- Cybercriminals use fake Robux offers to trick minors and steal real money.
- The 'beaming' technique allows accounts to be stolen without passwords, bypassing two-factor authentication.
- More than 34 million Roblox credentials have been leaked on the Dark Web, according to Kaspersky.
- Parents should activate parental controls, not save cards in profiles, and educate children about the risks.
Cybercriminals have targeted Roblox, one of the most popular gaming platforms among children in Spain , to carry out scams that can empty families' bank accounts. What many children and teenagers see as an innocent shortcut to safely obtain free Robux has become the gateway for organized crime groups operating on the Dark Web. Cybersecurity experts warn that the problem is growing and that parents must take urgent action.
Behind the promises of free virtual currency lies a criminal network that uses everything from fake websites to advanced Trojans. Joan Arnedo, a cybersecurity researcher at the Open University of Catalonia (UOC) , explains that scammers target children through game chats and networks like Discord, posing as users of the same age. They send them emotional messages with offers that are impossible to refuse, such as "enter your details here to get Robux" or "click on this link for exclusive content." And the unsuspecting kids fall for it.
The modus operandi of scammers
The method is always the same: the child receives a message with a tempting offer, clicks on a link external to the game, and unknowingly downloads a malicious file or enters their credentials on a fake website. The goal is to steal the Roblox account or, directly, access the payment methods saved on the phone or the platform. According to data from the cybersecurity firm Kaspersky, more than 34 million Roblox credentials have been leaked on the Dark Web in recent years, which gives an idea of the scale of the problem.
Once the criminals gain control of an account, they appraise the inventory of skins, weapons, and limited-edition items and resell them on illegal forums or Discord servers dedicated to money laundering. A powerful account with rare cosmetics can fetch hundreds of euros on the black market , and the scammers don't stop there: they also hack and hijack entire community-created video games to siphon off developers' monthly revenue.
The 'beaming' technique and the black market
The technology behind these scams is becoming increasingly sophisticated. Cybercriminals are no longer limited to fake login pages; they now use Trojans that can be purchased on underground forums for as little as $10. With these tools, they execute "beaming," a technique that involves stealing the victim's browser session tokens , cloning access, and directly entering Roblox profiles without the need for passwords or two-factor authentication. This allows attackers to empty associated bank accounts without the minor realizing it until it's too late.
The impact on families is often devastating. Children, lured by the promise of advantages in the game, download malicious files and, when they realize their mistake, usually remain silent for fear of punishment. The silence is broken when parents discover charges ranging from €300 to €2.000 on their bank cards linked to the platform. Arnedo insists that children are the victims, not the perpetrators, and that parents must create an environment of trust so they can report any mistakes without fear.
Tips for protecting minors
Faced with this threat, experts recommend several practical measures. First, activate parental controls and two-step verification whenever available . It's also crucial to monitor gameplay to detect any suspicious messages and prevent children from interacting with strangers outside the official platform. The golden rule is to never download patches or add-ons, or click on links that don't come from the game's official stores.
Furthermore, parents should avoid leaving credit card information saved by default in their children's gaming profiles and regularly review bank transactions. If, despite these precautions, a child falls victim to fraud, the first step is to change the password for the affected account, notify the platform, and cancel the associated credit card. Arnedo also advocates for basic digital protection and child accounts : children must understand that nothing online is free and that virtual currencies have real value, which their parents pay for.
Collaboration between parents, educators, and platforms is key to curbing this wave of fraud. With simple measures and open communication, it's possible to reduce the risk of young people falling prey to cybercriminals operating on Roblox and other multiplayer video games. Prevention and information remain the best weapons to protect the finances and safety of the entire family.