Hi Creators,
Today, we are introducing Enhanced Protection, the most secure version of 2-Step Verification (2SV) designed to eliminate “point-of-authentication” attacks like phishing and credential stuffing. We recommend enrollment for any user seeking maximum security, such as top creators and high Robux holders.
Why Enhanced Protection?
Standard 2-step verification (2SV), such as email or authenticator app codes, is a great first step at securing your Roblox account. When an account has enabled a 2SV, Roblox will add an additional challenge during sign-in and when a risky action (e.g., changing a credential, making a group payout) is being attempted on this account. However, this cannot protect your account against attackers who phish for codes used in a standard 2SV. Enhanced Protection moves beyond security codes by mandating phishing-resistant methods (i.e., passkeys, security keys) for sign-in and post sign-in challenge.
What does Enhanced Protection do?
When you enable Enhanced Protection, your account security transitions to a higher standard of security. This changes how your current login & 2SV methods work:
| Method | Change Under Enhanced Protection |
|---|---|
| Passkeys | Passkeys become your primary method for signing into Roblox and solving 2SV challenges |
| Hardware Security Keys | Existing hardware security keys (like Yubikeys) remain active for sign-in and 2SV challenges on supported platforms. New hardware security keys can be registered as passkeys in Settings > Account Info > Login Methods. |
| Email One-Time Passcodes (OTP) | Traditional email OTP are disabled for 2SV challenges. If email OTP is used for sign-in, you will need to solve a passkey or hardware security key challenge. |
| Authenticator Apps Codes | 6-digit codes from apps (like Google Authenticator) are disabled for 2SV challenges |
| Passwords | If passwords are used for sign-in, you will need to solve a passkey or hardware security key challenge. |
Turn on Enhanced Protection
You can turn on Enhanced Protection directly in your account settings.
- Log into your account and navigate to Settings.
- Select the Security tab.
- Locate the Enhanced Protection section to begin the process.
Before turning on Enhanced Protection, you must first:
-
Add at least 1 passkey to your account
- You can use a device-bound passkey or a hardware security key registered
-
Add a verified Email
Then you must also:
- Add a verified phone number OR
- Save backup codes
We require a verified email alongside a phone number or backup code because passkeys can be lost or damaged. When that happens, we want to make sure you can still pass two distinct challenges to securely regain access, in accordance with our new policy. For more information on Enhanced Protection, please visit our Help Center.
Thank you.
FAQs
Why do I need to add a phone number to turn on Enhanced Protection?
-
We do not mandate a verified phone number. To turn on Enhanced Protection, you can choose to add a phone number or save a set of backup codes. We require this to make sure that you have ways to recover your account if you lose your passkeys.
As a reminder, accounts with Enhanced Protection are considered 2SV-enabled accounts that require passkeys (device-bound or hardware security keys) for solving 2SV challenges. Our new security policy requires a user to solve two distinct challenges to recover a 2SV-enabled account.
How do I add additional passkeys to protect my account?
- To add additional passkeys:
- Log into your account and navigate to Settings
- Select the Account Info tab
- Locate Login Methods and click Manage
- Click Add Passkey.
You can add a device-bound passkey or an external hardware security.
