The Threat

"Click this link to win a free iPhone."
"Enter your password to verify."
"Click here to see who has a crush on you."

Social engineering is the art of manipulating people into doing things they wouldn't normally do. It doesn't exploit software. It exploits trust, urgency, fear, and desire. And it's not limited to adults and corporations. It's everywhere in your children's online world.

I've tested these strategies (without following through with malicious actions) and they're alarmingly effective. Scammers use psychological triggers that are so effective, even seasoned IT professionals fall for them. Industry benchmarks show that over 80% of breaches involve a human element. Your child isn't "naive" for falling for a trap, they're human, and they're the perfect target. They trust easily, they fear missing out, and they desire rewards (virtual currency, status, popularity). Their prefrontal cortex—the "brakes"—isn't fully developed.

The good news is that Security Awareness Training shows a 40% reduction in phishing risk within 90 days. Your child can learn to recognize these traps faster than adults. The key is practice, not perfection.

The Five Traps

Here are the five most common social engineering attacks targeting kids, how they work, and the script to teach your child to respond.

The "Free Stuff" Lure

It looks like: "Click here for FREE Robux!" "Enter your username to claim your prize!" "Watch this video to unlock the secret item!"

The "free" lure exploits desire. Kids want virtual currency and the scammer offers it for "free" in exchange for a click, a login, or a download. The result is malware on the device, stolen credentials, a hijacked account or all of the above.

The Script: "If something is free, you are the product. No one gives away something for nothing. If they want your password, your click, or your download, it's not a gift—it's a trap. If it sounds too good to be true, it is. Close the tab."

The "Urgency" Push

It looks like: "Your account will be DELETED in 24 hours! Click here to verify!" "Act NOW or lose access forever!" "URGENT: Your password has been compromised. Reset immediately."

Urgency exploits fear and panic. The attacker creates a false deadline so the victim acts before thinking. The link leads to a fake login page that steals credentials. Urgency is one of the most effective even on adults.

The Script: "Real companies don't threaten you with deletion and real emergencies don't come with a countdown timer. If someone is rushing you, they are trying to stop you from thinking. The rule: When you feel rushed, STOP. Close the app. Come back in 10 minutes. If it's real, it will still be there."

The "Authority" Impersonation

It looks like: "This is the moderator. I need your password to fix your account." "I'm from [game company]. You've been selected for a special role!" A message from a "friend" asking for money, gift cards, or login info.

Impersonation exploits trust in authority. This is big for kids because they're taught to listen to adults, moderators, and "official" accounts. Scammers impersonate these figures to extract information.

The Script: "No real moderator, company, or adult will EVER ask for your password. Ever. If they do, they are fake. The rule: If someone asks for your password, they're a scammer. No exceptions. Even if they sound official and even if they threaten you."

The "Friendship" Manipulation

It looks like: "If you're really my friend, you'll send me that picture." "Everyone is doing it. What's wrong with you?" "I'll tell everyone you're a coward if you don't do this."

"Friendship" exploits social belonging. Kids fear exclusion more than almost anything. Scammers (or even peers) use social pressure to coerce kids into sharing personal info, photos, or access.

The Script: "A real friend doesn't make you prove your friendship by doing something uncomfortable. A real friend respects your boundaries. The rule: If someone makes you feel guilty for saying no, they are not acting like a friend. You can always say no, and you can always tell me."

The "Curiosity" Bait

It looks like: "OMG you won't believe what they said about you! Click here!" "Someone has a crush on you! Find out who!" "Look at this embarrassing photo of you!"

This technique exploits both curiosity and vanity. The target clicks the link to satisfy curiosity, which installs malware or steals credentials.

The Script: "If someone wants you to see something, they'll show you directly. They won't make you click a mysterious link. The rule: If a message makes you desperately curious, that's the trap. The curiosity is the bait. Don't bite."

The Neurodivergent Lens: Rules Work

Social engineering exploits social norms—and neurodivergent kids often experience those norms differently.

Autistic kids may take messages at face value (literal interpretation). If a message says "I'm a moderator," they may believe it without questioning. They may also struggle to detect sarcasm, deception, or "tone" that signals manipulation.

ADHD kids may be more impulsive, making them more likely to click before thinking. The "Urgency" trap is especially potent because their brain craves immediate resolution, and the dopamine hit of "FREE" is harder to resist.

The Adapted Strategy: Rules Over Vibes

Instead of relying on social intuition, teach them a rule-based system.

  • No one gets your password. Ever. (Not a rule with exceptions. A rule with ZERO exceptions.)
  • If you feel rushed, stop. (The feeling of urgency IS the warning sign.)
  • If it's free, it's a trap. (No exceptions.)
  • When in doubt, ask a trusted adult. (Define "trusted adult" explicitly: parent, teacher, guardian—not "someone who says they're in charge.")

Rules often work better than gut feelings because neurodivergent kids may not have reliable intuition about social situations, but they can easily memorize and apply clear, unambiguous rules. This isn't a limitation; it's a strategic advantage.

The Red Flag Cheat Sheet

Print this, put it on the fridge and bookmark it on their phone.

  • "FREE" anything: You are the product. Close the tab.
  • "Act NOW!": They want you to stop thinking. Wait 10 minutes.
  • "Give me your password": 100% scam. Say no. Walk away.
  • "If you're really my friend...": Emotional manipulation. Say no. Tell a trusted adult.
  • "You won't believe...": Curiosity bait. Ignore. Delete.
  • "I'm a moderator/official": Authority impersonation. Verify independently. Never trust the message itself.

Starting the Conversation

Open with: "I want to talk to you about something called 'social engineering.' It's when someone tricks you into doing something by making you feel scared, rushed, or excited. It happens to adults, too. Let me show you some examples."

The key message: "Getting tricked is not your fault. These people are professionals but if you know the tricks, you can spot them. And if you spot them, you beat them."

The promise: "If you ever click something you shouldn't have, or give someone information you shouldn't have, I won't be angry and I will help you fix it. You can always come to me without punishment, just help."

As pretty much all parents know, fear of punishment is the #1 reason kids hide mistakes. If they know you'll help, not punish, they'll come to you when it matters most.

The Bigger Picture

Social engineering is the #1 attack vector for data breaches worldwide. Adults fall for it every day (phishing emails, romance scams, fake IRS calls).

By teaching your child to spot manipulation now, you're giving them a skill that will protect them for the rest of their life. Not just online, but in person, in relationships and in the workplace.

When your child recognizes the manipulation, they aren't just "safe." They're powerful. They're looking at a scammer and thinking: "I see what you're doing and I'm not falling for it." That's a trait of sovereignty.