Teaching Kids to Spot Online Scams: A Parent's Guide

The first scam most children meet is not an email from a bank. It is an offer of free Robux, a trade in a game where they hand over an item and get nothing back, or a message from a stranger in a Discord server who needs them to click something to "verify" an account.

These are not childish versions of real scams. They are real scams, running the same three or four mechanics that will be aimed at your child for the rest of their life, with the amounts scaled down. Which makes them unusually good teaching material, because the stakes are low enough to survive and the structure is identical.

This post sets out what the platforms themselves say, three rules that cover almost everything, and one explanation that works especially well on a child who codes.

Rule one: if somebody has to go first, it is a scam

This is the most useful sentence in the whole topic, and Roblox puts it almost exactly this way in its own guidance on trading: "You should never agree to any deal where one person has to go first and 'trust' the other."

Sit with how much that covers. The item trade where they promise to send yours back. The account "boost" where you log in for them first. The friend whose cousin will double your money. The rental deposit a teenager pays for a flat nobody owns. Every one of them requires the victim to move first.

Legitimate exchanges do not work that way. They happen simultaneously, through a system that holds both sides, and trust is not required because the system enforces it. Roblox's own trading feature does exactly this, and the company is blunt about the limits of its help outside that: it "cannot enforce deals made outside official features", and if a deal made outside them goes wrong, Roblox "cannot return your items or Robux".

Teach the child one question to ask in any exchange: who moves first? If the answer is "me, and then they promise", stop. No judgement about whether the other person seems nice is needed, which is the point. It removes the part children are bad at, reading strangers, and replaces it with something structural.

Rule two: nothing gives you currency for free

Roblox states it without hedging: "There is no way to get free Robux, and any offer of free Robux is a scam. There is no such thing as a Robux Generator, and if a person, website, or experience tries to tell you there is one, this is a scam and should be reported."

The company explains the purpose too. These scams exist "to trick you into giving out your password or personal information, or make you click on a bad link, with the goal being to take your account and all your Robux and items."

A child does not need a list of scam site names, which changes weekly. They need the category: anything offering in-game currency for free is a scam, every time, without exception. No judgement call, no grey area, no checking whether this one looks legitimate.

The explanation that works on a child who codes

Here is where a coding family has an advantage, and it turns a safety lecture into a computing lesson.

Ask your child where their Robux balance is stored. The answer is Roblox's servers, not their computer. Now ask what a web page running in their browser is able to do to a number stored on somebody else's server.

Nothing. It can send a request, and the server decides whether to honour it. A page cannot reach across and change a value it does not own, which is the whole reason online games keep balances server-side in the first place. If a web page could add Robux to an account, so could everybody, and the currency would be worthless within a day.

So a generator page is not a broken tool or a tool that sometimes works. Structurally, it is a form. Its only function is to collect what gets typed into it. The progress bars and the fake console output are theatre, added because a page that just said "enter your password" would be too obvious.

A child who follows that argument has something better than a rule. They have a reason, and reasons survive contact with a convincing-looking website in a way that rules do not. If your child has done any work with servers or APIs, our introduction to Roblox coding for kids covers the client and server split that makes this concrete.

Rule three: some things are never shared, and one of them will surprise you

Roblox's account safety guidance lists what should never be given to anyone: "your password, browser cookies, 2SV security codes, backup codes, personal details, or sensitive computer information".

Most parents cover the password. Very few cover the other two that matter, and both defeat a password entirely.

Two-step verification codes. A child who has been taught to protect a password will often read a six-digit code as something different and temporary, and therefore harmless. It is the opposite. The code is the second half of the login, and an attacker asking for it usually already has the password. Anyone who asks for a code is attacking the account, always, including somebody claiming to be support staff.

Browser cookies. This is the one almost no parenting article mentions, and it is how accounts get taken without a password at all.

A cookie is the small token a site gives your browser so it stops asking you to log in. It is proof of an existing session. Hand it over and you have handed over the logged-in state itself, which means the password is irrelevant and two-step verification is irrelevant, because neither is checked again. Scams that ask a child to paste something from their browser console, or to run a snippet of code "to get a free item", are usually after exactly this.

The rule to teach: never paste anything into a browser console, and never copy anything out of one, because somebody asked you to. For a child learning to code this needs saying explicitly, because they will legitimately be using a console in lessons. The console is a tool they use for their own projects, and never on somebody else's instruction.

Being young is not protection

Many parents assume a child who grew up with devices will see through this. The evidence points the other way for adults, and there is no reason to think children do better.

The Federal Trade Commission reported that in 2021, "Gen Xers, Millennials, and Gen Z young adults, people between 18 and 59, were 34% more likely than people 60 and over to report losing money to fraud." Older victims lost more per incident, with median losses rising from around 500 dollars for the 18 to 59 group to 1,500 dollars for people over 80. Younger people were defrauded more often and for less.

Those figures describe adults, not children, and the direction is the useful part. Fluency with technology is not the same skill as detecting deception. A twelve-year-old who can build a game is not thereby equipped to recognise a social engineering attempt, because those are unrelated abilities.

Why banning the game does not work

The instinct after a child loses something is to remove the platform. It is understandable and it has two problems.

It moves the activity out of sight rather than stopping it, usually to a friend's house or an account you do not know about. And it teaches nothing portable. The same patterns will arrive by text message at fifteen and by email at twenty-two, with a deposit or a salary attached instead of a virtual hat.

The alternative is not permissiveness. It is turning the incident into the lesson:

• Turn on two-step verification on every gaming account, together, today.
• Keep purchases behind an adult password, with no stored card and no one-click buying.
• Agree that in-game money is real money. A child who has earned pocket money understands the trade better than one for whom Robux appeared by magic. Our pieces on teaching kids about money when nothing is cash and on whether to pay children for chores both feed directly into this.
• Ask about the game regularly, in a way that is not an interrogation. A child who talks about what happens in a game will mention the odd message. One who expects a lecture will not.

If screen time is the underlying argument in your house, our guide to coding and screen time covers how to separate time spent making things from time spent consuming them, which is a more useful axis than total hours.

What to say afterwards

This part decides whether you hear about the next one.

A child who has just lost an account or an item is usually embarrassed, and embarrassment is what makes children hide things. If the expected consequence is losing the game, the rational move for a ten-year-old is to say nothing and hope.

So separate the two conversations completely. First, fix it: change the password, sign out of all sessions, enable two-step verification, report it in the game. Second, and explicitly: you are not in trouble, and telling me was the right thing.

Then, a day later, work out together which rule would have caught it. Did somebody have to go first? Was something free being offered? Was a code or a cookie requested? Almost always it is one of those three, and finding it themselves is worth more than being told.

Children who believe they will be met with help rather than punishment report things early, while an account can still be recovered. That is the whole return on this conversation.

The three rules, one more time

1. If one person has to go first, it is a scam. Ask who moves first.
2. Nothing gives you currency for free. No exceptions, and a web page cannot change a number on somebody else's server.
3. Passwords, codes and cookies are never shared. Not with friends, not with staff, not with anyone.

Three sentences, and between them they cover the overwhelming majority of what a child will meet. Teach the reasons rather than a list of dangerous websites, because the list changes and the reasons do not.

Platform guidance quoted here comes from Roblox's own help centre articles on free Robux generators, player trading scams and keeping an account safe. Fraud figures come from the Federal Trade Commission. For the coding side, see Codeyoung's online coding classes for kids.