Someone wants to give you their $2K Roblox account. Real?

Why this one gets even careful people

You already know the obvious rule: don't give anyone your password, don't click sketchy "free Robux" links. You'd spot a random stranger DMing you a generator in two seconds. So why does this one work on people who'd never fall for that?

Two reasons, and they stack. First, this isn't a stranger. It's someone you've raided with almost every week for six months. You've spent real time with DarkKnight_17. He gave you a Purple Star Knight two months ago for nothing. Your brain files him under "friend," not "threat" — and friends get the benefit of the doubt. Second, nobody's asking you for anything. They're giving. Two thousand dollars in Limiteds, the Sparkle Time Fedora, the whole set, just handed to you. Free money flips a switch in your head. The part of you that double-checks links goes quiet, because checking feels like you might talk yourself out of the best thing that's happened all month.

That combination — months of trust plus a windfall you don't want to question — is exactly the gap the scam is built for. It's not aimed at careless people. It's aimed at the moment your guard naturally drops.

The trick: it's not a trade, it's a fake login

Here's the part nobody says out loud. There is no such thing as transferring a Roblox account to another person. No button, no setting, no link, no "Roblox transfers ownership automatically." Roblox doesn't let you hand your whole account to someone, and sharing or selling accounts straight-up breaks the Roblox Terms of Service. So the second you see "log in here and ownership transfers to you," you're already looking at something that can't be real — it's describing a feature that does not exist.

What that link actually is: a pixel-perfect copy of the Roblox login page, sitting on a domain that is not roblox.com. Notice the URL in the DM — roblox-ownership-transfer.app/verify. That's not Roblox. Real Roblox lives at roblox.com and inside the official app, full stop. The fake page has the logo, the colors, the login box. You type your username and password to "verify it's you," and those keystrokes go straight to the scammer's server. There's no account being given to you. The only account changing hands is yours — and now they're the ones logging into it.

That's why this is called reverse phishing. Normal phishing demands your password. This version offers you a gift and lets you volunteer your password on your own, because you think you're "claiming" something. Same theft, smarter packaging. The defense is boring but absolute: you never type your Roblox password anywhere except the official Roblox app or roblox.com. Not to claim a gift, not to verify a trade, not to unlock anything. Ever.

And if you want to test whether a gift is real, there's a clean tell. Real items move through Roblox's in-game trade system — Limiteds sent account to account, visible right there in Roblox, no outside link involved. So you reply: "just trade it all to me the normal way." A real friend does it. A scammer suddenly has a reason why trading "won't work" and you "have to use the link." That excuse is the whole scam in one sentence. (This is the same engine behind the "free Robux, no human verification" generator scam — different wrapper, identical goal: get your login somewhere that isn't Roblox.)

Why the "friend" offering is probably already hacked

The thing that messes with your head is that the message feels like DarkKnight. The tone, the emoji, the way he calls you his best mate in the guild. So how is it a scam if it's actually him?

Usually it isn't him. One of two things is true. Most often: DarkKnight's own account got phished first. A scammer logged into his Discord, scrolled his friends list, saw a six-month raiding history with you, and fired off the "I'm quitting" offer wearing his name. The real DarkKnight has no idea any of this went out. He's probably asleep. That's why "messaging him to ask if it's real" inside the same Discord doesn't help — you'd just be asking the scammer, who will absolutely say "yes bro it's me, hurry before my parents take my phone."

Less often, but it happens: the "friend" was a scammer the entire time. Six months of being a chill guildmate, a free Purple Star Knight that cost him maybe thirty bucks — all setup, a cheap investment for a two-thousand-dollar payoff. Patient, but real.

Either way the move is the same. Confirm the person on a different channel than the one the offer came in on. Hop on the guild voice call and hear his actual voice. Text him on a number or app you already had for him. If he can't be reached anywhere except the account pushing the link, that account is compromised — and the kind thing to do is screenshot it and warn the guild so nobody else logs in.

What to do if you logged in

Maybe you already typed your password into that page before something felt off. Okay. You're not stupid and you're not the only one — this scam is good. Move fast and you can shut the door before they get comfortable:

1. Change your Roblox password right now, from the official Roblox app or roblox.com — not from any link in the DM. If you can still get in, do it immediately. Use a password you've never used anywhere else.
2. Turn on 2-Step Verification. Settings → Security in the real app. Now even someone holding your password can't get in without the code on your phone.
3. Set an Account PIN. Same Security menu. It locks your settings so an attacker can't quietly change your email or password even if they're already logged in.
4. Log out all other sessions / "Refresh" your account. In Security settings there's a log-out-of-all-devices option. That kicks the scammer off if they're already signed in on their own device.
5. If you reused that password anywhere else — email, Discord, a game — change it there too. They will try it.
6. Can't get back in at all? Use Roblox's official account-help flow at en.help.roblox.com to recover a hacked account, and tell a parent so they can watch for weird charges. That's not snitching on yourself — it's closing the door faster.

If real money got taken — a stolen card, a charge you didn't make — it's worth reporting. In the US you can file with the FTC at reportfraud.ftc.gov, and online crime can be reported to the FBI's IC3 at ic3.gov. You probably won't get the Robux back, but reporting helps get these accounts and sites taken down so the next guildmate doesn't fall for it.

For parents reading this

If you're a parent who landed here, two guides cover the rest: Free Robux Generators — What Every Parent Should Know in 2026 for the full 2026 scam-pattern catalog, and Roblox Account Hacked — A Parent's Recovery Guide for the step-by-step if it already happened.