Brief Description:
Using the support system for Roblox, allows you to enter anybody’s email. Let’s use a YouTuber for example, let’s say you really don’t like them. If they have their business email publicly available, and is linked on their YouTube channel, and is linked to their Roblox account, ANYBODY could use their email, make a ticket for Roblox support sending a threat, and get them banned.
Here’s an example:
Let’s say this is KreekCraft’s email: iamkreek@gmail.com
Let’s assume it was listed under his channel as his business email, and linked to his Roblox account.
If I go to Roblox Support, I can enter in his email, and since we all know his username, enter in the username, as shown below…
You might be thinking, what is the problem with this?
If you send a threatening message, or anything that violates Roblox’s Terms of Service, your account gets banned. So you could get anybody banned.
Expected behavior
Expected Outcome:
Some sort of confirmation email sent from Roblox to confirm it was actually ME who created the ticket.
Below is some concept art of what it could look like…
Yeah, this makes way too much sense — it would not only prevent abuse but also confirm that the real owner of the email is actually the one reaching out. It would instantly block a whole class of exploits. The fact that this kind of basic verification doesn’t exist is honestly crazy.
There’s even a YouTuber who had the FBI show up at his house because of this situation. People use the support system to send threatening messages to Roblox using that person’s email, and things can escalate to a really serious level:
Also, I feel like maybe they don’t want to enforce this. Like, if someone is currently logged into their account and using the email that’s already verified and connected to it, maybe Roblox thinks there’s no need to verify if it’s actually them when they contact support. But for literally every other imaginable scenario, this kind of verification seems absolutely necessary.
I noticed that some agents do realize that the ticket is unusual and ask you to confirm that you wrote it.
However some agents do take it as 100% real.
Here’s an example of an agent that noticed.
