A cautionary tale about online gaming security – and why some companies get customer support right.
What Happened
One of our founder’s kids loves Roblox. Smart parent, secure setup. The account had two-factor authentication through the parent’s email. Should have been safe.
It wasn’t.
Last week, the kid noticed some game items missing. Strange. When we checked the account, we found a login session from Indonesia. Obviously compromised.
We did everything right. Changed the password to a long, random string. Logged out all other sessions. Problem solved.
Wrong again.
The Real Attack
The hackers were smarter than we realized. The kid had unknowingly installed malware – probably from a sketchy game download or website. This malware could “steal cookies” – essentially copying the digital keys that prove you’re logged in.
With stolen cookies, hackers could log into the account from their own devices without needing the password or email verification. Think of it like someone photocopying your house key.
But here’s where it got clever. After we changed the password, the malware was still on the computer. This time, the hackers:
- Logged the kid out of all sessions
- Used a keystroke logger to capture the two-factor code as the kid typed it
- Switched the account from email-based two-factor to authenticator-based two-factor
- Locked us out completely
Now the hackers had total control. The account required an authenticator app they controlled, and we had no backup codes.
The Rescue
This is where Roblox impressed us. Their support team actually helped recover the account. They verified details about how the account was used and confirmed the parent’s email address. Within days, we had access back.
This kind of real human support for compromised accounts is rare. Most companies just point you to automated password reset tools. Roblox deserves credit for going beyond that.
What This Means for You
Your takeaways from our expensive lesson:
Use authenticator apps, not email, for two-factor security. Email-based verification can be bypassed more easily. Apps like Google Authenticator or Microsoft Authenticator are stronger.
Clean devices matter more than strong passwords. Malware can defeat almost any security measure. Keep computers updated and avoid downloading sketchy software.
Hardware security keys are the gold standard. For your most valuable accounts – banking, work, primary email – consider a physical security key. They’re nearly impossible to hack remotely.
Save backup codes somewhere safe. When you set up two-factor authentication, most services give you backup codes. Print them. Store them securely. You’ll need them if your device breaks or gets stolen.
Not all companies will help you recover. Roblox went above and beyond. Many services won’t. Take security seriously upfront.
The Bottom Line
Gaming accounts might seem trivial, but they’re often connected to payment methods and personal information. Treat them seriously.
More importantly, use this as practice for protecting accounts that really matter. The same techniques that compromised a Roblox account could target your bank, work email, or social media.
Security isn’t about being paranoid. It’s about being prepared.
