Read this before you buy anything

If an account has a verified email with billing attached, and you won't be getting every billing email plus the original verification email, don't buy it. I know that sounds blunt, but there's no version of this where securing it afterwards saves you.

Billing emails are proof of purchase, and proof of purchase decides who owns an account. They sit in someone else's inbox. Nothing you change from the inside touches them.

There's a real exception though. If the account was verified years after it was made and has no billing on it, or you're getting all the billing emails yourself, you're fine. The issue was never that an email exists – it's who's holding it.

Before you buy

Do both of these yourself, inside the account. Seller screenshots are easy to crop or fake, and these two checks decide whether the rest of this even matters.

1. Check the email

Open the settings and look at the phone number and email fields.

• Add mail – the field says "none," or there's red text telling you to add mail. Nothing is attached, no recovery route exists outside the account. This is what you're hoping for.
• Pending mail – an address was entered but never confirmed. It's easy to think unverified means harmless. It doesn't. A pending mail can still pull the account back, so treat it exactly like a verified one.
• Verified mail – confirmed, and sitting in someone else's inbox. Unless that inbox comes with the sale, walk away.

Ask the seller which of the three it is, then go and check it yourself before any money moves.

2. Check for billing

Go to My Transactions and open the Type of Transaction dropdown.

• Currency Purchases. Anything listed here means Robux has been bought on the account, and whoever bought it has the receipt. The account in the screenshot above clearly has billing.
• Premium Stipends – check this separately. Premium purchases don't show up under currency purchases at all, so an account can look completely clean while still having a payment history behind it. If it's ever had Premium, someone has bought Robux on it.
• Gift cards. These also appear in the currency list, and gift card billing can't be used to pull an account. So an entry here isn't automatically a dealbreaker. If the seller says it was gift cards, there should be a matching gift card item in the inventory from that same month. Go and look – the inventory either backs up their story or it doesn't.
  
  
  

Securing it

Four steps, one sitting, in this order. The gap between getting the credentials and finishing this list is the only window where the account is still at risk from the person you bought it from. They've got the password, and they might still have a session open.

1. Add your own email

• Have the address ready beforehand. Make a fresh Outlook mail before the handover rather than scrambling for one while the clock is running. If the account comes with its original email, use that instead – an OGE is worth more, both for security and if you ever resell.
• Don't use your main email. Two reasons. If you resell later, the email should go with the account, and you can't hand over the inbox you use for everything. And keeping them separate limits the damage if either one ever gets compromised.
• Pick an address with no Roblox history. Old associations can cause conflicts during recovery down the line.
• Change the password once the email is on. You should get a revert link at the new address. That link showing up confirms the email is properly attached and that notifications are reaching you. If it doesn't arrive, stop and figure out why before you go any further.
  
  
  
  

2. Remove every passkey

Get rid of every passkey on the account that you didn't add yourself.

• This is the one people skip, and skipping it quietly undoes everything else on the list.
• A passkey doesn't depend on the password. Changing the password won't remove it, won't disable it, and won't tell you it's there. If the previous holder set one up on their phone, they still have full access after everything else you've done.
• Do this before adding your own, so you can clearly see which ones were already there.
  
  
  
  

3. Turn on 2FA and replace the backup codes

Both live in the Security section of settings.

• Use an authenticator app. Roblox recommends it over email or security keys, and it makes sense – codes are generated on your own device instead of landing in an inbox, so someone would need your phone rather than just your email password.
• Generate new backup codes, even if 2FA was already on. If codes were ever created, the previous holder might still have a copy saved, and backup codes get you in even with 2FA enabled. A fresh set cancels every old one.
• Save them properly. Roblox shows them once. Worth knowing: Roblox needs two separate verification methods on the account before it'll restore access if you lose your primary one. Your backup codes are usually that second method.
  
  
  
  

4. Add your own passkey

• Same Security section. Use a phone – the process is noticeably easier than on desktop.
• This is the strongest layer you can add. A passkey checks the domain before it responds, so it simply won't authenticate on a fake login page the way a typed code would.
  
  
  

Why the order matters

Each step leans on the one before it.

1. Email first, because Roblox needs a verified address before it'll let you turn on 2FA, and because recovery runs through it.
2. Passkeys second, because a leftover passkey skips the password entirely. Leave it until later and the previous holder still has full access to an account you think you've already locked down.
3. 2FA and fresh backup codes third, built on an email that's now yours.
4. Your own passkey last, on a foundation that's already clean.

Swap any two of these and you leave a gap open.

Do the checks before you pay, do the four steps in one sitting after, and the account is genuinely yours. Most accounts that get lost after a sale are lost in the hours where this list was still half-finished.

Sources

This guide draws on the community thread HOW TO SECURE A ROBLOX ACCOUNT on OGUser, alongside Roblox's official security documentation:

• Keep Your Account Safe – Roblox Support
• Add 2-Step Verification to Your Account – Roblox Support
• My account was hacked – What do I do? – Roblox Support