When i was contacting Roblox Support, i was asked to create a new case/ticket using a different email address because they somehow were unable to verify my account ownership even though that the email i am contacting them from is the verified email address of my Roblox account for over 2 years.
The email address they asked me to contact them from (after Support giving me a hint) is invaild, at the original account creation of this account which is 2018, the email address inputed was a spelling mistake of outlook, “outook” is the email domain Support requested me to contact them from, “outook” is a domain for sale, meaning it isn’t even a email provider and as-well was never verified for my account.
This is a security issue because if they ask users to contact them from emails that don’t exist or the account owner doesn’t own anymore (because it was hacked or such) then if the attacker knows the full email that Supports wants them to reply with, the attacker can create a new email address for that or request to “gain back access” to such account to the email provider and since Support uses outdated information, the attacker can password-reset the user or such after contacting Support.
My current account email has been added to my account for over 2 years and is verified, i even asked Support for them to re-check my account email but they keep requesting me to contact them from the original unverified email for my account.
If i send a password reset link to my current roblox account email address, my account will appear there:
How would they not be able to verify account ownership if my account appears there?
This also occurs to other users, not just me; here’s another user that has submitted a bug report for an issue like this, it was marked as “Closed” but wasn’t fixed: Roblox Support does not use the latest account records .
Screenshots of Roblox Support requesting me to contact them from such email address that i never owned:
Expected behavior
Roblox Support should use the latest verified account email address/latest account records when verifying that an account belongs to somebody.
A private message is associated with this bug report