The new scam-link playbook targeting kids in 2026
Fake Roblox and Fortnite “free V-Bucks” links are still the #1 way kids lose accounts. Here’s the anatomy of the scam — and how to stop it cold.
The playbook (2026 edition)
The scam targeting your kid’s Roblox or Fortnite account hasn’t really changed since 2019. It still works because every new cohort of 9-year-olds is new to it.
- Kid clicks a “free V-Bucks” or “free Robux” link (posted on TikTok, Discord, or a fake YouTube comment).
- Lands on a page that looks like Roblox / Epic Games login.
- Enters username and password.
- Scammer logs in, drains the account of Robux / V-Bucks, changes the email, sells the account.
Why it still works
Because the pages are getting better, the promises are getting more specific, and most kids don’t learn to read URLs carefully until their teens.
Kill switches for parents
- Turn on 2-step verification on the Roblox / Epic account. Makes the stolen password useless.
- Set a spending / purchase PIN so drained currency can’t be re-topped up automatically.
- Add the parent email as recovery email, not the kid’s email, so the kid can’t be tricked into approving a change.
- DNS-level block of known scam domains. NextDNS with the default family blocklist catches most.
Teach your kid this one phrase
“If it says free, it’s a lie.”
Roblox and Epic don’t give away currency. Ever. No contest. No promo code. No YouTuber is doing a “real” generator. The end.
If the account is already drained
- Reset the password immediately.
- Report to Roblox / Epic support via the account recovery flow.
- Check for linked accounts (e.g., Epic linked to Microsoft or PlayStation) that need resetting too.
- Report the scam URL to the platform where the kid found it.
- File at reportfraud.ftc.gov.