Online Scammers: What Happens to Kids and What to Do About It

An ordinary Tuesday that ended in a hacked account

Thirteen-year-old Jake Bates was playing Fortnite. Another player in the chat said something like: “Want me to give you some rare skins? Just send me your username and password, I’ll set it up.” Jake sent it — it took maybe ten seconds, no pressure, no drama. Five minutes later he couldn’t log into his own account. The other player changed the password, the recovery number, and the phone — not just on the game, but on Jake’s email too, which had his mom’s card linked to it. As a final touch, the scammer killed Jake’s character in-game — apparently just to be cruel.

What matters here: nobody threatened or blackmailed Jake. He was just chatting with a peer (or someone who looked like one) in an ordinary game chat, and did something that, from inside a teenager’s world, looks completely reasonable: helped the person who offered to help him first.

What it looks like from the inside — three scenarios, three different kids

Scenario 1: chasing status
A kid searches for “free Fortnite skins” or “Robux generator.” They land on a site that looks official — sometimes even with a domain like “.gov” or “.org.” The site asks for login details, then a survey, then a “generator” download. What actually happens is either account theft or malware. The kid’s motivation here isn’t naivety — it’s completely understandable social pressure, since in their world status is often literally measured in skins.

Scenario 2: manipulation through sympathy
In a game’s voice chat (this is a real, documented pattern, not an isolated incident), a kid hears from another player: “I had a really bad day, my friends at school won’t let me hang out with them anymore because I don’t have any skins.” This is followed by a direct or indirect hint that a gifted skin would help. It’s the same mechanism that works offline: emotion first, request second.

Scenario 3: panic instead of logic
Here the target isn’t the kid — it’s you. Your phone rings with your own child’s number on the screen. You pick up and hear their voice, panicked, crying: “Mom, I’ve been in an accident” or “I’ve been arrested, please don’t tell Dad.” The voice is indistinguishable from the real one, because modern AI needs just three seconds of genuine audio to clone a voice with up to 85% accuracy — and a clip that short is easy to find in a story or comment on TikTok. What follows is a request for an urgent money transfer or gift cards, often with a fake photo or video “proof,” sent with a timer so you don’t have time to look closely.

Only in 2025, the FBI logged more than 22,000 complaints tied to AI-related fraud, with reported losses of roughly $893 million — the first year the FBI’s annual internet crime report broke out a section specifically for AI.

Mini-glossary: how your kid might describe what happened

Kids rarely say “I got socially engineered.” Here’s what you might actually hear instead — and what it means:

• “He said he’d help me get a skin if I gave him my password” — classic account theft through trust.
• “There was a site, I thought it was the real Roblox” — a phishing site posing as the official one.
• “They said I won a prize, I just had to buy a gift card at the store and send the code” — a gift-card scam.
• “I got a call from your number, and it was definitely your voice” — a voice deepfake.
• “All my skins are gone, and there’s a name in a different alphabet on my account now” — a stolen and resold account (rare skins genuinely get resold on gray markets for $200–800 or more).

Step by step: what to do

Before anything happens:

Come up with a family safe word or phrase — something to say or ask if you get a panicked call demanding money. A scammer using a cloned voice won’t know it, and in a panic it’s much easier for anyone to remember one phrase than to reason through a whole situation logically.
⠀
Set one non-negotiable rule about gaming: never share a login or password with anyone, no matter what’s promised in return. Real companies (Roblox, Epic Games) never ask for a password in chat — that one fact filters out most of these attempts on its own.

If something has already happened:

Don’t panic out loud, and don’t open with “I told you so.” Ask calmly what happened, who reached out first, what they asked for. Save the messages and screenshots — you’ll need them both for reporting to the game’s support team and, if money was involved, for your bank.

If money is gone, contact your bank right away to lock the card. If an account was stolen, contact the platform’s support (Epic Games, Roblox) — both have specific processes for reports involving social engineering. If there was a threatening call or extortion attempt, that’s a matter for the police, not just a family conversation.

How to start the conversation without your kid shutting down

The weak version: “You know there are scammers online, be careful.” It doesn’t land, because it’s too vague and sounds like a lecture.

What works better is entering through their world: “Hey, I saw a story about a scam in Roblox where someone lost their entire inventory in five minutes. Do you know how to turn on two-factor authorization so that doesn’t happen to you?” This works because you’re not restricting anything — you’re protecting something they actually care about: their progress, not an abstract idea of safety.

Watch for signals even without a direct conversation: your kid suddenly has a bunch of rare items you definitely didn’t buy — worth asking where they came from. They seem unusually upset after a gaming session — maybe they got scammed, or someone’s being cruel to them in a private chat. They mention a “friend” from the game who turns out to be an adult — that’s its own separate conversation, no longer about scams specifically.

The one thing to take from this lesson

To a kid, a scam rarely looks like danger — it looks like ordinary interaction in a game, where someone is offering help, sympathy, or generosity. That’s exactly why “be careful with strangers” doesn’t work here. In this picture, the stranger looks like an ally. What actually works is one concrete rule (“we never give out our password”) and your kid’s certainty that if they do get caught out, home is where they’ll get help, not shame.