10 signs your Roblox account is hacked (and how to confirm)

The short version

Your Roblox account is hacked when someone else has the credentials and is using them. That can be silent (they sit on the account waiting for items to be tradeable) or loud (they spam scams from your account inside an hour). The signs below cover both modes.

If you see any of these and you are sure they are not from you, treat the account as compromised. Change the password from the Roblox website immediately, then sign out of all other sessions (Settings → Security → "Sign out from all other sessions"). The second step is what kicks the hacker out — the password change alone is not enough if their session token is still active.

If you have already been locked out (you cannot sign in at all), go to account recovery without email access instead — that guide covers the support ticket path.

The 10 most reliable signs

Each item below tells you what the symptom is, what is causing it, and what to do about it. They are ordered by how reliable a signal each one is — the top ones almost always mean compromised; the bottom ones can have innocent explanations and should be combined with at least one other sign.

1. Login email from a country you have never been in

Roblox sends an email whenever an account is signed into from a device or IP it has not seen before. The subject line is "New Sign-in to your Roblox Account" or "Account Activity Alert."

• The email lists the approximate location, browser, and time.
• A login from Brazil while you are in the UK = compromised. Period.
• A login from a city 30 miles from yours = probably your phone on mobile data instead of Wi-Fi, not a compromise.
• A login from "Unknown / Anonymous" = often a VPN; could be you, could be a hacker behind one. Combine with sign #2 to confirm.

This is the highest-fidelity signal. Roblox sends the email even if the login was blocked by 2FA, so it tells you "someone has your password" even when they have not actually gotten in yet.

2. Robux balance dropped without you buying anything

Open your Robux transaction history (Settings → Billing → Transaction History on the website). If there are purchases or spends in the last 24 hours that you did not make, the account is compromised.

Hackers spend Robux fast, usually on tradable limiteds that they then trade to a clean account. Look for purchases of off-meta limiteds, large catalog hauls, or sudden game-pass buys you do not recognize.

3. Inventory items moved without you trading

Roblox keeps a trade history visible at Trades → History on the website. If there are completed trades you did not authorize, the account is compromised — even if the trade looks "fair" by item-value alone, the fact that you did not click through it means someone else did.

Limited items are the highest-value target. If a Dominus or other expensive limited is gone, the trade history is the first place to look.

4. Friends ask why you are sending scam links

Hackers use compromised accounts to spread scams to your friends. The bait is usually:

• "Hey check out this free Robux site roblox.com/free-robux.fake-domain.com"
• "Bro I got hacked, can you log into my account and check?"
• "I'm reporting your account, click here to dispute"

If two or more friends mention receiving messages like that from you in the last day, the account is compromised. Hackers send these in bulk, so multiple friends report it almost simultaneously.

5. Your display name or avatar changed without you doing it

Hackers sometimes flip the display name to a scam-promo string ("FREE-ROBUX-GG", "DM-FOR-LIMITEDS") or wipe the avatar to default colors. Both are visible immediately on the profile.

Either one is high-confidence compromised.

6. Locked out — password "incorrect" but you know it's right

You enter the correct password and Roblox rejects it. Two possible causes:

• Hacker changed the password. This is the most common explanation. They got in, rotated the password, and now you cannot log back in.
• You typo'd. Try one more time, then use Forgot Password if it still fails.

If Forgot Password sends to an email address you do not recognize, that confirms compromise — the hacker also changed the email on the account.

7. 2-Step Verification challenge fires when you did not try to log in

Roblox shows a 2FA prompt only when a login attempt is in progress. If you get a Roblox 2FA email or authenticator notification but you are not actively logging in, somebody else is — they have your password and are trying to push through the second factor.

This is also a high-fidelity signal. Change your password immediately.

8. Premium subscription cancelled or downgraded mysteriously

If you had Roblox Premium and it is suddenly inactive or downgraded, someone changed the payment method or cancelled the subscription. Combine with sign #2 (Robux balance change) — sometimes the hacker cancels Premium to redirect the upcoming Robux payout to themselves before logging out.

9. Friend or group memberships disappeared

Hackers occasionally clean up the social graph to avoid easy account recovery — removing friends, leaving groups, or emptying the chat history. If you log in and your friends list is suddenly shorter than yesterday, run the rest of this checklist.

10. Random new device or browser shows up in active sessions

On the website: Settings → Security → My Account → Active Sessions. The list shows every device currently authenticated against your account. A device or browser you do not recognize means somebody is logged in right now.

Sign out of all other sessions immediately — that single click invalidates every token except the one in your current browser.

Signs that mean nothing on their own

These four show up in worried posts on Reddit but are almost never actually compromise:

• Your in-game character looks different. Roblox avatar rendering occasionally bugs out, especially after a new Roblox update. Reload the avatar or log out and back in.
• You got a "we noticed a new sign-in" email but you recognize the device. Roblox's notification email fires on minor browser fingerprint changes — new Chrome version, browser update, mobile data vs. Wi-Fi. If you actually recognize the device, the email is a false positive.
• You hit a game's anti-cheat ban. That is the game owner banning you from their experience, not Roblox banning your account. Different system.
• Roblox temporarily logged you out. Session tokens expire on a rolling basis. If you got logged out and re-signing in works fine, it was a token rotation, not a hack.

What to do immediately if you confirm compromise

The order matters. Do these in sequence, not in parallel:

1. Sign out of all sessions. Settings → Security → "Sign out from all other sessions" on the Roblox website. This is the only step that kicks the hacker off right now. Until you do this, changing the password is not enough — their existing session token still works.
2. Change the password. Use a long randomized one from a password manager. Do not reuse a password from any other site.
3. Enable 2-Step Verification if you have not already. Settings → Security → 2-Step Verification → set up via authenticator app (not SMS — SMS can be SIM-swapped).
4. Update the email on the account to a primary one you actively check. Hackers sometimes get back in by exploiting an old, abandoned recovery email.
5. Audit transaction history. File a support ticket for any trade or purchase you did not authorize. Be specific — give Roblox the trade ID and the timestamp.
6. Warn your friends. Send a single short message that the account was compromised and any DMs from the last 24 hours were not from you.
7. Check linked accounts. Discord, third-party game-account links, payment methods. Anything tied to the Roblox account is also at risk.

Frequently asked

Q. I think I'm hacked but I'm not sure. What's the safest thing to do? Change the password and sign out of all sessions anyway. It costs nothing if you were wrong; it limits damage if you were right.

Q. The hacker is using my account right now. Can I see what they're doing? Indirectly. The active sessions list shows their device, location, and last-active time. You cannot see screen-by-screen what they are typing, but you can see that they are online. Signing out all sessions kicks them off.

Q. Will Roblox reimburse stolen Robux? Sometimes. If you can prove the account was compromised (via support ticket, with screenshots of the unauthorized trades and login alerts), Roblox can roll back trades on items that have not yet been re-traded out. Robux balances themselves are harder to recover; Roblox is much more likely to restore items than currency.

Q. Should I just delete the account? No. Account deletion is irreversible and Roblox will not restore a deleted account, even if you later prove ownership. Recover the account first, then decide whether to keep using it.

Q. The hacker locked me out completely. What now? See How to recover a Roblox account without email access. The support-ticket process is slower but works if you have evidence of ownership (purchase history, login IP history, original signup data).

Q. How did they get my password in the first place? Three vectors account for almost all Roblox account compromises:

• Reusing a Roblox password on a site that got breached, and the breach dump was sold.
• Falling for a phishing site that looked like Roblox login (roblox-login.tld etc.).
• Running a "free Robux generator" or executor download from an untrusted source that included a credential stealer.

Use a password manager so every site gets a unique random password, do not click login links in DMs, and do not download executors from anywhere except the canonical sites in our Executors guides.

If any sign on this page describes what you are seeing right now, treat the account as compromised. The cost of being wrong is one password change; the cost of being right and waiting is your inventory.