To improve security across Roblox, we are updating the account recovery requirements for all users with 2-Step Verification (2SV) enabled. This new recovery policy will be fully enforced by March 2026.
What This Means for 2SV Enabled Users
If you ever lose access to your primary 2SV method (like your authenticator app or security key), you will typically need two different verification methods on your account to complete recovery.
This means that if you lose access to the primary 2SV method and your account does not have two distinct recovery methods on file, you may be unable to regain access.
What You Need to Do Now
Choose one or more of the following backup options to ensure you can recover your account in the future:
Option 1: Add a Phone Number
This ensures you meet the two-method recovery requirement. At recovery, you will need to complete both an email challenge and a phone challenge to successfully regain access to your 2SV-enabled account.
Only available for users aged 13 and over.
Option 2: Add a passkey
Signing in with passkeys, a fast and non-phishable authentication method, will skip the 2SV challenge
Available for all ages
Option 3: Save Backup Codes
These one-time codes let you complete the 2SV challenge even if you lose access to your primary 2SV method.
Available for all ages
You can update your account and recovery methods in Settings:
OK, not a bad update. Security is always good. My only question is if this means we may see trade holding periods reduced in the future.
As i’m sure you’re aware, the entirety of the trading community was incredibly disappointed when you added trade holds, and i’m sure all of us traders would like either a reduction or removal of the holding period system.
Not a bad update actually. 2FA in my opinion is needed more than before so seeing how they’re improving the security of it is nice to have. Also I noticed that 2FA is prompted when doing some actions such as spending robux when location is different, so that’s nice too
Email is only vulnerable if you aren’t making full use of the security features most email providers offer. And presumably, if you have at least 2SV via Security Key enabled there’s a very reasonable assumption the user has also secured their email.
You’re confusing passkeys for security keys. Passkeys make use of your existing device’s security capabilities while security key is a dedicated device for securing an account.
Question 1:
Does the new update mean email verification codes are no longer valid?
Question 2:
So, do we need three methods to log into our account now if we have 2SV?
Password, Email Verification code and a third method (phone, passkey or backup codes)?
Hey folks, we understand that there’s some concern about the possibility of SIM-swapping attacks with phone verification, and we want to emphasize two points:
With 2SV enabled, you will need to present two methods in total to recover your account going forward, so even if phone is one of your two methods, an attacker will NOT be able to recover your 2SV-enabled account through SIM-swapping alone
We encourage the usage of passkeys and/or backup codes if you are not comfortable with phone verification.
Good post. I’ve just recently got my account compromised and I got access to it as of yesterday, now waiting on a rollback request. I’m going to make sure I take extra security measures on my account from this point onwards especially when the likelihood of me accessing my account was influenced by a couple of factors that could have prevented me from accessing my account which was scary.
