Wednesday, December 28, 2022

Inside Roblox’s Criminal Underworld, Where Kids Are Scamming Kids

In the depths of the Roblox criminal Discord network, a scammer from across the void shows me his best score. A screenshot materializes in the chat — it contains the uncensored username, password, and IP address of a Roblox account that was allegedly captured in his snare. There were 467,985 Robux in the target's wallet at the time of the hack, equivalent to about $5,850.

"I scripted something called a pin cracker. I run it, crack their pin, and it auto-unverifies their email," says the scammer, when I ask how they prevent their victims from reclaiming their Roblox identity. "They get logged off, and I change everything."

Could it really be that simple? I didn't know what to believe. The panels of these Discord servers bloom with illicit content — almost like the Anarchist's Cookbook for Roblox hoodlums. A marketplace zooms by in one of the sub-channels where swindlers offload troves of plundered goods; Roblox accounts and items, sure, but also instructions on how to steal those assets in the first place.

There is a forum titled, "Flex Your Beams," the term "beam" being shorthand for "scam" in Roblox parlance. It's filled to the brim with screenshots like the one I just saw; an ocean of exposed authentication details. Sometimes, a user posts a clip that documents the entirety of their operation. "Beaming 25k, ezzz," reads the title of one unlisted YouTube video from November. The author breaks into a mark's Roblox profile and trolls them in the DMs. ("Did you just try scam me keeps saying giving item to u," writes the victim. "Get beamed," they respond.)

I scripted something called a pin cracker. I run it, crack their pin, and it auto-unverifies their email.

The hacker I'm speaking to shows me a few more of his scores; a bounty of high-value Roblox cosmetics that could fetch a pretty penny, as well as a Visa credit card to boot. They say they generates about €2,000 a week, but considers his beaming career a "hobby," rather than a full-time job. I had never played Roblox before writing this report, and I traditionally understood the game to be a diversion for elementary-aged kids; training wheels before they graduated to Minecraft or Call of Duty. To be confronted with a multifaceted racketeering affair — one that borders on organized crime — forced me to reconsider my preconceptions. I had to ask: How old was this guy?

"13, heh," he wrote.

Now I knew I was being trolled — 13-year olds aren't complicit in this degree of professional fraud. One of the first things you learn as a games journalist is to not take a seedy Discord channel at face value. Surely I was being worked. And yet, the presence beyond the screen did agree to jump on a voice call to confirm his claim. As soon as we connected, a distinct, pre-pubescent voice crackled out of my phone.

"I spend the money on my friends and stuff. I buy something from Amazon for my room, stuff like that," he says. "My parents don't know. They ask where I get the money for everything. I just make excuses and they believe me."

After I hung up, the hacker told me he recently purchased a gaming PC complete with a GeForce RTX 3090 graphics card. It cost €2,600. I expected him to be guarded about all of these transgressions, but at the end of our conversation he asked me to link out to his Discord name, so he could "get more buyers." Clearly I had crossed over into the dark side of Roblox.

The future is Roblox

Roblox was released in 2006 as a free-to-play sandbox for its 164 million active users. The platform offers its users the tools to create their own video games within the overarching Roblox universe, as well as the ability to earn revenue from their creations. As Roblox became more popular, developers generated increasingly elaborate projects. Today, the service is home to first-person shooters, management simulators, and a bevy of loose, social spaces that serve the same purpose as Club Penguin for kids of an older generation. In fact, you could make the argument that Roblox, in its current form, is the most prominent "metaverse" available on the internet.

"Kids are using Roblox to socialize. You can see it had massive growth during the pandemic. It's a place to hang out, just like that Facebookian metaverse we're being promised," says Quintin Smith, a longtime games journalist who published two robust investigations into Roblox's underbelly with his company, People Make Games. "You can look at Roblox and say, 'Yes, this is the future.'"

As Smith dug into Roblox, it became increasingly clear that a cutthroat financial system coursed through this ascendent metaverse — incentivizing some questionable baronial instincts within a video game that is primarily enjoyed by children. Smith was particularly taken aback by the stock market-like system that powers Roblox's catalog of limited items, which is a heady topic I'll attempt to explain as succinctly as possible. Essentially, Roblox hosts a storefront that sells cosmetic items that are only stocked in a finite supply. Those items are sold until Roblox HQ removes them from store shelves, after which they can only change hands by reselling them to other users for Robux or other cosmetics, potentially adding up to a profit. There are entire websites that track the fluctuating values of various cosmetics in the game, allowing any enterprising shark to speculate on the ebbs and flows of the exchange.

Of course, Roblox takes a 30 percent fee off the top of all limiteds sold for Robux between users on Roblox's official channels, and the only way to convert Robux into real money is through a function called "Devex" — which allows Roblox game developers to convert the virtual currency they earn from their games into dollars and cents at a fixed rate. (Limiteds exchanged for other limiteds are not subject to that tax.) So, if you're not a Roblox developer but still want to turn your Robux into dollars and cents, you're out of luck… unless you know where to look. All of this red tape has given rise to a black market for those who wish to eschew the house rules and cash out more efficiently.

The Roblox black market takes many different forms. You can go to a website, like ro.place, which offers a slew of limiteds anyone can purchase with USD. There are those who work as middlemen in Discord servers; they facilitate trades made with real money in order to ensure that the partners in a deal don't scam each other. You can even head over to Ebay, where there are always auctions on tap for all sorts of rarefied cosmetics. The actors in this underworld often see themselves as the good guys. After all, if Roblox is responsible for this expansive universe of goods and services, why shouldn't its participants be allowed to reap the rewards?

I won't BS you and say [I started my business] solely for [being] the solution.

"We bring the buyers to the sellers, and sellers to the buyers. The sellers source these [limited] items from private sellers, normally they are Roblox users that are unable to cashout through a traditional system by Roblox such as Devex. The sellers then list their items on the website and kids will come and buy. The site earns a small commission per sale," says the owner of ro.place, who adds that his business is a "solution to an issue caused by Roblox."

"Also I won't lie, the profits are appealing," he continues. "I won't BS you and say [I started my business] solely for [being] the solution."

Therein lies the central paradox of Roblox. The game incentivizes users to use its platform as a way to generate revenue, but the restrictions on actually accessing that revenue has caused some of the commerce to move underground. If you've spent any amount of time playing multiplayer games, you already know that the shady third-parties who trade cosmetics are often riddled with scammers. Naturally, Roblox Corporation outlaws any transactions that happen away from their channels, and warns its users not to engage with buyers and sellers the company can't monitor.

People come to Roblox to express themselves creatively and connect with friends. These interactions, experiences, and items are precious to them, which is why we’ve built tools to protect accounts from malicious actors. These features include two-factor authentication for all users, educational materials for best practices, escrow on catalog and in-experience purchases, and security banners about suspicious activity on an account," reads a statement issued by a Roblox spokesperson to IGN. "We also aggressively deter moving activity off Roblox because we cannot control activity on other applications, which rarely have comparable safety policies, account restrictions, parental controls, and other protections. For example, users cannot exchange in-game virtual currency for real-world currency on Roblox outside of our developer exchange program and we specifically ban the use of third-party trading sites. We constantly monitor our platform to ensure that our users have a safe experience and will take appropriate action to address any issues that could have an impact on safety, and offer one-time recovery of any inventory lost.

All of those failsafes are in place, but given the way Roblox's finances are structured, is anyone surprised that offsite trading continues to be a force in the game's economy?

I'd love to say that the hacker I spoke to at the beginning of this story was an outlier. That the other underworld dwellers better fit the image you and I have of the typical cybercriminal — someone who understands the ramifications of their actions, or at the very least, is of legal age. But minutes after the conclusion of our interview, I spoke to another swindler active on the beaming servers who claimed to be 13. Over text, he provided a holistic overview of his operation. It's a basic phishing scheme, explains the hacker. He enters popular Roblox games and targets those who seem to be wearing expensive limited items; or he trawls through Discord channels in order to "trick mainly younger people, who don't understand much."

"We can convince them to do whatever. Like click the link and enter their info," says the hacker. "You just have to be good with your words."

The hacker sent over some of his alleged receipts. In one of his more high-profile deceptions, he managed to pry two rare limiteds, worth about $11,000, from a victim. The hacker claims that he and his "partner" make "around 10k a week." But in order to keep his criminal ring up and running, the hacker relies on another tendril of the Roblox underworld. There is a site called RBXFlip which advertises itself as "The Original Roblox Casino." It's a simple design: Two players enter and put their pricey limited items on the line, an algorithm behind the scenes flips a coin, and whoever wins keeps the bets. I had heard that RBXFlip had a strong association with the beamers of the Roblox community, and this hacker added more context to those claims. He told me that he has to "clean" his stolen limiteds and remove any evidence of their origin in order to "prevent account termination." The best way to do that? RBXFlip. When you gamble on the site, the items you are wagering with are briefly moved to a bot, before being redirected to the winner. The hacker claims that the process removes any ability for the victims to track down their goods.

"The original owner wouldn't be able to get them back once they go through RBXFlip," he says. "[It's] a sort of laundering." (After winning a bet, the hacker says he fences the items over PayPal in other Discord servers.)

I was unable to get in contact with the core owners of RBXFlip, but one of the moderators on the site's staff did respond to my Discord messages. He pushes back on the hacker's claims, saying that there's "no need" for someone to use a gambling site to launder stolen limiteds, but the moderator was otherwise brazen about any other security concerns. Can RBXFlip do anything to prevent underaged kids from using the site to gamble?

"We have no way to enforce [our] 18+ rule," he says.

Is he at all worried about kids potentially losing a lot of money on a gambling service oriented around a game for elementary-aged youths?

"I'm not a girl, why worry about something out of my control."

In fact, the moderator had no qualms about any of the problems that have come to be associated with Roblox. It was like we were speaking different languages. He, and so many others, have been playing a very different version of this video game for a very long time.

“The Roblox black market turns poor kids wealthy," he says. "For all I'm concerned, it's a blessing for people who aren't doing the best in life."

"I rushed through the door to find her sobbing"

As always, it's important to remember that the victims of these scams are often young and uniquely vulnerable to bad actors on the internet. Kristen Dagg watched her daughter "Alice" save up all of the money she received for her 11th birthday, about 240 AUD, so she could spend it all on Roblox cosmetics. (Dagg asked us to use a pseudonym for her daughter.) Alice bought some brand-new character faces, and decided to trade some of her other items to raise extra funds to afford more accessories.

"She agreed on a trade and was tricked into clicking on a link which enabled the scammer to access all of her inventory. He wiped her out of her valuable items," remembers Dagg. "I got a call, as I wasn't home, and she couldn't speak. My partner was home with her and I could hear him furiously typing in the background, trying to help. I rushed through the door to find her sobbing, white as a ghost and having a full blown panic attack."

Alice tells me that she "didn't even know" she needed to trust whoever scammed her. "I thought I knew what I was doing and it was going to be okay," she said. "I didn't know this scam existed."

Dagg mentions that Alice's relationship with the game has never been the same. The crime made her daughter far more vigilant on Roblox. "It's kind of like a person who has committed a petty crime going to jail for the first time, and once they get in there they trust too many people and get messed up," she says. "So they learn the ways of survival and become part of the necessarily brutal environment. It's a dog eat dog world, and now, half a year on, my daughter is queen of the prison yard."

Roblox, to reiterate, is one of the largest sources of children's entertainment in the world. Forty-three million players log into it everyday, and countless kids rely on the servers to keep them connected with their friends during the dog days of the pandemic. So it's strange to hear a parent compare the game to a prison yard. After talking to the flippers, gamblers, and hustlers of the Roblox underworld, I do wonder if Roblox Corporation understands the responsibility that comes when your player base is composed of innocents.

"On a purely emotional level I feel extraordinarily disturbed that the largest producer of children's entertainment in the world today has such a financial backbone," says Smith. "For some reason, I keep going back to thinking about Sesame Street. When Sesame Street was created, it was, in part, to sell children on concepts like the alphabet. There have been at least periods in human history where the people who were making the most expensive and forward-thinking children's entertainment were doing it for the betterment of children."

They learn the ways of survival and become part of the necessarily brutal environment

This isn't a problem that's unique to Roblox. Games have been nudging their way towards total financialization for a long time. Counter-Strike has left a massive network of weapon-skin bartering in its wake, and there's a whole cottage industry built around Fortnite V-Bucks scams. It makes you wonder if Roblox's issues are about to metastasize into countless more development studios. It was not that long ago that the prime directive in the games business was to deliver products that generate fun, rather than to monitor a ferocious laissez-faire economy.

It's a thought that brings to mind an exchange I had with the owner of the ro.place. At the tail end of our conversation, they told me that they essentially grew up on Roblox. Endless afternoons were spent mastering the breezy games available on the platform, long before it morphed into the juggernaut it is today. But around 2015, something changed. The owner felt less inclined to play Roblox, and more inclined to use it as leverage for a new hustle.

"[Roblox Corporation] started promoting the professional production of Roblox games, and since those games cost a lot of money to make, devs would be inclined to turn them into cash grabs," he says. "Perhaps I realized I could make consistent money, but to me, the games were not as fun anymore. This new age of Roblox users are all used to these games, so they never experienced what fun truly was."

This is the reality that faces Roblox Corporation, and any publisher who is cooking up a decentralized, microtransaction-laden parallel universe. They all know the risk factors: They are witness to the scams, the swindles, and the racketeering, all adding up to a robust criminal underworld that thrives outside of their limited jurisdiction. Roblox needs to reign in these contingencies, because video games should never make anyone grow up too fast.

Luke Winkie is a freelance writer for IGN.

at

No comments:

Post a Comment

Subscribe to: Post Comments (Atom)

Nexon's Medieval Fantasy Brawler Warhaven Shutting Down 6 Months After Launching in Early Access

Nexon's medieval fantasy brawler Warhaven is shutting down on April 5, 2024, just six months after it launched on Steam in Early Access...