PC Gamer is supported by its audience. When you buy through links on our site, we may earn an affiliate commission. Learn more
By published
Some of the schemes used to prey on young Roblox users are surprisingly sophisticated.
In December 2021, the YouTube channel People Make Games shared new allegations claiming that the game and game-creation platform Roblox is unsafe for kids—its primary audience. For anyone not tuned into the Roblox scene, it was eye-opening: Literal children being swindled out of sometimes large amounts of money and work, a situation that Roblox appeared either unwilling or unable to address.
A new Vice report digs deeper into how it all happens: How «beamers,» as they’re called in the Roblox community, are able to hack into Roblox accounts, strip them of valuable items, and then sell them on black markets. Phishing is a big problem, obviously, as beamers use generators to automatically create legitimate-looking pages targeting specific users or items, commonly shared with Roblox users via Discord. But there are more sophisticated schemes in play too.
One common ploy is to offer to create a new avatar for the intended target or claim they’re looking for paid help to develop a game, the goal being to gain access to the victim’s .HAR file, and more importantly the login token it contains. A Google Chrome extension enables those tokens to be manipulated in order to gain access to targeted accounts; .HAR files contains a warning that explicitly states the risk of sharing it, but it often goes overlooked or ignored.
Beamers have also been able to gain control of targeted accounts by using fake Paypal screenshots to convince Roblox support that they’re the proper owners, similar to the takeovers of «high-profile» FIFA accounts by hackers in January. One player told Vice he believes his account was compromised via «SIM swapping,» in which the victim’s mobile carrier is tricked into sending texts and calls to a SIM card controlled by a hacker, enabling them to bypass 2FA protection or even change a user’s password.
Once a victim’s Roblox items are taken, they’re typically offloaded on one of many unauthorized Roblox marketplaces, for sometimes breathtaking prices: YR, the co-founder of the Adurite marketplace said the biggest sale on the site in 2021 was a Midnight Blue Sparkle Time Fedora, which sold for $13,605.
🥳🥳🥳 pic.twitter.com/cAKmk47EAfDecember 27, 2021
YR acknowledged that the sale of stolen items through unofficial markets is a problem, but said that—much like Roblox itself—there’s not much they can do to stop it. «As we are a public and easily accessible marketplace to sell on, it’s surely possible that these ‘beamers’ attempt to sell items on Adurite as they would try to on any other sort of marketplace,» they said. «Although we try our best to filter out these items, it’s very difficult to detect/filter these items.»
Roblox does offer a «rollback» option for item trades, but it’s limited to one per account. It also «aggressively deters moving activity off Roblox because we cannot control activity on other applications,» a rep told Vice, and offers 2FA and other features to help protect accounts.
«“We’ve spent over a decade building a stringent safety and security system and policies that we are proud of and that we are continuously evolving as our community grows,» the rep said. «The Roblox InfoSec team, in particular, actively mines various sources for threat intelligence, monitoring for malicious activity and taking appropriate action.»
Clearly, it’s not enough: The digital frontier is a risky place for everyone, but it’s not reasonable to expect children to effectively navigate those risks unaided and unprotected, especially when the amounts of money involved are bound to continue to attract predators.
Andy has been gaming on PCs from the very beginning, starting as a youngster with text adventures and primitive action games on a cassette-based TRS80. From there he graduated to the glory days of Sierra Online adventures and Microprose sims, ran a local BBS, learned how to build PCs, and developed a longstanding love of RPGs, immersive sims, and shooters. He began writing videogame news in 2007 for The Escapist and somehow managed to avoid getting fired until 2014, when he joined the storied ranks of PC Gamer. He covers all aspects of the industry, from new game announcements and patch notes to legal disputes, Twitch beefs, esports, and Henry Cavill. Lots of Henry Cavill.
Sign up to get the best content of the week, and great gaming deals, as picked by the editors.
Thank you for signing up to PC Gamer. You will receive a verification email shortly.
There was a problem. Please refresh the page and try again.
PC Gamer is part of Future US Inc, an international media group and leading digital publisher. Visit our corporate site.
© Future US, Inc. 11 West 42nd Street, 15th Floor, New York, NY 10036.
