Your 10-year-old son has started playing Roblox, when he realises all of his in-game currency, Robux, is gone. When you try to find out what happened, he says he was recently promised extra Robux if he followed a link on YouTube. When he signed on at the site link, he was taken to the Roblox site as usual but there was no sign of the extra currency.
He has fallen victim to a fraud where Roblox users – many of whom are children – are being targeted for their login details. With those details criminals can steal the virtual currency and players’ personal data. Within Roblox, players use Robux to buy virtual items, such as skins or animations for their avatar.
You can earn the currency within the game, but it can also be bought. At Roblox’s online store you can buy packages costing up to £199.99. Using ready-made kits bought on the dark web, fraudsters create a fake login page that is identical in appearance to the legitimate Roblox site.
Researchers from NordVPN say that over a seven-day period they found almost 200 addresses selling ready-made phishing pages that provided the tools to defraud Roblox users. Often the links to the phishing sites are in comments on YouTube or TikTok videos or in chats on Discord, the chat app for gamers. The message might say there are free Robux available if a player clicks on the link provided.
Like many scams, there will often be an element of urgency attached, such as the offer apparently only being valid for a few hours, to encourage the victim to act without fully thinking through the consequences. From that link, the child will be taken to a fake sign-in page that will probably be identical to a legitimate Roblox site in appearance. The address will usually contain the name Roblox, for example “Roblox-verify” or “login-Roblox”.
When they are on the scam site, the child will be asked for their username and password but may also be told to put in two-factor identification codes, says NordVPN. But then the child is taken to the legitimate Roblox site so they can play their games as normal, leaving little indication that anything is amiss. Once they have the login details, the fraudster may sell them on or use them to transfer Robux to another account.
Extract — continue reading at the source.
