You Can't Sell a not.bot: Why Account-Based Age Verification Always Fails
In January 2026, Roblox rolled out mandatory age verification. The system requires facial scans or government ID to prove users are who they say they are. It was designed to protect children in one of the world's largest gaming platforms, where over half of users are under 16.
Within days, age-verified Roblox accounts appeared on eBay. Prices ranged from $2.99 to $19.99.
For less than the cost of a fast food meal, anyone could buy a pre-verified account and sign in without any identification or facial scan. The verification was already done. The buyer just inherited it.
The Account Problem
This isn't a bug in Roblox's implementation. It's a fundamental flaw in how account-based verification works.
When you verify an account, the verification attaches to the account -- not to the person. The account becomes a bearer token: whoever holds it gets the privileges. Transfer the account, and you transfer the verification.
Roblox isn't alone in this. Every platform that ties verification to an account faces the same structural weakness. Dating apps verify profiles that get sold. Social media platforms verify accounts that get traded. Financial services verify users who share credentials.
The pattern is always the same: verify once, transfer forever.
Why This Is Dangerous
In most contexts, account selling is a nuisance -- someone gets a pre-aged gaming account or a pre-verified social profile. Annoying, but not catastrophic.
In the context of child safety, it's something else entirely.
Roblox's age verification was specifically designed to create safe spaces for children. Verified minor accounts can access child-only chat features and social spaces. The entire point was to ensure that the people in those spaces are actually children interacting with other children.
When a pre-verified minor account is sold for $2.99 on eBay, a predator can buy it. They sign in without any identification. The system sees a verified minor account and grants access to child-only spaces.
The verification system designed to protect children becomes the tool that gives predators access to them.
Roblox's system was also fooled by 3D animated avatars and "old people makeup" -- users found creative ways to manipulate the facial scan itself. But the account selling problem is more fundamental because it doesn't require any technical sophistication. Just a credit card and an eBay account.
The Numbers
Roblox reported that 45% of users had completed age verification. That means 55% are potentially locked out of verified features -- creating pressure to find workarounds. Some will verify legitimately. Others will buy accounts.
After Wired reported on the eBay listings, the marketplace removed them. But the incentive structure hasn't changed. Where there's demand and easy supply, markets form. If not eBay, then Discord servers, Reddit threads, or dedicated forums.
The market will continue because the fundamental economic equation remains: verified accounts have value, and verification can be transferred by transferring the account.
The Verification-to-the-Person Alternative
The fix isn't better account security, though that helps. The fix is changing what gets verified.
When verification attaches to a person rather than an account, selling the account doesn't transfer the verification. The buyer gets the account, but not the proof of identity. When the platform checks "is this person verified?" the answer is no, because the original person's verification stayed with them.
This is how not.bot works. Cryptographic verification ties to the individual through privacy-preserving cryptography. You can prove you're a real human, prove your age range, or prove any other verified attribute -- and that proof stays with you. It doesn't live in the account.
If Roblox used person-based verification:
- A predator could buy a pre-verified account for $2.99
- They'd sign in and see all the account's content and settings
- But when the system checks their identity verification? Nothing. The verification went with the original owner
- Access to age-restricted spaces would require the buyer to verify themselves -- which a predator trying to access child spaces would fail
You can sell an account. You can't sell a not.bot.
Beyond Gaming
This isn't just a Roblox problem. It's a structural issue for every platform that gates access based on account-level verification.
Dating apps verify user identities and display badges. Verified accounts are already being sold, giving catfishers and scammers a "verified" badge they never earned.
Social media platforms verify creator accounts. Account trading markets sell these verified profiles to anyone willing to pay.
Financial platforms verify users for KYC compliance. Account selling creates money laundering vectors.
Any platform that says "this account is verified" faces the same fundamental problem: the account is not the person.
The Design Principle
The lesson from Roblox is simple but important: verification has to answer the right question.
"Is this account verified?" is the wrong question. Accounts are transferable objects. Verifying them creates transferable trust, which defeats the purpose of verification.
"Is this person verified?" is the right question. People can't be transferred. Tying verification to the individual through cryptographic proof means the trust goes where the person goes -- and stays where the person stays.
The Roblox account sellers on eBay didn't break anything. They just revealed what was always true: if verification lives in the account, verification is for sale.
Not.bot puts verification where it belongs -- with the person. And you can't put a person on eBay for $2.99.
Sources: Fast Company, Daily Dot, Dexerto, Wired, Geeks+Gamers coverage of Roblox age verification and account selling, January 2026.