roblox account.
This is the step that stops it happening again. Phishing gets the password; 2SV means the password on its own is worthless.
Step 4: Check the email and phone on the account
While you are in Settings, verify that the registered email address and phone number are still yours.
Attackers change these deliberately, because it converts a temporary compromise into permanent ownership — every recovery route runs through the email. If it has been changed and you have not yet lost access, change it back now.
Also check:
- Linked social accounts — remove anything you did not add.
- Recent trades in Trading History.
- Recent Robux transactions in Transactions.
- Group memberships and roles — accounts are sometimes used to gain access to a group's funds.
Screenshot anything unusual. You will want it for the support ticket.
Step 5: Contact Support with the right evidence
If you have lost access entirely, this is the route, and how you write it changes the outcome.
Roblox Support needs to establish that you are the owner. Give them, in one message:
- The exact username (and any previous usernames)
- The original email address on the account
- The approximate creation date
- Robux purchase receipts with order numbers — from card statements, PayPal, or the Apple/Google Play purchase history
- The date you lost access and what you noticed
Purchase receipts are by far the strongest evidence, because they link the account to a real payment record that an attacker cannot fabricate. If the account has ever bought Robux or Premium, find those receipts before submitting.
What to expect on timing
Support responses typically take a few days rather than hours, and the first reply is often a templated request for more information. Answer it fully and quickly. Submitting multiple tickets does not speed things up and can reset your place in the queue.
How it happened, so it does not happen again
Almost none of these are technical compromises. In practice it is one of four things:
The conversation worth having with a child afterwards is a short one: Roblox will never ask for your password anywhere except the Roblox login page, and nobody can give you free Robux. Those two sentences prevent nearly all of this.
What works
What doesn't
Key takeaways
If the account belongs to a child, it is worth pairing this with the parental controls guide — several of the settings there reduce the exposure that leads to this in the first place.
Frequently asked questions
Will Roblox refund stolen Robux or return traded items?
Usually not, and it is better to know that upfront. Roblox's position is that trades and purchases made from an authenticated session are final, including when that session was an intruder's. They do sometimes make exceptions for large-scale incidents or clear cases of a compromised account reported very quickly, but you should plan on recovering access rather than assets. This is exactly why the first hour matters so much.
How do these accounts get compromised in the first place?
Almost never by 'hacking' in any technical sense. The overwhelming majority are phishing: a site promising free Robux, a Discord bot asking you to log in to claim an item, or a fake trading site that shows a real-looking Roblox login page. The child types their password into a page that is not Roblox. Second most common is password reuse — the same password used on a smaller site that got breached.
My child's email was changed. Can we still recover it?
Yes, but it needs Roblox Support rather than self-service. Submit a support request from the original email address if you still control it, and include everything that proves ownership: the account creation date, previous usernames, Robux purchase receipts with order numbers, and any linked payment method. Purchase receipts are the strongest evidence because they tie the account to a real payment record.
Is two-step verification worth the hassle for a child's account?
It is the single highest-value thing on this page. Nearly every compromise route stops at 2SV, because a phished password on its own becomes useless. Use the authenticator app option rather than email if the child has a phone — email 2SV fails if the email account is compromised too, which happens when passwords are shared between them.
Should we just delete the account and start over?
Only as a last resort. An established Roblox account carries purchase history, group memberships, friends and any limited items, none of which transfer. Try the recovery route fully — including a support ticket with purchase evidence — before starting again. If the account had significant Robux spending, that receipt history is genuinely strong leverage in a support request.
About the author
Roblox & Live-Service Editor
Priya started scripting in Roblox Studio at fourteen and has since published three experiences, the largest of which passed 1.2 million visits. That background is why our Roblox coverage explains why a code fails rather than just telling you to try again later.
Found something wrong? Games patch and fixes go stale. If a step here no longer works, tell us at hello@spyld.com and we will retest it. Read how we test and our editorial policy.