How scam emails, texts, DMs, and fake login pages target children — often via games and 'free' offers — to steal accounts, money, and personal details, and how to spot them.
Phishing & Smishing is scam emails, texts, and messages that trick children into revealing passwords, personal details, or money — often through games, fake prizes, or messages posing as a friend.
Phishing (scam emails and messages) and smishing (scam text messages) try to trick someone into handing over passwords, personal details, or money, or into clicking a malicious link. Children are frequently targeted through the things they use most — games, social media, and messaging — with lures like free in-game currency, 'you've won' prizes, fake account-security warnings, or messages pretending to be from a friend. Because these scams create urgency and excitement, young people can act before they think.
A scammer sends a message designed to look legitimate — a text about a missed delivery, a DM offering free V-Bucks or Robux, an email warning that an account will be closed, or a link to a fake login page that captures the password. Some hijack a friend's account first, so the message appears to come from someone the child trusts. Once a child enters details or grants access, the attacker can steal the account, make purchases, or use it to target the child's friends. Quishing (scam QR codes) and fake giveaways work the same way. The common thread is pressure to act fast and a link or form that shouldn't be trusted.
In your child's behaviour
On their device
Teach the 'stop and check' habit
Agree a simple rule: never click links or enter passwords from an unexpected message, and never hand over codes or payment to 'claim' something. If in doubt, go to the app or site directly rather than via the link, and ask you.
Lock accounts down
Turn on two-step verification (2FA) for games, email, and social accounts, use strong unique passwords (a password manager helps), and make sure recovery details are set — so a stolen password alone isn't enough.
Normalise reporting, not blame
Make clear that anyone can be fooled by a convincing scam, so your child will never be in trouble for telling you. Show them how to report and delete phishing texts (forward to 7726) and messages in-app.
In immediate danger: call 999. For non-emergency police matters, call 101.
Concerned about a child but it's not an emergency? NSPCC helpline 0808 800 5000. Childline for young people 0800 1111.
This is practical educational content to support families. For case-specific concerns about a child's safety, contact the NSPCC helpline on 0808 800 5000 or your local safeguarding team.
Myth: You can always tell a scam text or email because of bad spelling and obvious mistakes.
Fact: NCSC's own guidance on spotting scams is direct about this: it used to be easier to spot scams from bad spelling, grammar, or a design that felt 'off', but scams have got smarter and some now fool even the experts. Teach your child to judge a message by what it is asking for, such as a password, a code, or urgent action, rather than by how polished it looks or reads.
Myth: If a message comes from a friend's account, it must be genuine and safe to act on.
Fact: Action Fraud has warned that criminals routinely take over email and social media accounts and then use them to send scam links and prize offers to the real owner's contacts, because a message from someone you trust is far more likely to be opened and acted on. If a friend's message is out of character, pushes a link, or asks for a code, treat it with the same caution as a message from a stranger and check with them another way before doing anything.
Myth: A padlock icon or 'https' at the start of a web address means the site is genuine and safe to use.
Fact: Get Safe Online explains that the padlock and 'https' only show that the connection to a site is encrypted, not that the site itself is trustworthy or run by whoever it claims to be; a convincing fake login page can display the same padlock as the real one. Teach your child to check the actual web address carefully rather than trusting the padlock alone, and to reach a site by typing it in or using a saved bookmark rather than via a link in a message.
At this age your child is mostly using shared or supervised devices, games consoles, and tablets, so scam contact is most likely to arrive as an in-game pop-up, a chat message, or something sent to an account you manage. Keep control of app store logins and payment details yourself, and set a simple household rule that any 'you've won' message or free reward offer gets shown to you before anything is clicked or entered. Praise them for showing you a suspicious message rather than reacting to it, so asking first becomes automatic.
Your child is likely gaining their own accounts on games, messaging apps, and possibly email around this age, often alongside friends exploring the same platforms. Set up two-step verification together on anything they now manage themselves, and talk through real examples such as 'free Robux' or 'free V-Bucks' offers so they recognise the pattern rather than just that one scam. Make sure they understand that a message from a friend's account can still be a scam if that account has been hijacked.
Teenagers at this age use social media DMs, messaging apps, and email more independently, and are increasingly targeted with fake giveaways, account-security warnings, and QR codes on posters or in messages. Since well-written, convincing scams are now common, encourage them to judge a message by what it is asking for rather than how polished it looks, and to go directly to an app or site rather than clicking a link in a message. Agree that they will tell you if they have entered a password or details anywhere, without fear of getting into trouble.
By this age your young person is likely managing their own bank account, email, and social media with little oversight, and may be targeted with more convincing scams involving jobs, deliveries, HMRC, or bank security warnings. Make sure they use two-step verification and strong unique passwords across their important accounts, and that they know to contact their bank and report to Action Fraud immediately if they have shared a password or made a payment. Remind them that reporting quickly, rather than feeling embarrassed, gives the best chance of limiting any loss.
Was this page helpful?
Get practical child safety updates in your inbox. No spam.