How do I protect my child from grooming, scams and online exploitation?

Online exploitation does not always begin with a threat. It may begin with somebody who notices the child's interest, offers a rare item, gives intense attention, promises work, understands a difficult day or appears to be the same age.

Protection is stronger when a child can recognise how a conversation changes. “Never talk to strangers” is too broad for gaming, selling, group interests and social media, and too narrow when the harmful person is already known.

Teach the movement from contact to control

Grooming is a process in which an adult builds a relationship with a child online in order to harm or take advantage of them. CEOP Education notes that the person may send sexual material, ask the child to do something uncomfortable or seek an in-person meeting for sexual abuse.¹

Scams and other exploitation may use different goals, including money, account access, personal details, criminal activity or control over the child. The routes overlap when trust is used to create pressure.

Teach the child to notice when a person:

• becomes intensely friendly or flattering within a short time;
• claims that nobody else understands them;
• offers gifts, game currency, paid work, followers or special access;
• asks them to keep the relationship, gift or task secret;
• moves contact into a private or encrypted service;
• requests location, passwords, codes, documents or bank details;
• asks for an image, livestream, sexual act or meeting;
• starts with a small favour and increases the requests;
• creates urgency or says an offer will disappear;
• claims the child now owes them;
• threatens to share information or images; or
• asks the child to receive, move or withdraw money for somebody else.

One feature does not prove grooming or fraud. The pattern tells the child to pause and seek a second view before the next step.

The NCA and NPCC identify discoverability, unknown-adult contact and movement into private messaging as features that can enable criminals to reach and isolate children.²

Use a response the child can remember

Agree three words:

1. Pause: do not send more money, information, images or replies.
2. Preserve: keep the username, link and key messages or screenshots where safe.
3. Tell: contact a named adult even if a rule has already been broken.

The adult's promise is part of the plan:

“You can tell me after one message or after a hundred. I will help make you safe before we discuss the household rule.”

Do not promise there will be no change to access. A contact may need blocking, an account securing or a device checking. Promise that reporting the harm will not be treated as the cause of it.

Some children need an alternative to spoken disclosure. Agree a code word, note, shared message or trusted person. Make the signal unambiguous: it means “I need help with something online, and I cannot explain it yet.”

Rehearse decisions, not frightening speeches

Use examples that fit the child's actual activities:

“A player offers you a rare item if you move to private chat. What is the pause point?”

“A new account that looks like your friend asks for the login code sent to your phone. How do you verify it?”

“Someone has an image and says they will send it to school unless you pay. What do you do first?”

The aim is not a perfect answer under no stress. Practise opening the conversation with an adult, finding the account name and stopping before the next transfer.

For a child who interprets broad language word for word, replace “do not share personal information” with examples: full name, school, uniform, address, live location, travel route, passwords, one-time codes, documents and images that show a bedroom or street. For a child who responds quickly, put the pause outside working memory: a note near the device or a rule that any request involving money, secrecy, moving apps or images waits for a second person.

Do not teach that neurodivergence makes a child an inevitable victim. Teach the specific decision support this child can use.

Reduce the routes that create opportunities for pressure

Review the accounts and devices together:

• use the child's real age;
• limit who can discover and contact the account;
• keep profiles, friend lists and location private where possible;
• turn off unknown direct messages and livestreaming;
• require approval for purchases, downloads and new payment methods;
• remove stored cards when independent spending is not safe;
• use strong, separate passwords and multi-factor authentication;
• protect recovery email addresses and one-time codes;
• check which photos reveal school, home or routine; and
• restrict who can add the child to groups.

The article on reducing risky social-media features explains how to preserve the purpose and safe contacts while changing the feature that creates the clearest risk.

Controls reduce opportunity; they do not prove that everybody reaching the child is safe. Keep the reporting promise active.

Verify through a separate route

A familiar photo, voice or username is not enough to verify an unexpected request. Agree that the child will contact the person or organisation through a number, account or website already known to be genuine.

Examples include:

• calling the friend on their saved number;
• asking a family question through a separate channel;
• opening the bank or game app directly rather than following a link;
• finding the organisation's number on its official website; or
• asking the parent before entering a code or payment detail.

Do not use the contact information supplied inside the suspicious message. GOV.UK advises using official routes and provides current ways to report suspicious emails, websites and texts.³

Notice money that does not look like a purchase

Exploitation may appear as earning rather than spending. Be alert when a child receives unexplained transfers, is paid to open an account, is asked to move money, buys vouchers for somebody else, lets another person use their payment account or receives goods to forward.

Ask without beginning with accusation:

“I can see money arrived and left quickly. Tell me who asked, what they said the job was and whether they have threatened you.”

Pause transfers, contact the bank or payment provider through its official route and preserve transaction references. Do not send more money to release funds, prove identity or recover a previous loss.

If a child may be controlled or used for criminal activity, treat it as possible exploitation. Ask police or local children's social care for advice rather than relying only on a fraud report.

If sexual grooming or blackmail is happening

Stay with the child and establish immediate danger. Has a meeting been arranged? Does the person know the child's location, school or home? Are there threats of immediate violence or self-harm?

Do not blame the child. Do not pay a blackmailer or continue engaging. Internet Watch Foundation guidance for sexual extortion advises parents not to pay or engage further, not to delete useful messages, and to contact police.⁴

Preserve usernames, profile links, dates, threats and surrounding messages. Do not forward sexual images or ask the child to recreate them. Then:

• report online child sexual abuse or grooming to CEOP;⁵
• use Report Remove if an under-18's sexual image or video of themselves is online;
• report suspected child abuse to local children's social care or police; and
• call 999 if anyone is in immediate danger.

CEOP is not the general route for bullying, fake accounts or hacking. The article on the first-hour online-harm sequence separates those routes.

Take any threat of self-harm or suicide seriously. A child being blackmailed may feel that exposure is unbearable. Stay with them and seek urgent mental-health or emergency help when they cannot stay safe.

If money, identity or an account has been taken

Stop contact and further payments. Contact the bank, card issuer, game marketplace or payment provider using its official website or number. Change the affected password from a trusted device, sign out other sessions and secure the recovery account. Do not destroy the original messages before recording what is needed.

The national fraud-reporting service is now Report Fraud for England, Wales and Northern Ireland. Its current service accepts reports of cybercrime, fraud and suspicious messages.⁶ In Scotland, current GOV.UK guidance directs people who have lost money to an online scam or fraud to Police Scotland.³

Suspicious texts can be forwarded to 7726. Use the live GOV.UK page for current phishing-email and website reporting instructions.³

A fraud report does not automatically recover money. Keep the bank's case reference, the platform report and the fraud reference together.

Restore safety without shrinking the child's whole world

After an incident, a child may feel ashamed, foolish or frightened of every notification. They may also miss the person they thought was a friend. Both can be true: the contact was exploitative, and the relationship felt meaningful.

Name the offender's responsibility without mocking the child's trust. Rebuild access in stages around known contacts, supervised money routes and a check-in the child can tolerate. Review whether sleep, school attendance, mood or self-harm has changed and seek professional help when distress persists.

Update the wider safety plan with the pressure pattern, the route that failed and the named adult or service for next time. Do not write “never make this mistake again”. Write the next observable action.

Children cannot be made invulnerable by one warning. They can be given clearer pause points, safer account design and an adult response that makes asking for help possible before pressure becomes control.

Footnotes

1. CEOP Education defines online sexual grooming as an adult building a relationship with a child online to harm or take advantage of them and describes sexual requests, uncomfortable acts and meeting pressure. ↩

2. The NCA and NPCC identify mass discoverability, unknown-adult contact and private messaging as features that can enable online criminal harm to children. ↩

3. GOV.UK provides current phishing-reporting routes, including 7726 for suspicious texts, and directs fraud victims in Scotland to Police Scotland. ↩ ↩² ↩³

4. IWF sextortion guidance advises parents not to blame the child, pay or engage further, and not to delete messages that may assist a report. ↩

5. CEOP's Safety Centre is the specialist reporting route for online child sexual abuse and grooming, not ordinary bullying, fake accounts or hacking. ↩

6. Report Fraud is the current national reporting service for cybercrime and fraud in England, Wales and Northern Ireland. ↩