Hello everyone,
I am writing this out of sheer desperation and deep frustration regarding a critical failure in the Roblox Support and Account Security support system. My developer account (OfficiallySpooky) has been compromised. While I have the definitive proof required to verify my ownership, I am entirely unable to present it because the Support system traps me in an automated AI rejection loop, closing my tickets within minutes.
To highlight the absurdity of this situation: I am writing and posting this DevForum thread from the compromised account itself, as my DevForum session is still active. That alone should serve as initial proof of my identity, yet I cannot get a human agent to review my case.
The Situation & The Hijack
My account was targeted and hijacked by some bad actors on the 5th of August. I was a victim of a screenshare scam where a user reported that someone was imposing as me trying to sell shares of my game âMount Kenyaâ
Screenshots:
I then contacted the admins of this discord server âDev Hubâ and requested this post get taken down, for which they requested for me to prove that I am the owner of the account I say I am, which to me felt like a common necessity to prove ownership, in the process, this person asked me to turn off my 2FA and turn it back on, and in the process I was very particular on turning off my screenshare when there was anything sensitive on screen, but Iâm sure that they got a glimpse of my 2FA Authenticator QR code and got access that way.
The server has a very sketchy verification bot which asks you to link to your roblox account by asking you to log in and that may have been the way they got access to my password.
But right after the initial screenshare my account was still safe as I immediately created new backup codes and changed my 2FA settings. So the user came back and requested that I provide the validation once more to a superior of his:
And this was the nail in the coffin where as soon as I performed the same process again, as soon as I turned off my 2FA and turned it on they immediately replaced my email with theirs and took over the account and signed me out.
I am perfectly aware that this was a big oversight on my part, and I have taken the time to learn from this experience, so please let this be a learning experience for whoever is reading this.
After changing the password, 2FA information, and email, I was locked out of the account helpless as they took control of my assets and Robux.
However, my original phone number is still linked to the account. Despite this, and despite having my very first historical billing receipts (dating back to 2019), I cannot recover my account because the automated system instantly rejects my tickets for not emailing from the âassociated emailâ, the very email the hackers changed.
The Disconnect Between Appeals and Account Security
In an attempt to permanently terminate my account, the hackers intentionally uploaded NSFW content, which successfully triggered an automated ban.
I appealed this ban, explicitly stating in my ticket that the account had been compromised, that I was locked out, and that the Terms of Service violation was committed by the unauthorised intruder.
- The Good News: A human agent on the Appeals team reviewed the ticket and reduced the ban to a warning, restoring the accountâs standing.
- The Critical Failure: The Appeals agent only addressed the moderation action. They completely ignored the text stating the account was compromised. They did not revert the email, and transferred the case to the customer support team that within minutes auto-rejected the ticket, even after repeatedly asking for a human agent.
As a result, the ban is lifted, but the hackers still have full control of the credentials. They could immediately upload another inappropriate asset and get my account permanently deleted today, and I am powerless to stop it.
The Support Loop (20+ Tickets)
I have opened over 20 support tickets across various categories (Account Hacked, Billing, Appeals) trying to break through the automated filter. Every single time, I receive the exact same templated response:
âUnfortunately, we donât have enough information to verify ownership of this account. Without verification, we are unable to assist further with your request.â
I have the information. I have the original creation email as well as the email when the hijackers changed my email, the payment receipts, and the linked phone number. But the system closes the ticket before a human ever asks for or views my attachments.
The Impact on Developers
I am an active developer, and my experience, Mount Kenya, was on track to regaining popularity. Development has now been completely halted. My developer assets, group funds, and hard work are currently sitting in the hands of malicious actors.
Roblox is failing to provide the bare minimum of support for its player and developer core. I have seen multiple reports across the DevForum and other platforms of developers suffering from this exact same âSupport Bot Loopâ vulnerability. The system is designed to reject victims of account theft precisely when they need human intervention the most.
Request for Help
If any DevRel staff member sees this, or if anyone in the community knows an escalation path or a specific method to force a manual review by the Account Security team, please reply below. I have all the proof necessary; I just need a real person to look at it and recover my account.
