Help Your Family Recognize an Online Scam

If money, access, identity information, or safety may already be involved

Move to What To Do After a Possible Online Scam. Contact the relevant financial institution, payment provider, account provider, carrier, device or software provider, or emergency service through a separately obtained official channel. If there is immediate physical danger, threatened violence, a missing child, or another urgent safety concern, call 911.

Do not keep the suspected scammer engaged to gather more evidence. Do not pay again to “unlock,” “reverse,” investigate, recover, protect, or release money. Do not delete relevant records until the appropriate provider or authority has advised what to preserve.

A convincing message can still be false

Scam awareness is no longer a search for bad spelling. Unexpected contact may use a real company name, a copied logo, a familiar profile photo, public information, a convincing invoice, a caller-ID label, a believable account detail, or a voice that sounds like someone the family knows.

The Federal Trade Commission describes recurring patterns: impersonation, a problem or prize, pressure to act, and a requested payment method. Its family-emergency guidance warns that artificial intelligence can be used to clone a familiar voice from a short audio sample. A realistic voice, video, image, sender name, phone number, email address, website appearance, or personal fact is therefore not proof of identity.

No single clue proves that a message is genuine or fraudulent. The durable skill is to separate the claim from the channel that delivered it.

Use Stop, Leave, Verify, Decide

1. Stop the requested action

Before certainty, stop the consequence. Do not:

click a link, scan a code, open an attachment, or download a file
reply, continue the call, or call a number in the message
share a password, passcode, one-time code, recovery key, Social Security number, account detail, identity image, location, or intimate material
approve a sign-in, multifactor prompt, account recovery, purchase, money movement, or device-pairing request you did not initiate
buy gift cards, send cryptocurrency, wire money, use a payment app, mail cash, or deposit a check and return part of the money
install software, visit a remote-support site, share a screen, or give control of a device

Urgency is a reason to pause. A real organization may need timely action, but the family can reach it through a known channel rather than obeying the unexpected contact.

Use a prepared sentence:

I do not make account, money, identity, device, or safety decisions during unexpected contact. I will verify this separately.

A child or teenager can use an even shorter version: “I need to check with my adult.” No explanation or argument is owed to the sender.

2. Leave the sender’s channel

End the call. Close the message without using its link. Do not transfer to another department, accept a callback, or let the caller remain on speaker while the family checks. A scammer can continue supplying urgency, instructions, and supposed proof while still controlling the interaction.

If the device or account may have been taken over, use another known-safe device when possible to reach the provider. Do not assume that a reply from the same family account, email thread, social profile, or phone proves the person controls it.

3. Verify independently

Use contact information obtained before the message or found separately through a trustworthy source:

For a bank or card issuer, use the official app you normally open or the number printed on the card or statement.
For a family emergency, call the person on a number already saved and contact another trusted person who can check. Do not trust the voice alone.
For a school, clinician, employer, government agency, delivery company, utility, store, or platform, use the known app, statement, official website typed or opened separately, or an established in-person route.
For an account warning, open the account in the normal way and review its security page rather than using the message link.

Ask only whether the claim and requested action are real. Do not read a one-time code, password, or recovery key to someone who called. Do not search for a “customer service” number from an advertisement without checking that it belongs to the actual organization; fraudulent support routes can appear in search and social results.

4. Decide in the trusted channel

The claim is false: use the provider’s report or block tools, preserve what is relevant, and end contact.
The claim cannot yet be verified: do nothing consequential. Ask a trusted adult or the organization through its official route.
The claim is real: continue only in the independently reached account, app, number, website, office, or other trusted route.
Someone already acted: begin consequence-specific recovery immediately rather than spending time proving exactly what kind of scam it was.

Watch the pressure, not just the story

Different stories often use the same decision pressure. Pause when unexpected contact combines one or more of these:

Urgency: act now, the account will close, the child is in danger, the offer ends, or police are coming.
Secrecy or isolation: do not tell family, the bank, school, employer, authorities, or anyone else.
Authority: a supposed government agent, police officer, court, employer, clinician, bank investigator, teacher, platform employee, or technology company gives unusual instructions.
Fear: arrest, deportation, injury, exposure, humiliation, account loss, service cutoff, or a child’s punishment is threatened.
Hope: a prize, job, scholarship, investment, refund, loan, romance, opportunity, rescue, or exclusive access is promised.
Reciprocity: the person sent money, a check, a gift, attention, affection, game items, or help and now demands something back.
Payment control: gift cards, cryptocurrency, wires, payment apps, cash, account transfers, or a returned “overpayment” are required.
Access control: the sender wants a password, code, approval prompt, screen share, software installation, remote access, or a move to another platform.

These are reasons to stop and verify, not a diagnostic checklist. A scam may use only one pressure, and a legitimate message may look unusual. Independent verification makes the decision safer than arguing from appearance.

Treat verification codes and approval prompts as account keys

One-time codes and sign-in approvals are often designed to prove that the person holding the device is the account owner. If another person asks for the code, they may be trying to complete their own login, recovery, transfer, or account setup.

Household rule:

Never share a security code, password, recovery key, or unsolicited approval with a person who contacted you, even if they claim to work for the provider.

When a legitimate support interaction requires identity verification, begin through the provider’s known route and follow the instructions inside that trusted process. A family member should not ask a child to read codes aloud casually or use a child’s device as an authentication relay.

Prepare for impersonation before an emotional call arrives

FTC guidance warns not to trust a familiar-sounding voice in an emergency-money request. Families can agree in advance to a verification routine that does not depend on voice, caller ID, a photo, or a secret phrase alone.

For example:

End the unexpected contact.
Call the person through a previously known number.
If unreachable, contact another trusted person through an established route.
Verify the event and any payment request separately.

A family phrase may be one layer, but it can be overheard, shared, guessed, or disclosed. It should not override the independent callback. Do not post detailed routines, travel plans, school schedules, identity documents, or voice samples merely to “test” whether scammers can use them.

Separate prevention from account security

Pausing a scam message and securing accounts support each other, but neither replaces the other. CISA’s Secure Our World guidance emphasizes four recurring protective habits:

recognize and report phishing
use long, random, unique passwords, supported by a reputable password manager where appropriate
enable multifactor authentication on accounts that offer it
install software updates promptly, using automatic updates where appropriate

Begin with the email account that can reset other accounts, then financial, mobile-carrier, cloud-storage, shopping, social, school, gaming, and device accounts according to the household’s actual exposure. Use provider-supported settings and recovery methods. Do not remove a child’s legitimate accessibility support, parental-control arrangement, or necessary shared access without understanding the consequence.

MFA reduces some account-takeover risk but does not make every prompt genuine. A person can still be tricked into approving a login or sharing a code. Password managers and software updates reduce risk but do not prove that a message or website is authentic.

Build rules around actions, not age stereotypes

Children, teenagers, adults, and older relatives can all encounter persuasive contact. A useful family system matches permissions and supervision to the individual, the account, and the consequence.

Decide together:

which purchases, transfers, account changes, downloads, contacts, and sharing decisions require an adult check
how a child reaches a trusted adult without continuing the conversation
which accounts belong to a child, which are adult-owned, and who controls recovery information
how the family handles gaming trades, marketplace sales, creator or job offers, scholarships, contests, romance, sextortion threats, school messages, and support requests
how to respond if the child used a false age, hid an account, shared something private, or broke a family rule

The first response should protect the child and stop ongoing harm. Discipline, device removal, surveillance, or public confrontation should not delay account, payment, identity, sexual-safety, or physical-safety response. Do not impersonate a child, secretly continue a conversation as them, or ask them to entrap the sender.

Make disclosure safer than secrecy

Scammers may count on embarrassment. Families can remove some of that leverage with explicit language:

You will not be punished for stopping and asking. If you already clicked, paid, shared, approved, downloaded, or kept a secret, tell us now. Our first job is to protect you and limit harm.

This is not a promise that choices have no consequences. It is a promise that safety response comes before blame. Avoid statements such as “How could you fall for that?” or “You should have known.” Anyone can act while frightened, hopeful, rushed, isolated, tired, or trying to protect someone.

If the message includes intimate images, threats, sexual requests, blackmail, stalking, trafficking, self-harm threats, or danger to a child, do not bargain, pay, redistribute images, conduct an amateur investigation, or force repeated disclosure. Preserve what the appropriate authority or platform needs without making unnecessary copies, protect the child from further contact, and use the current safeguarding and emergency routes appropriate to the situation.

Protect children’s identity and accounts without unnecessary surveillance

A child’s name, birth date, Social Security number, school details, images, voice, location, and account credentials can have long-term consequences if misused. Adults should collect and share only what a service genuinely needs, review privacy and recovery settings, and know which authorized adult controls minor accounts.

FTC’s IdentityTheft.gov notes that a child generally should not have a credit report unless information is being used for credit activity, and provides current routes for checking and freezing a child’s credit when appropriate. These steps require identity and authority documents and should be taken through the official credit-bureau and FTC routes, not through a link in an unexpected warning.

Account protection does not require reading every private conversation. Use developmentally appropriate supervision, transparent household rules, provider controls, and increased review when risk or prior harm justifies it. Preserve age-appropriate privacy and the child’s ability to seek help from safe adults.

When to report and what reporting can do

The FTC accepts fraud reports at ReportFraud.ftc.gov. The FBI’s Internet Crime Complaint Center accepts reports of internet-enabled crime. Providers, financial institutions, schools, employers, platforms, carriers, local law enforcement, and child-protection routes may also have roles depending on the consequence.

Reporting creates a record and can support investigation or pattern detection, but it does not replace immediate account, payment, device, identity, or physical-safety action. It does not guarantee recovery. Use the provider’s official contact route and keep complaint confirmations.

Preserve original messages, sender details, dates, amounts, transaction identifiers, receipts, account notices, and actions already taken when safe and relevant. Avoid opening new attachments or links to collect more. Store evidence with limited access, especially when it contains a child’s identity, location, financial information, or intimate material.

A one-minute family agreement

Write and practice:

Unexpected contact does not control our next action.
We stop before money, information, codes, access, downloads, or secrecy.
We leave and verify through a separately obtained trusted route.
No one is mocked or punished for asking early or admitting an action.
Adults own financial, account-recovery, reporting, and safeguarding response.

Use Practice Spotting Scam Pressure as a Family for fictional, no-contact examples. Never practice with a real suspicious link, phone number, account, payment request, or sender.

Sources

Sources were rechecked on August 8, 2026. This guide provides general US educational information, not an authenticity determination, investigation, legal conclusion, financial advice, or guarantee of prevention or recovery.