Use fictional examples, never live suspicious content
This 20-minute activity helps a family practice a response before pressure arrives. Every message on this page is original teaching material. It contains no working link, phone number, account, payment destination, or real person’s details.
Do not open a real suspicious message for this activity. Do not click, reply, call, scan, download, forward, pay, share a code, install software, approve a prompt, or keep a suspected scammer engaged so someone can practice. If a family member may already have acted, stop the activity and use What To Do After a Possible Online Scam.
The skill is not “guess the scam.” It is Stop, Leave, Verify, Decide:
- stop the requested consequence
- leave the sender’s channel
- verify through contact obtained separately and already trusted
- decide and continue only in that trusted route
Choose a facilitator and make participation accessible
An adult should facilitate when children participate. Choose a calm time that does not compete with driving, bathing, cooking, medicine, water supervision, animals, or another task needing active attention.
Adapt the activity to each person’s development and access needs. Participants may speak, point to response cards, write, draw, use a communication device, ask for plain-language repetition, observe, answer privately, or leave. Do not measure response speed. A person may recognize pressure slowly and still use the correct safety routine.
Avoid scenarios that closely repeat a participant’s recent loss, abuse, family crisis, identity theft, sextortion, job loss, immigration concern, or other distress unless a qualified professional has helped decide that the practice is appropriate. This is education, not exposure therapy or an investigation.
What to bring
- this page in a format participants can access
- four cards labeled Stop, Leave, Verify, and Decide, if useful
- paper for one family rule and one adult follow-up
- 20 uninterrupted minutes
- no real accounts, messages, identity documents, passwords, codes, or payment tools
The facilitator should read Help Your Family Recognize an Online Scam Before Acting first. Do not improvise technical, financial, legal, or safeguarding instructions when a scenario raises a real concern.
Minute 0-2: Make the no-shame agreement
Read or adapt:
These examples are fictional. We are practicing a family system, not testing who is smartest. Scams create urgency, fear, hope, secrecy, affection, or confusion. Anyone may stop and ask another person. If anyone has seen something similar in real life, they can tell an adult privately now or later. Safety response comes before blame.
Agree that nobody will be mocked for a mistaken answer or a past action. Adults should not use the activity to demand account access, inspect private conversations, expose a child’s mistake to the group, or announce an unplanned punishment.
Show the pause signal. This might be a word, raised card, hand signal, communication-device choice, or moving toward the trusted adult. If someone pauses, stop. Clarify, adapt, or finish another day.
Use six questions for every fictional message
For each scenario, ask:
- Claim: What does the sender want us to believe?
- Pressure: Which emotion, authority, urgency, secrecy, or reward is being used?
- Consequence: What money, information, code, access, download, contact, or action is requested?
- Stop: What should not happen yet?
- Leave and verify: How do we exit and reach the real person or organization without using anything supplied here?
- Adult owner: Which trusted adult handles payment, account recovery, reporting, or safeguarding if this occurs?
Do not ask, “Is it definitely a scam?” A fictional scenario can demonstrate patterns, but real messages sometimes remain uncertain until independently verified.
Minute 2-5: Scenario 1, the small delivery fee
Fictional delivery notice: Your package cannot be delivered because a small postage balance remains. Confirm your address and card within 30 minutes at the button below.
Pause before the teaching notes.
Pressure: A familiar routine, believable small amount, deadline, and fear of losing a package.
Consequence to stop: Do not press the fictional button, provide an address or card, reply, or search using a number from the notice.
Independent route: Open the retailer or carrier account the family normally uses, type or use a previously saved official address, or check the known order record. A real-life message should not be forwarded to another family member for them to test.
Teaching point: A small request can lead to payment-card, identity, or account information. Polished design and a known delivery brand are not proof.
Minute 5-8: Scenario 2, the familiar emergency voice
Fictional call: A voice that sounds like a relative says they lost their phone, are in serious trouble, and need money immediately. They insist nobody else can be told.
Pressure: Familiar voice, fear, love, urgency, secrecy, and the belief that only the recipient can help.
Consequence to stop: Do not pay, disclose information, stay on the call, or accept a transfer to a supposed lawyer, hospital, police officer, or payment helper.
Independent route: Hang up. Call the relative through a number already known. If the person cannot be reached, contact another established family member or trusted person. The FTC warns that scammers use fake emergencies, including AI-enabled familiar-voice impersonation; voice and caller ID do not prove identity.
Teaching point: Practice the callback sequence, not a family secret as the only safeguard. A phrase can be exposed or guessed and must not override independent verification.
Minute 8-11: Scenario 3, the account-protection call
Fictional caller: This is your bank’s fraud team. Someone is stealing your money. Stay on the line, read the security code we just sent, install our protection app, and move the balance to a safe account.
Pressure: Authority, fear of loss, continuous contact, technical language, and instructions presented as protection.
Consequence to stop: Do not share a password or code, approve a prompt, install anything, grant remote access, move money, or use a number supplied by the caller.
Independent route: Hang up. Open the bank’s normal official app or call the number on a recent statement or the back of the card. FTC guidance on unexpected money-risk calls says to contact the institution independently, while its verification-code guidance explains why the code must remain private.
Teaching point: Personal details known by a caller are not proof. A security code or unsolicited approval can be a key to the recipient’s account.
Minute 11-13: Scenario 4, the easy job or creator opportunity
Fictional message: We found your profile and want to hire you for remote rating work. Reply today to earn hundreds each week. First, deposit a check for equipment and send the unused amount to our vendor.
Pressure: Flattery, income, professional-looking language, urgency, and a payment that seems to arrive first.
Consequence to stop: Do not reply, deposit the check, buy equipment, send money, complete tasks, provide identity or banking information, or move to another messaging app.
Independent route: Find the employer through a separately located official site and contact its established human-resources or careers route. Ask a trusted adult to review the opportunity. A logo, contract, check image, recruiter profile, interview text, or dashboard balance is not proof.
Teaching point: FTC job-scam guidance warns against unexpected job texts, paying to be paid, fake checks, and tasks that eventually require the worker’s money.
Minute 13-15: Scenario 5, the game trade or marketplace buyer
Fictional chat: I will pay extra for your game item or used device. To prove you own the account, send the code that just arrived. My payment screenshot shows the money is waiting.
Pressure: A good price, social proof, fear of missing the deal, and a request framed as verification.
Consequence to stop: Do not share the code, change account details, move off the platform, open a payment link, ship an item, or trust a screenshot or displayed balance.
Independent route: Check the platform’s actual account and transaction record through its normal app or site. Use its documented trading, selling, payment, and support process. A child should bring the request to the designated adult before any account, money, shipping, or identity action.
Teaching point: A verification code verifies the person entering it, not the stranger asking for it. Adults should set transparent purchase and trade permissions rather than wait for a loss.
Minute 15-17: Scenario 6, the prize, scholarship, or benefit fee
Fictional notice: Congratulations. Your application was selected for a major award. Pay today’s processing fee with gift cards and send photos of the card numbers to release it.
Pressure: Hope, authority, scarcity, deadline, and payment required before receiving value.
Consequence to stop: Do not buy cards, send card numbers or photos, provide identity documents, or pay to release the supposed award.
Independent route: Ask whether anyone actually applied. Reach the school, program, agency, or organization through a separately obtained official route. FTC gift-card guidance states that gift cards are for gifts, not payments, and that requests for their number and PIN are scam indicators.
Teaching point: A promised prize or opportunity does not make an unusual payment method safe. Children should not be tasked with deciding whether financial aid, benefit, tax, immigration, or legal contact is real.
Optional scenario: secrecy, intimate material, or threats
Use this only if developmentally appropriate and not likely to recreate harm:
Fictional contact: I have private material about you. Keep this secret, send more, or pay, or I will share it with everyone.
The correct practice response is not detailed negotiation. Stop replying, do not pay or send more, preserve only what the appropriate adult, platform, or authority needs, and tell a trusted adult immediately. Adults should protect the child, limit further contact, and use current platform, law-enforcement, child-protection, school, or emergency routes appropriate to the situation.
Do not ask a child to explain intimate details in the group, display material, continue contact, impersonate the sender, trap the person, or repeatedly recount the event. Immediate physical danger or threatened violence uses 911.
Minute 17-19: Practice one response out loud
Choose one neutral scenario. Each participant can say, select, or point to:
- Stop: “I am not doing that now.”
- Leave: “I am ending this contact.”
- Verify: “I will use the app, number, person, or site I already trust.”
- Ask: “I need my trusted adult to help.”
The exact wording does not matter. Do not time participants or require a performance. A person who freezes, feels unsure, or wants help is allowed to use one word, show a card, close the device, or bring it to an adult.
Minute 19-20: Close the loop
Ask:
- Which pressure was hardest to notice?
- Which independent route was easiest to name?
- Is any family permission, account owner, recovery contact, purchase rule, or trusted adult unclear?
- Does anyone want to discuss a real concern privately?
Choose one adult-owned follow-up. Examples:
- verify who controls recovery for a child’s gaming or email account
- write the known bank and carrier contact routes in a protected family record
- enable provider-supported MFA on a priority account
- clarify which purchases, trades, downloads, and job offers require adult review
- add a second trusted adult a child may contact
Record the owner, backup, date, and proof. “We talked about scams” is not proof that an account or permission gap is fixed.
Debrief without grading or surveillance
Discuss the method, not who was “fooled.” A participant may notice urgency but miss secrecy, or choose a safe pause without naming the scam type. That is still useful. The desired behavior is stopping consequence and reaching help, not producing a perfect analysis.
Do not convert the activity into routine secret inspection of messages. Families can use transparent, developmentally appropriate supervision, provider controls, purchase approvals, privacy settings, and account recovery ownership. Increase support when the individual, account, prior event, or consequence calls for it while preserving an age-appropriate route to trusted help.
If someone discloses that they already clicked, paid, shared, approved, downloaded, installed, sent an image, or continued contact, thank them for telling you. Stop the lesson and begin real response. Do not delete evidence, punish first, post the incident publicly, or make the person contact the suspected scammer again.
Do not practice with naturally arriving suspicious messages
The earlier version of this activity suggested redacting a naturally received message. That is no longer the preferred method. Opening, screenshotting, forwarding, or handling real suspicious content can expose links, personal information, malware, intimate material, or ongoing contact. Use the fictional examples on this page instead.
If a real message arrives, keep it out of the group activity. A responsible adult should use the provider’s current reporting and response route, preserve only necessary evidence securely, and follow the recovery decision aid if any action may have occurred.
Sources
- Federal Trade Commission: How To Avoid a Scam
- Federal Trade Commission: How To Recognize and Avoid Phishing Scams
- Federal Trade Commission: Scammers Use Fake Emergencies To Steal Your Money
- Federal Trade Commission: How To Handle Unexpected Calls That Claim Your Money Is at Risk
- Federal Trade Commission: What’s a Verification Code and Why Would Someone Ask for It?
- Federal Trade Commission: That Job Offer Text Is Probably a Scam
- Federal Trade Commission: Avoiding and Reporting Gift Card Scams
- CISA: Secure Our World Resources
Sources were rechecked on August 9, 2026. The fictional scenarios, six-question method, response cards, and 20-minute sequence are original Saralivo teaching material, not quotations or live scam messages.