The new scam-link playbook targeting kids in 2026
Fake Roblox and Fortnite “free V-Bucks” links are still the #1 way kids lose accounts. Here’s the anatomy of the scam — and how to stop it cold.
The playbook (2026 edition)
The scam targeting your kid’s Roblox or Fortnite account hasn’t really changed since 2019. It still works because every new cohort of 9-year-olds is new to it.
- Kid clicks a “free V-Bucks” or “free Robux” link (posted on TikTok, Discord, or a fake YouTube comment).
- Lands on a page that looks like Roblox / Epic Games login.
- Enters username and password.
- Scammer logs in, drains the account of Robux / V-Bucks, changes the email, sells the account.
Why it still works
Because the pages are getting better, the promises are getting more specific, and most kids don’t learn to read URLs carefully until their teens.
Kill switches for parents
- Turn on 2-step verification on the Roblox / Epic account. Makes the stolen password useless.
- Set a spending / purchase PIN so drained currency can’t be re-topped up automatically.
- Add the parent email as recovery email, not the kid’s email, so the kid can’t be tricked into approving a change.
- DNS-level block of known scam domains. NextDNS with the default family blocklist catches most.
Teach your kid this one phrase
“If it says free, it’s a lie.”
Roblox and Epic don’t give away currency. Ever. No contest. No promo code. No YouTuber is doing a “real” generator. The end.
If the account is already drained
- Reset the password immediately.
- Report to Roblox / Epic support via the account recovery flow.
- Check for linked accounts (e.g., Epic linked to Microsoft or PlayStation) that need resetting too.
- Report the scam URL to the platform where the kid found it.
- File at reportfraud.ftc.gov.
Common questions
How does the free-currency scam actually work?
Your child clicks a “free V-Bucks” or “free Robux” link from TikTok, Discord or a fake YouTube comment, lands on a page that imitates the Roblox or Epic login, and enters their username and password. The scammer then drains the currency, changes the email and sells the account.
Why does a scam from 2019 still work?
Because every new cohort of nine-year-olds meets it for the first time. The fake pages have also improved, the promises have got more specific, and most children do not learn to read URLs critically until their teens.
What actually stops it?
Four things. Two-step verification on the Roblox or Epic account, which makes a stolen password useless. A spending PIN, so drained currency cannot be topped back up. Your email as the recovery address rather than your child’s, so they cannot be tricked into approving a change. And DNS-level blocking — NextDNS with the default family blocklist catches most of these domains.
What is the one phrase to teach?
“If it says free, it’s a lie.” Roblox and Epic do not give away currency — no contest, no promo code, no YouTuber running a real generator. The value of a flat rule is that it needs no judgement in the moment.
The account has already been drained. What now?
Reset the password immediately, then use the Roblox or Epic account-recovery flow. Check linked accounts too — an Epic account tied to Microsoft or PlayStation needs resetting as well. Report the scam URL on the platform where your child found it, and file at reportfraud.ftc.gov.