Incorrect Email Mask Displayed on 2-Step Verification Screen When Adding Account via Switch Accounts

[anon75603056]

Description:

When attempting to log into another Roblox account using the Switch Accounts → Add Account feature, the 2-step verification screen incorrectly displays a masked version of the currently logged-in account’s email address instead of the email address associated with the account being added.

This issue occurs consistently across multiple browsers (Opera GX and Google Chrome) and only affects the Switch Accounts flow. The regular login page does not show this issue since the email mask normally doesn’t appear there.

---

Steps to Reproduce:

1. Log into any Roblox account (Account A).
2. From the Settings menu, click Switch Accounts → Add Account.
3. Enter the credentials of another account (Account B) that has email-based 2-step verification enabled.
4. Observe the 2-step verification prompt that appears after submitting the credentials.

---

Observed Behavior:

• The 2-step verification screen displays a masked email address starting with the first letter of the currently logged-in account’s email (Account A) instead of Account B’s email.
• The rest of the address is censored as usual (e.g., r******@gmail.com), but it incorrectly shows the active account’s email rather than the one you’re trying to log into.

---

Expected Behavior:

• The 2-step verification screen should show the masked email address that belongs to the account being added (Account B), not the currently active account (Account A).

(The verification code itself is still sent to the correct email (Account B). This is purely a visual issue affecting the displayed mask, not the actual 2-step verification process)

---

Reproducibility:

• 100% reproducible across multiple browsers.

---

Environment:

• Browser: Opera GX 122.0.5643.79 (Chromium 138.0.7204.251)
• Operating System: Windows 11 Pro
• Processor: Intel Core Ultra 9 275HX
• Memory: 64 GB RAM
• Graphics: NVIDIA GeForce RTX 5090
• Browser Extensions: None enabled

---

Screenshots:

• Visual evidence will be provided (three screenshots):

  1. The currently logged-in account’s email (Account A):
     

• 2. The email mask shown on the 2-step verification screen:
     

     

  3. The email of the target account being added (Account B):
     

[poggodoggodude]

Hi folks!

Thank you for the report. We shipped a change that we think addresses the issue. Do you think you could try again?

[anon75603056]

I tried to reproduce it, and it’s fixed. Thanks