Your Kid Just Got Scammed. You Probably Don't Know Yet.

35% of kids active online encounter scam attempts — through games, social media, and fake giveaways. Here's exactly how scammers target children and what to do.

My son came downstairs last Thursday holding his iPad like it was evidence at a crime scene. He'd clicked a link in Roblox chat from someone claiming to be a moderator who needed to "verify his account" or it would be permanently deleted. He'd entered his username and password on a page that looked exactly like the Roblox login screen. By the time he told me, someone had already drained 4,300 Robux from his account and changed the email address.

He's eleven. He builds obstacle courses in Roblox Studio. He knows not to talk to strangers. And he still fell for it, because the scam wasn't designed for an adult who'd recognize a phishing page. It was designed for an eleven-year-old who panicked at the thought of losing two years of builds.

That's the part most parents miss. We teach "stranger danger" and assume it translates. It doesn't. The scams going after kids right now are engineered specifically for the way children think — they exploit panic, social proof, FOMO, and the desperate desire to be chosen by someone famous.

The Numbers Are Worse Than You Think

The FBI's Internet Crime Complaint Center logged 17,993 complaints from victims under 20 in 2024, totaling $22.5 million in losses (FBI IC3 2024 Annual Report). That number is almost certainly a fraction of the real damage, because most kids don't report scams to their parents, let alone to a federal agency. My son sat on his Roblox incident for two days before I noticed the login email change.

Nir Kalron, the cybersecurity researcher who founded the child safety platform Kidas, puts the exposure rate at 35% — more than a third of kids who are active online encounter scam attempts, primarily through gaming platforms (KTAL News, 2025). That's a comparable vulnerability rate to elderly adults, the group we already recognize as the most targeted demographic.

And the attack surface is expanding. Kaspersky's research team tracked over 19 million attempts to download malicious files disguised as popular children's games between April 2024 and March 2025. Attacks targeting young gamers surged 30% in the first half of 2024 compared to the previous six months. The four most-exploited titles: Minecraft, Roblox, Among Us, and Brawl Stars (Kaspersky, 2024–2025).

How the Scams Actually Work

I want to be specific here, because vague warnings like "be careful online" accomplish nothing. These are the five most common vectors hitting kids right now, based on incident reports and security research from the past twelve months.

The fake moderator message. Someone messages your child in a game chat or on Discord claiming to be from Roblox, Fortnite, or Minecraft's moderation team. The message says the account has been flagged — for cheating, for inappropriate language, for a terms of service violation — and provides a link to "appeal" or "verify." The linked page is a pixel-perfect clone of the real login. Once credentials are entered, the attacker takes over the account, locks out the original owner, and either sells the account or strips its inventory. Roblox's own developer forum documented a wave of these using spoofed "Security Alert" emails that replicated the platform's password reset screen, complete with the child's avatar (Malwaretips, 2026).

The free currency generator. Search "free Robux" or "free V-Bucks" and you'll find hundreds of sites promising unlimited in-game currency. Every single one is either a credential harvester, a malware installer, or an ad-fraud click loop. Some are all three. They're promoted through YouTube videos, TikTok clips, and in-game chat. The pitch is simple: enter your username, complete a "human verification" survey, and receive your currency. The surveys collect personal data. The downloads install adware or worse. The currency never arrives.

The fake giveaway. A social media account impersonating a popular YouTuber or streamer announces a Roblox gift card giveaway, a PS5 contest, or a "subscriber milestone reward." To enter, children are told to click a link, follow specific accounts, share the post, and provide their email or gaming credentials. The links lead to phishing pages or data collection forms. In 2025, scammers increasingly used hacked accounts of real small creators to run these — which means the giveaway posts appeared to come from legitimate, verified accounts kids already followed.

The trading scam. In games with item trading (Roblox, CS2, Rocket League), a scammer offers an extraordinary deal on a rare item, then switches the trade at the last second, uses a middleman scam to intercept inventory, or convinces the child to drop items "to prove they're real" before completing the trade. A variation: the scammer says they need to "check the item is not duped" and asks the child to log into a third-party site — which is, of course, a credential phisher.

The influencer impersonation. Someone contacts your child claiming to be a YouTuber, streamer, or esports recruiter. They say they want to play together, feature the child in a video, or recruit them for a team. The relationship builds over days. Eventually, the scammer asks for an account password ("to add you to our private server"), gift card codes ("just to verify you're serious"), or personal information. Kalron's research found that impersonating YouTubers and gamers is one of the most effective tactics because children desperately want to be noticed by creators they admire.

Why Kids Fall for It When Adults Wouldn't

I keep coming back to why my son — who is not a careless kid — typed his real password into a fake page. Part of it is developmental. The prefrontal cortex, which handles risk assessment and impulse regulation, isn't fully developed until the mid-twenties. When a message says "your account will be deleted in 24 hours," an eleven-year-old processes that as an emergency, not a red flag.

But there's something else. Kids trust platforms the way we trust institutions. My son believed a message claiming to come from Roblox moderation because he'd never had reason to doubt that Roblox moderation was real and working. The concept that someone could impersonate a platform authority inside the platform itself — that the system could be used against him — hadn't occurred to him. He's in fifth grade. Why would it?

A Bankrate survey from March 2026 found that Gen Z individuals lost money at the highest rate (53%) when scammed. The Pew Research Center reports that roughly three-quarters of adults under 30 have experienced an online scam or attack. These numbers don't improve at younger ages. They get worse.

And then there's the shame factor. Kids don't tell their parents they got scammed because they think they'll be punished — the device taken away, the game banned, the independence revoked. So the scam goes unreported, the compromised account stays compromised, and the child doesn't learn what happened or how to recognize it next time. My son waited two days. Some kids never say anything at all.

What Actually Works

I'm going to be honest: I had a parental control app running on his iPad when this happened. It didn't help. The phishing page loaded inside the Roblox app's web view, which the control software treated as part of Roblox — an approved app. Content filters catch pornography and violence. They don't catch a login page with the wrong URL.

So what does work?

Run the scam by them before the scammers do. Sit down with your kid and show them a fake Robux generator site. Let them see the "complete a survey" loop. Show them what a spoofed URL looks like. My son can now spot a typosquat domain (r0blox.com, roblox-login.net) faster than I can, because he has a personal reason to care. Abstract warnings don't stick. Concrete examples do.

Establish a no-penalty reporting rule. Tell your kid, explicitly and more than once: if something weird happens online — you clicked something, you gave out your password, someone asked you for information — you can tell me and I will not take your device away. I will not ban the game. We will fix it together. If the cost of reporting is losing access, kids will choose silence every time. Every. Single. Time.

Turn on two-factor authentication on every gaming account. Roblox, Epic Games, Steam, Minecraft (Microsoft account), Discord — all support 2FA. Even if credentials are stolen, the attacker can't log in without the second factor. My son's account could have been saved by a six-digit code on my phone. It took me four minutes to set up after the fact. I should have done it on day one.

Teach the "pause and ask" reflex. Any message that says you need to act immediately — your account is flagged, this offer expires in ten minutes, click now or lose everything — is a message designed to prevent thinking. The single most effective anti-scam skill for any age: when something feels urgent, stop. Close the message. Go find a parent or another adult. Legitimate platforms don't delete accounts without warning. Legitimate giveaways don't expire in five minutes.

Check their email. If your child has a gaming account, they have an email address attached to it. That inbox is where account takeover attempts show up. Look at it. Once a week. Not to spy — to catch the password reset email that your kid didn't request.

The Conversation Most Parents Aren't Having

We talk to kids about predators. We talk about cyberbullying. We talk about screen time. We almost never talk about fraud. The word "scam" barely appears in digital citizenship curricula. Common Sense Media's lesson library has extensive units on privacy and reputation. It has almost nothing specifically about recognizing and responding to financial and credential fraud targeting children.

The LA County government figured this out. In February 2026, they filed the first lawsuit by a California governmental entity against Roblox, alleging the platform fails to protect children from predatory behavior — and they specifically cited the platform's inadequate protections against scam activity, not just sexual exploitation (LA County, Feb 2026). With 75% of U.S. children ages 9 to 12 playing Roblox regularly and over 40% of the platform's 380 million monthly users under 13, the exposure is staggering.

Meanwhile, the FTC reported in April 2026 that social media scam losses hit $2.1 billion in 2025 — eight times higher than 2020 (FTC, April 2026). The 18–29 age group is the most heavily targeted on social media. The under-18 group isn't even tracked separately in most federal data sets, which means we're flying blind on the actual scale of child-targeted fraud.

My son got his Roblox account back, eventually. It took a support ticket, a parent ID verification, and eleven days. He still logs in. He still builds obstacle courses. But now, when someone messages him claiming to be a moderator, he screenshots it and shows me instead of clicking the link.

That's the shift. Not fear of the internet. Not avoidance. Just the reflex to pause and verify before acting on urgency he didn't create.

It cost him 4,300 Robux to learn it. I'd rather it hadn't, but at least the lesson was Robux and not something worse.

Sources referenced in this article: