After suspected compromise, Roblox recommends removing suspicious downloads or extensions, scanning for malware, restarting, and scanning again before account recovery. Then address account security. Roblox: My account was hacked – What do I do?.
This article focuses on the first response. The account recovery guide covers the detailed login-recovery branches. A calm, ordered response is more useful than trying unrelated fixes on several devices at once.
Separate observations from assumptions
Make a brief private note of the first sign you noticed. Examples include an unrequested settings alert, a password no longer accepted, an unfamiliar session, or a change to items you can actually observe. Record the approximate time and what access you still have.
One confusing error does not identify a cause. Avoid accusing a particular player or assuming every changed balance was theft before checking the account. At the same time, you do not need to wait for certainty before stopping suspicious activity and reviewing your own access.
Stop using a device you suspect is unsafe
If the problem followed a download or browser extension, do not keep entering replacement passwords on that device while wondering whether the software is still active. Follow the cleanup steps above and seek help from the person who manages the device when necessary.
Think through the sequence privately: what was installed, what page was opened, and what information was entered? This is not an invitation to test the suspicious file again. The useful outcome is an accurate timeline, not a repeat of the event.
If you still have account access
Roblox’s password-change control is in Account Info and asks for your current password and a new one twice. Roblox: How do I change my password?. Check that you are working in the affected account, and keep a record of completing the change without recording the password in the incident note.
End unwanted sessions using Roblox’s session controls. Roblox: Session Management. Our session-management guide explains the details.
Review what you can still use for recovery before closing a working session. If you are already locked out, do not treat a public profile view as account access; move to the recovery route instead.
Respond to an actual pending security request
Roblox’s Delayed Actions feature can pause sensitive actions and notify you. If the request was not yours, follow the official rejection flow and review the password and security settings. Roblox: Delayed Actions.
Read the action described. A pending email or asset-related request and a completed change are not identical events. Note which one you saw. If you took a protective action, include that in your timeline so a later report does not imply it is still pending.
If items or currency are missing
Contact Roblox within 30 days for compromised-account inventory assistance; restoration is limited and not guaranteed. Roblox: My account was hacked – What do I do?. Do not delay while searching for a promised outcome.
List the missing items or observed transactions as accurately as you can, including relevant times. Mark anything uncertain. A smaller list of concrete observations is stronger than a long list assembled from memory and assumptions.
Avoid a second compromise during recovery
Keep passwords, verification codes, backup codes, and cookies private. Roblox: Keep Your Account Safe. Do not install an unknown recovery tool because you feel rushed.
Use the official support-contact process for ownership and account issues. Keep one coherent explanation: what changed, when you noticed, what access remains, and what protective steps you completed.
Finish the response, not just the login
Getting back into the account is a checkpoint. Before returning to normal use, make sure you understand which recovery contact and login methods now belong to you, which devices should remain connected, and whether the suspected source of the problem was addressed. Keep the incident note until the situation is resolved.
Official sources reviewed September 13, 2026. This guide is based on documentation research, not a claim of hands-on testing. Qrajo is independent of Roblox. Featured artwork is an original illustration. Read our editorial policy.
