Fear does not teach, it silences

Most adults teach online safety the way they were taught about strangers: with warnings. The problem is that scared kids do not become careful kids. They become kids who hide things, because admitting a mistake means admitting they did the dangerous thing you warned them about.

The goal is different: raise kids who recognize a scam, pause, and tell someone. That last part is the whole game. A ten-year-old who clicks a bad link and tells you within five minutes is a security success story. A fifteen-year-old who gets blackmailed and tells nobody is the failure mode, and it is almost always fear of punishment that keeps them quiet.

So the one rule that applies at every age: make reporting free. Whatever happened, the first response is "thank you for telling me," not a lecture, and never taking the device away as punishment for honesty. Confiscation teaches exactly one lesson: next time, say nothing.

With that foundation, here is what actually lands at each age.


Ages 6 to 9: habits, not threats

At this age, kids do not need threat models. They need habits framed as house rules, the same way "look both ways" is a rule long before a child understands traffic physics.

What works:

  • Passwords are secrets, like a diary key. A password is something you share with a parent and nobody else. Not the best friend, not the cousin, not the nice person in the game chat.
  • Ask before you tap. Pop-ups, download buttons, "you won a prize" screens: the rule is simply "come get a grown-up first." No explanation of malware required.
  • Real name, school, address stay offline. Practice it as a quiz: "Someone in the game asks what school you go to. What do you say?" (Answer: nothing, and tell an adult.)
  • Devices live in shared spaces. Not surveillance, just proximity. Weird things get noticed early when the tablet is at the kitchen table.

Keep sessions short and playful. A five-minute "spot the trick" game beats a thirty-minute talk every time. Interactive modules built for this age group, like the ones on kids.mlab.sh, work well precisely because they feel like games first and lessons second.


Ages 10 to 13: the scam years

This bracket lives in Roblox, Minecraft, Fortnite, and Discord, and that is exactly where the scams are. Kids this age are old enough to understand why, so start explaining mechanics instead of just rules.

The threats they will actually meet:

Scam How it looks The tell
Free currency generators "Free Robux/V-Bucks, just log in here" Nobody gives away money; the login page steals the account
Fake trades "Give me your item first, I'll send mine after" Real trades happen inside the game's trade system
Account "verification" A DM claiming the account will be banned unless they log in via a link Games never DM ban threats with login links
Friend impersonation A hacked friend's account asking for passwords or gift cards The out-of-character request itself

This is also the age for real password hygiene:

  • Passphrases beat passwords. "PurpleDragonEatsToast4" is easier to remember and stronger than "Kevin2015!". Let them invent silly ones; silliness is memorable.
  • One account, one password. Explain credential stuffing in kid terms: "If a thief steals the key to your locker and you used the same key for your house, what happens?"
  • Turn on two-factor together. Do it on their gaming account first, because that is the account they actually care about protecting.

And start the oversharing conversation early, before social media makes it urgent: photos reveal school logos, street signs, and location metadata. A good exercise is to look at a stranger's public profile together and list everything you can figure out about them. Kids find this detective work fascinating, and the lesson teaches itself.


Ages 14 to 17: honest conversations

Teenagers can smell a sanitized talk from across the room. At this age, being factual and calm earns you more credibility than being protective.


Oversharing and the permanent record

Skip "colleges will see your posts" (they mostly tune it out) and talk about mechanics instead: screenshots exist, private accounts leak through followers, and deleted content survives in archives and in other people's saves. The practical rule that resonates: write every message as if it could be forwarded, because it can be. That applies to group chats above all, where "private" means "visible to whoever is least trustworthy in the group."


Sextortion: say the word

This is the conversation most parents skip, and it is the one that matters most. Financial sextortion is one of the fastest-growing crimes targeting teens, and boys aged 14 to 17 are now the primary targets. The pattern is consistent: an attractive stranger initiates contact on Instagram, Snapchat, or a game, moves fast, sends an image, asks for one back, and then immediately demands money under threat of sending the image to the victim's followers and family.

Teens need to hear three things, stated plainly:

  1. The blackmailer is lying about everything. It is usually organized crime running hundreds of accounts, not an individual. Paying does not stop the threats; it marks the victim as someone who pays.
  2. The response is: stop replying, screenshot, block, report. Do not pay, do not negotiate, do not delete the evidence. Platforms and police take these reports seriously, and services like NCMEC's Take It Down can help get images removed.
  3. Their life is not over. This is the sentence that prevents tragedies. Teens have died by suicide within hours of the first threat because they believed exposure was unsurvivable. Say it before it is ever needed: "If this ever happens, it is not the end of anything, you will not be in trouble, and we will fix it together."

That is not a scare tactic. It is a fire drill: rehearsed calmly so the real event is survivable.


Conversation starters that actually work

Questions beat lectures at every age:

  • "What's the weirdest message you've ever gotten in a game?"
  • "How would you know if someone online isn't who they say they are?"
  • "What would you do if a friend's account started acting strange?"
  • "Has anyone in your class ever had an account stolen? What happened?"
  • For teens: "What would you tell a younger kid about what to watch out for?" (Teaching it is the best way to internalize it.)

For structured practice, pair the talks with hands-on material: password games and phishing-spotting exercises on kids.mlab.sh for the younger brackets, and for curious teens, real security fundamentals on academy.mlab.sh. Some of them will discover it is a career.

You are not raising kids who never make mistakes online. You are raising kids who recognize trouble early and tell you about it. Optimize for that.