Short answer: On the Roblox website or app, go to Settings (gear icon) → Security, and switch on 2-Step Verification. Choose Authenticator App rather than email, scan the QR code, enter the six-digit code, and save the recovery codes. If this is a child’s account, do it together and keep the recovery codes somewhere a parent can find them.
Why Roblox accounts get stolen
Two reasons, and they are both about money.
Robux and Limiteds. Accounts holding Robux balances or rare limited items have straightforward resale value. Limited items in particular trade at high prices and cannot be re-acquired once they are gone from an account.
The user base is young. Scams aimed at children work far more often than the same scams aimed at adults. “Free Robux” sites, fake giveaways, and in-game messages promising rare items are constant, and a nine-year-old is not equipped to spot a lookalike login page.
The emotional cost usually exceeds the financial one. Losing an account built over years, with friends, saved creations and items, matters enormously to the child it happens to.
Step 1: Open Security settings
- Sign in at roblox.com (or in the app).
- Click the gear icon → Settings.
- Open the Security tab.
- Find 2-Step Verification.
You will need a verified email address on the account first. Many children’s accounts were created without one, or with an address the child no longer uses — fix this before anything else, because it is the only recovery route Roblox offers.
For a child’s account, use a parent’s email. This is the single most useful thing you can do: recovery emails go to an adult, and the account cannot be quietly changed without a parent seeing it.
Step 2: Choose the authenticator app
Roblox offers:
- Authenticator App — six-digit codes generated offline. Choose this.
- Email — a code to the inbox. Simpler, but only as strong as the email account, and slower in practice.
Turn on Authenticator App. Roblox displays a QR code and a manual entry key. Scan it with any standard app — Google Authenticator, Aegis, 2FAS, Microsoft Authenticator. If this is unfamiliar territory, start with what is an authenticator app.
On a shared family device, consider putting the token in a parent’s authenticator rather than the child’s phone. It adds a small amount of friction to logging in and a large amount of protection against a child being talked into approving something.
Never screenshot the QR code. Children stream and screen-share constantly, and that image is the account’s permanent key.
Step 3: Save the recovery codes
Roblox provides recovery codes after setup. Save them — printed and kept with household documents is ideal for a family account, or in a parent’s password manager.
Roblox support does help with account recovery, but the process asks for details like previous passwords, purchase receipts and the original email. Having the codes skips all of it. See where to store 2FA backup codes safely.
Step 4: The other settings that matter
While you are in Settings, four things are worth the time:
- Account PIN (Settings → Security) — a four-digit PIN that locks the settings themselves. Set it, and do not tell the child if you are managing safety settings for a young user. It prevents privacy and age settings being changed on a whim or under pressure from someone in a game.
- Parental controls and spend limits — under Parental Controls, you can set monthly spend limits and content maturity settings.
- Privacy settings — who can message, chat and invite. Tightening these removes the delivery channel for most scams.
- Previous sessions — check for logins you do not recognise and change the password if anything looks wrong.
The conversation that matters more than the settings
Technical controls only go so far with a young user. The rules worth teaching, in language that works:
- Free Robux does not exist. Every site, video and message offering it is a scam, without exception.
- Nobody ever needs your code or your password. Not a friend, not a “Roblox admin”, not a YouTuber. Roblox staff will never ask. See OTP scams.
- Do not log in on a link somebody sent you. Type roblox.com yourself.
- Trading “for a bit” is theft. Handing an account over to someone who will “make it better” ends one way.
- If something goes wrong, tell an adult straight away. Children hide compromised accounts out of embarrassment, and the delay is what makes it unrecoverable.
Frequently asked questions
Can my child set this up themselves?
Technically yes, but do it together. The recovery codes and the email address should be under a parent’s control, and that is a decision worth making deliberately rather than discovering later.
Which authenticator app should we use?
Any standard one — Roblox uses normal TOTP. If the family already uses a password manager, its built-in authenticator keeps everything in one place. See password managers with built-in TOTP.
What if we lose the phone with the codes?
Use a recovery code, or the verified email. Failing both, Roblox support can help with proof of ownership — purchase history is the strongest evidence. See recovering accounts after losing your 2FA phone.
Why is the code being rejected?
Usually the phone’s clock has drifted. Turn on automatic network time. See why 2FA codes get rejected.
Does 2FA stop in-game scams?
No. It stops unauthorised logins. Trade scams, fake giveaways and social manipulation inside games happen while the real owner is logged in — those need the conversation above, not a setting.
My child’s account was already stolen. What now?
Reset the password via the verified email immediately. If the email was changed, contact Roblox support with purchase receipts and account history. Then enable 2FA before anything else, and check the device for malware if they have installed “Roblox executors” or mods — those are a common source of stolen sessions.
The bottom line
Five minutes in Settings: verified parent email, authenticator app rather than email codes, recovery codes stored where an adult can find them, and an account PIN on top. Then have the free-Robux conversation, because the settings protect against strangers and the conversation protects against the scam that gets past them.
Setting up 2FA elsewhere too? Our guides cover Epic Games and dozens of other services — or generate a test code with our free browser tool.