I’d like to think that I do a pretty decent job of teaching my son about being safe on the internet.   We talk about scams, we talk about privacy, we talk about keeping information safe and about being skeptical of strangers.   I monitor his phone alongside of him, we look at his chats and messages together and talk about strategies for staying safe.   We do it as a team.

Which is why it was such a surprise when he got scammed out of his Roblox account a few days ago.

Aiden actively plays a variety of games that require virtual currency.   Sometimes he spends his own money on some of it, but I’ve tried to teach him the value of patience and how to minimize his real world spend while maximizing his in game earnings.   However, he does have access to YouTube and has always been drawn to the videos promising “Free $$$, just follow these easy steps!”   We’ve talked many times about how those are nearly all fake, and most are designed to actually hack or scam people.   He always says that he understands…  but clearly there was still a part of him that wanted to believe.

In Roblox, most of the games are user generated.   If you have a certain level of access, you can also create private servers of those games, populated only by the people you invite in.   Aiden told me once that he was playing on a private server with some people that he’d met in game.   This raised a red flag to me, and so we talked about how well he knew them, and about making sure he didn’t give them ANY information about himself or accept anything outside of the game.   The fact that he had befriended a stranger and was playing on their private server did cause me some concern, but having the conversation with Aiden and checking the message logs between them was adequate.  I wasn’t ignorant, but clearly I should have listened to that warning in my head.

On Monday, Aiden was playing on the private server when the host said that there was a bug that would give him a ton of free $$$ once he got through the walls of a building.   All he had to do was click on them and get past, and he’d get a huge amount of free in-game cash.   Aiden clicked on the wall and a dialog box popped up.   It had a field for username, which was pre-populated with Aiden’s character name.   The next field was to enter a password.   The dialog box looked identical to the one that you use to log into the game at the start of every session.   He questioned the host about it.   The host said that he got that box too, and once he got past it he received all the bonus money.

Aiden typed in his password and hit enter.

A few seconds later, the server was shut down.   Aiden was booted from the game.   He tried to log in and couldn’t.   Nobody was at the computer with him, but I think we can all imagine how he felt in that moment.   An hour or so later, Jess was tucking him in to bed and noticed he seemed more solemn than usual.   At first he denied anything was wrong, and then he told her what happened.  His biggest concern was that since we had bought in-game cash once, he thought the scammer had access to our credit card.  He was terrified, devastated and afraid of what our reaction would be.   This was how he spent the night before his 11th birthday.

Jessica tried to get into his account, but it turns out that it’s possible to create a Roblox account without adding an email address.   It seems that’s what he did.  Without a valid password or email recovery, the game was over.   We’ve reported the scam to Roblox support, but haven’t heard anything back yet.

The reason I share this story in such detail is because I want people to understand just how easily this can happen to our kids.   We monitor him, we talk about these issues with him regularly, I truly thought we did everything right while still giving him room to explore and grow.   Heck, I talk to parents and educators about internet safety and digital citizenship on a regular basis.   And despite all that…   Aiden still fell for it and lost his account.

In truth, I’m actually not all that heartbroken about it.   Aiden learned a really valuable lesson in a deep, meaningful way.  This is going to leave a scar, and teach him in a way that ‘cautionary tales’ just can’t measure up to.  At the end of the day, the only thing he really lost was his account, which he’ll be able to replace through time and effort.   In my opinion, it’s actually worth getting burned in this way so that he doesn’t get burned in a more serious way down the road.   And the fact that it happened shone a spotlight on some issues that we need to rectify as parents.

We let Aiden create his account by himself.   This time, we’re going to do it together.   We’re going to make sure he has an email address attached and we’ll explore the parental controls that Roblox offers (we didn’t even know those existed before).   We’re going to play the game with him, so we have a better understanding of how it works.  If we don’t, we won’t know when he’s putting himself in a situation that may be potentially hazardous.   I’m going to be more diligent about enforcing rules around his friends list.   I won’t be 100% opposed to allowing strangers on it, but he’s going to have to justify for me in detail why he feels safe letting a stranger into his virtual circle.  And it may sound silly, but I’m not going to ignore my instincts.   When he said he was on a private server, I immediately got concerned.   I should have followed that instinct through.

Aiden is at the age right now where he’s earning a lot more independence.   The one thing we’re really trying to impress upon him is that no matter what he does, if he tells us the truth then we handle it as a team.  We want him to feel comfortable coming to us when he makes a mistake, knowing that regardless of whether there’s a punishment involved, we’re in his corner and will work with him to handle it.  I was proud of him for letting us know almost immediately even though he was positive he was going to be punished and we were going to be extremely angry.    Losing his account was punishment enough, and he was able to sleep soundly knowing that we were proud of him for coming clean and letting us know.  It was a dumb mistake.  He’ll make more.   But hopefully he won’t make the same one a second time.

One final note for educators…   No matter how well we think we’re teaching our kids to be skeptical, safe and armored against harm… we need to keep that conversation ongoing and open.   When they fall, don’t beat them up.   Pick them up and help them share their story with their peers.   It’s always more meaningful when it’s personal.

The next day was his eleventh birthday.   He got $40 in Roblox gift cards from his grandparents and a subscription to the Builders Club from his sister.   And when time allows, the family is going to sit down and create new accounts together…   as a team.