Kid's Roblox or Fortnite Account Hacked? What to Do, Step by Step

Short answer: Secure the email address on the account first, then reset the game password and turn on 2-step verification. If you're locked out, use the official recovery route. Roblox says to contact it within 30 days if items or Robux were lost. Epic says it will tell you the outcome of a recovery request within 48 hours, or let you know if it needs more time.

Last verified 2026-10-01 against the official sources listed with this post.

Your kid opens the game and the password doesn't work. Or the skins are gone, or the friends list is full of strangers. Take a breath. Your kid is going to need you calm more than they need you angry, and the fix is a checklist, not a crisis. Raising Bytes is written by a dad of three who works in cybersecurity, and this is the order we'd do it in.

One exception first. If anyone is threatening your child, demanding money or photos, or asking to meet, stop here and go to our Something happened? page. That's no longer an account problem.

Do this right now

1. Secure the email inbox on the account. Whoever controls that inbox can reset the game password. Change the email password and turn on two-factor authentication (2FA).
2. Check that email account for changes you didn't make. The FTC suggests checking the recovery email and phone number, looking for forwarding rules you didn't set up, and signing out of all devices.
3. Reset the game password to one that isn't used anywhere else.
4. Turn on 2-step verification in the game account (steps below).
5. If you can't get in, use the official recovery route for Roblox or Epic below. Only use roblox.com or epicgames.com, never a "recovery service" someone messages you about.

Roblox: the official steps

Roblox's help page lists these steps, in this order:

1. Clean up the computer. Remove anything downloaded from outside sites and any browser extensions, then run a full virus scan, restart, and scan again. Roblox says malware left behind can let the account be taken again. (Roblox also says it doesn't make any browser extensions.)
2. Reset the password.
3. Turn on 2-Step Verification: Settings → Security.

If the reset doesn't work, contact Roblox Support at roblox.com/support. To help prove the account is yours, Roblox asks you to write from either the first email address added to the account or the billing email used for the very first payment. That still helps if the hacker changed the email. If the account never had an email or a card or PayPal purchase, Roblox says it can still look at other ways to verify ownership.

About lost Robux and items: Roblox says it doesn't guarantee an account will be restored to how it was, or that lost items or currency can be recovered. In very limited cases it may help, but you must contact Roblox within 30 days of the account being compromised. Don't wait until the weekend.

Fortnite (Epic Games): the official steps

For Fortnite, account help comes from Epic Games Player Support.

1. Secure the email first. Epic calls your account email "the key" to the Epic account. If you've lost access to it, contact your email provider to recover it, then secure it with a unique password and 2FA.
2. Reset the Epic password. On Epic's sign-in page, choose Trouble signing in? and enter the account's email. This only works if you still control that email.
3. Try a linked account. If the Epic account is linked to PlayStation, Xbox, Nintendo Switch, Facebook, Google, or another service, try signing in with it. If you get in but the email was changed to one you don't control, Epic says signing in isn't enough. Go to step 4.
4. Submit an account recovery request. Epic says it can only process recovery requests submitted through its official form. Before you start, gather what you can: the Epic account ID or a purchase invoice ID, every email and display name the account has used, the name and country used when it was created, any 2FA phone number, linked console accounts, and the payment methods used. You can skip what you don't have, but once you select Submit, you can't add anything.
5. Watch for the email. Epic sends a confirmation titled "Your Epic account recovery request" with a link to check the status. Epic says it will tell you the outcome within 48 hours, or let you know if it needs more time.
6. Once you're back in: reset the password, turn 2FA back on, and re-link your accounts. If you see linked accounts you don't recognize, Epic asks you to submit a support ticket.

Talk about it, without blame

Ask how it happened, and promise up front that they're not in trouble for telling you. You'll learn more that way. Roblox says the most common way players lose their accounts is sharing their login details directly with someone or filling out online surveys. The usual bait is a "free Robux" or "free V-Bucks" offer:

• Roblox: "Any offer of free Robux, subscriptions, or valuable items is a scam."
• Epic: real offers only appear in the Epic Games Store or on Epic's official websites and social media channels.
• Roblox says its employees will never ask for your password. Epic says it only asks for your password on its official login pages, never by email, message, or third-party site.

Lock it down so it doesn't happen again

Turn on 2-step verification, with an authenticator app.

• Roblox: Settings (the gear icon on the web, or the three dots on mobile) → Security, then turn on the method you want. Roblox recommends the Authenticator App option, and you need a verified email to turn on 2-Step Verification. While you're on that tab, select Generate under recovery codes and save the backup codes where you can find them. Each code works once.
• Plan for recovery. If 2-Step Verification is on and your kid loses their main method, Roblox says they'll need two different verification methods to get back in. Options include a phone number (13 and over), a passkey, or backup codes.
• Epic: go to Password and security in the Epic account, and under Two-Factor Authentication, select Set up. Epic says an authenticator app gives the strongest protection. It also says to turn on 2FA for any linked accounts (Xbox, PlayStation, Nintendo, Facebook, or Google), because those can be used to get in, too. Your kid may care that 2FA is also required to send gifts in Fortnite.

Guard the email behind the game. The FTC explains why: if someone gets into an email account, they can request password resets for your other accounts and lock you out. Use a strong, unique password and 2FA on that inbox. Roblox says the only email on your kid's account should be your kid's own or a parent's.

One password per account. Both companies say not to reuse passwords. Epic suggests a password manager.

Know the gift card scam. The FTC says only scammers will tell you to buy a gift card and give them the numbers off the back: "No matter what they say, that's a scam." Treat anyone in a game or a DM who asks your kid for a gift card code the same way. If it already happened, keep the card and receipt, report it to the gift card company right away, ask for your money back, and report it to the FTC at ReportFraud.ftc.gov.

Two habits worth teaching:

• No screen sharing while logging in. Roblox warns that sharing your screen while logging in can give your login information away.
• No trades outside the game. Roblox says it can't recover items from deals made outside its official systems.

For the settings side, see Roblox parental controls for ages 5–8 and Fortnite voice chat and spending settings under 13. Our free checklist covers Roblox, Fortnite, and your kids' other apps, no login needed.

Guidance, not a guarantee: settings change; check the linked help pages.

Raising Bytes is independent and not affiliated with, endorsed by, or sponsored by Roblox, Epic Games, or any other company mentioned. App names are trademarks of their owners.