I am experiencing a reproducible issue with Roblox Account Recovery for the account @ItsPennyXD.
The account previously had an email address associated with it which is still accessible to us. That email address historically received Roblox security communications for @ItsPennyXD, including password-change notifications, login notifications and 2-Step Verification communications.
However, the email appears to have subsequently been removed or changed on the account.
Steps to reproduce
- Open the Roblox Forgot Password/Username recovery process.
- Enter the historical email address previously associated with @ItsPennyXD.
- The recovery process identifies the correct account, Penny (@ItsPennyXD).
- Select the account and continue recovery.
- Roblox displays the Account Recovery page stating that a 6-digit verification code has been sent.
- Check the relevant email inbox, including spam/junk folders.
- No verification code is received.
- Select Resend code.
- No code is received and recovery cannot proceed.
This has been reproduced repeatedly.
There is an additional complication: @ItsPennyXD is a child account associated through Roblox Parental Controls with an accessible parent account. Despite retaining access to the parent account and historical email address, I cannot find an alternative verification path when email recovery reaches this dead end.
The result is a recovery loop: self-service recovery requires a verification code that does not arrive, while the user is repeatedly directed back to that same self-service process.
I can provide screenshots showing the Account Recovery verification-code screen and additional account information privately to Roblox staff.
Expected behavior
The Account Recovery process should provide a usable recovery path when the account owner/parent retains legitimate historical verification information.
If the entered email address is eligible for recovery, the displayed 6-digit verification code should actually be delivered so recovery can continue.
If the historical email is no longer eligible because it was removed or changed on the account, the recovery process should provide an appropriate alternative verification route rather than leaving the user at a verification-code screen that cannot be completed.
For a child account linked through Roblox Parental Controls, I would also expect there to be an appropriate method for the verified parent account to assist with recovery or establish the parental relationship when normal email recovery is unavailable.
The expected result is not for Roblox’s security requirements to be bypassed. It is for there to be a functional method of satisfying those requirements when the normal email recovery mechanism cannot be completed.
A private message is associated with this bug report