The new scam-link playbook targeting kids in 2026
Fake Roblox and Fortnite “free V-Bucks” links are still how kids lose accounts. Roblox says flatly that any offer of free Robux is a scam. Here’s the anatomy of it — and how to stop it cold.
The playbook (2026 edition)
The scam targeting your kid’s Roblox or Fortnite account hasn’t really changed since 2019. It still works because every new cohort of 9-year-olds is new to it.
- Kid clicks a “free V-Bucks” or “free Robux” link (posted on TikTok, Discord, or a fake YouTube comment).
- Lands on a page that looks like Roblox / Epic Games login.
- Enters username and password.
- Scammer logs in, drains the account of Robux / V-Bucks, changes the email, sells the account.
Why scam links still work
Because the pages are getting better, the promises are getting more specific, and most kids don’t learn to read URLs carefully until their teens.
Kill switches for parents
- Turn on 2-step verification on the Roblox / Epic account. Makes the stolen password useless.
- Set a spending / purchase PIN so drained currency can’t be re-topped up automatically.
- Add the parent email as recovery email, not the kid’s email, so the kid can’t be tricked into approving a change.
- DNS-level block of known scam domains. A filtering resolver such as NextDNS with a family blocklist will catch a share of these domains. It is a useful extra layer, not a guarantee — new scam domains appear faster than any list is updated.
Teach your kid this one phrase
“If it says free, it’s a lie.”
Roblox says this itself, in its own support documentation: “Any offer of free Robux, subscriptions, or valuable items is a scam… There is no such thing as free Robux or subscription offers, tricks, or codes.” Roblox also adds the rule worth memorising: “Never enter your password anywhere other than the Roblox login page.”
V-Bucks work slightly differently and it is worth being precise, because a child who finds the exception will discard the whole rule. V-Bucks can be earned inside Fortnite — through a paid Battle Pass, or in Save the World. What has never existed is V-Bucks from outside the game: no generator, no third-party site, no YouTuber giveaway. Roblox states its version of this in writing; we could not find an equivalent published statement from Epic, so treat the V-Bucks half as our guidance rather than a quotation. Either way the rule to teach is the same: game currency only ever comes from inside the game or the official store. Never from a link.
If the account is already drained
- Reset the password immediately.
- Report to Roblox / Epic support via the account recovery flow.
- Check for linked accounts (e.g., Epic linked to Microsoft or PlayStation) that need resetting too.
- Report the scam URL to the platform where the kid found it.
- File at reportfraud.ftc.gov. This is the FTC’s own instruction for phishing: “Report the phishing attempt to the FTC at ReportFraud.ftc.gov.” The FTC also asks you to forward a phishing email to the Anti-Phishing Working Group at reportphishing@apwg.org, and a phishing text to SPAM (7726).
What was checked, and when. Roblox scam guidance and FTC reporting routes verified against the vendor’s own documentation on 2026-09-08. Not reached in that pass: Epic currency policy.
Common questions
How does the free-currency scam actually work?
Your child clicks a “free V-Bucks” or “free Robux” link from TikTok, Discord or a fake YouTube comment, lands on a page that imitates the Roblox or Epic login, and enters their username and password. The scammer then drains the currency, changes the email and sells the account.
Why does a scam from 2019 still work?
Because every new cohort of nine-year-olds meets it for the first time. The fake pages have also improved, the promises have got more specific, and most children do not learn to read URLs critically until their teens.
What actually stops it?
Four things. Two-step verification on the Roblox or Epic account, which makes a stolen password useless. A spending PIN, so drained currency cannot be topped back up. Your email as the recovery address rather than your child’s, so they cannot be tricked into approving a change. And DNS-level filtering — a resolver such as NextDNS with a family blocklist catches a share of these domains, though new ones appear faster than any list updates. Roblox’s own rule underpins all of it: “Never enter your password anywhere other than the Roblox login page.”
What is the one phrase to teach?
“If it says free, it’s a lie.” Roblox states it directly: “There is no such thing as free Robux or subscription offers, tricks, or codes.” V-Bucks are slightly different and worth being precise about, because a child who finds the exception will discard the rule: V-Bucks can be earned inside Fortnite, through a paid Battle Pass or Save the World. What never exists is game currency from outside the game — no generator, no third-party site, no YouTuber giveaway.
The account has already been drained. What now?
Reset the password immediately, then use the Roblox or Epic account-recovery flow. Check linked accounts too — an Epic account tied to Microsoft or PlayStation needs resetting as well. Report the scam URL on the platform where your child found it, and file at reportfraud.ftc.gov, which is the FTC’s own instruction for phishing. One caveat: if the person behind the link began contacting your child — asking for photos, threatening them, moving to a private app — that goes to NCMEC’s CyberTipline instead, because the FBI’s IC3 states that “crimes against children should be filed with the National Center for Missing and Exploited Children”.
When parental controls change
Scams and platform changes move quickly. Roughly monthly we send new guides, changes to controls like these, and scams worth knowing about.
Free. No ads, no affiliate links, and we never sell or share your address.