Phishing and Scam Awareness Lessons for Teenagers — A Guide for Schools

Why now

Teenagers aren't bystanders — they're the targets

It's tempting to file scam awareness under "adult problems" — no salary, no mortgage, nothing worth stealing. The data says otherwise. Teenagers have bank accounts, marketplace logins and game inventories worth real money, and scammers meet them exactly where they are: research for Safer Internet Day 2025 found social media is the most common place 8–17-year-olds encounter scams, ahead of email — with online games third. The updated RSHE guidance, statutory from September 2026, reflects that reality: it names scams, fraud and financial exploitation in the content secondary schools must cover.

The same research — a Censuswide survey of 2,013 UK 8–17-year-olds — shows how routine this has become:

46%

of UK 8–17-year-olds say they've been scammed online — and 9% have lost money to one (Safer Internet Day 2025 research)

1 in 5

see a scam online every single day; 79% come across one at least monthly

74%

want to learn more about how to spot scams — the demand for this lesson comes from the students themselves

Scope: teaching the topic vs handling an incident

This guide is about teaching. If a student has already lost money, that's a matter for their bank first, then Report Fraud — the service that replaced Action Fraud from December 2025 as the reporting route for England, Wales and Northern Ireland (Scottish reports go to Police Scotland). And if a scam has become coercion — blackmail over images, or pressure to move money through their account — that's a safeguarding matter for your DSL. For the image-blackmail version, see our sextortion guide for schools.

The trap

"Check for dodgy spelling" is not a strategy

The classic scam-awareness lesson is a checklist of surface tells: bad grammar, odd formatting, an amateurish look, a suspicious-seeming address. That described scams a decade ago. AI-drafted messages are fluent, fake sites are pixel-perfect clones of real ones, and a sender name or a link's visible text can display anything at all. Every surface checklist has a shelf life, and it has expired.

Worse, checklist-teaching quietly installs the inverse rule: if it reads well and the address looks right, it's safe. That is precisely the reflex modern scams exploit — it's the same trap as teaching students to hunt visual artefacts in deepfakes. A message is never safe because its link shows a real-looking domain; displayed link text proves nothing about where a link actually goes.

What holds up is anatomy, not appearance. Almost every scam, whatever its costume, is built from pressure, urgency and an ask — money, a card number, a login, a code. And the defence that never rots is one habit: don't act on the message itself. Open the official app, type the address you already know, call back on the number you already have. If the message was real, going direct costs thirty seconds; if it wasn't, it just failed.

Try the endpoint of that lesson

Our free activity Would You Click? teaches students to read a web address — and to reveal where a link actually goes versus what it shows. Swipe to Survive then puts scam texts on a timer with genuine messages mixed in, so students learn the real discriminators rather than "everything with a link is a scam". Like all our free activities, both are browser-based and login-free, and produce no record — a taster for the classroom, not the platform.

What to teach

Six messages that outlive any scam format

Scam formats churn weekly — this term's fake giveaway is next term's fake job offer. These don't:

Every scam has the same skeleton

Pressure ("your account will be closed"), urgency ("in the next 24 hours") and an ask — money, a code, a login, bank details. Teach students to name all three in any example and new scam formats classify themselves.

"Looks legit" proves nothing

Fluent English, real logos and a real-looking web address are all free to fake — and a link's visible text says nothing about where it goes. Judge a message by what it wants from you, never by how professional it looks.

Go direct — every time

The universal safe move: don't tap the link, don't call the number in the message. Open the official app, type the address you know, ring the number on the card. One habit, thirty seconds — and it blocks the link-and-callback phishing that makes up most of what students meet.

The offer itself is the tell

A giveaway that DMs you, half-price tickets from a stranger, a "flip" that doubles your money: too good to be true isn't a cliché, it's data. If the deal only exists in this message, right now — that's the reason why.

"Easy money" can mean money muling

Letting someone route money through your account is money laundering, whatever the DM called it — with serious banking and legal consequences for those knowingly involved. Under-21s were behind about one in five money-mule cases flagged to Cifas in early 2023 — and a groomed or pressured student is a victim to safeguard, not blame.

Scammed is not stupid

Scams attack attention, not intelligence — and nearly half of UK 8–17-year-olds have been caught too. Build no-blame reporting: tell an adult, forward scam texts to 7726 (free on every UK network) and scam emails to report@phishing.gov.uk.

The landscape

The scams actually reaching teenagers

Teenagers don't get the same scam mix as adults — less HMRC and pension fraud, far more of what fits their platforms and their money. The Safer Internet Day research and our own monitoring of UK teen scams point at the same shortlist:

Fake giveaways and freebies

Among the most common scams young people report: a brand or influencer "giveaway" that ends at a form wanting card details or a login "to verify your account". The prize is the pressure; the form is the ask.

Ticket and purchase scams

Concert tickets, trainers and tech at too-good prices, paid by bank transfer to a seller who vanishes. Timed to tour on-sales and drops — and usually the first scam that costs a teenager real money.

Gaming: trades and account theft

Free skins and currency, "trust trades" that end with an empty inventory, and fake login pages for game accounts. Games are the third most common place 8–17s meet scams — and for younger teens, the account is the prize.

Delivery, bank and "fee" texts

A parcel needing a £1.49 redelivery fee; a bank "alert" needing your details. The small fee is bait — the card details are the harvest. The tell is never how the link looks; it's the fee, the urgency and the ask.

Money-mule recruitment

"Easy money" posts and DMs offering cash to receive and pass on a transfer — with recruitment on social media and in person outside schools and colleges (Cifas). Saying yes carries real legal risk; a coerced or groomed teenager needs safeguarding, not blame.

Sextortion

The fastest-escalating and most dangerous: flirtation to image to blackmail, sometimes within an hour, aimed mostly at boys. It needs its own lesson and its own incident response — see our sextortion guide.

What's circulating this term

The mix shifts faster than any scheme of work. Our On the Radar page tracks scam formats aimed at UK teens right now — human-reviewed before anything is published — and works as a ready-made lesson starter: what's the pressure, what's the urgency, what's the ask?

Sequencing

Where it fits at KS3 and KS4

Like every topic in a sequenced online safety curriculum, scam awareness builds: KS3 installs the reflexes on the low-stakes scams students already meet, KS4 raises the stakes as the money gets real — first bank accounts, first wages, first independence.

Key stage 3

Install the reflexes

The skeleton: pressure, urgency and the ask — name all three in any example, however it's dressed
Go direct as a habit: never act on the message — open the app or type the address yourself
What a web address actually tells you — and what a link's visible text can never prove
The scams they meet now: fake giveaways, game trades and account phishing
No-blame reporting: tell an adult early, and forward scam texts to 7726

Key stage 4

Raise the stakes

Purchase and ticket scams — bank transfer as the red flag, and why "buyer protection" isn't a slogan
Money muling and the law: what "letting a mate use your account" actually is, what it can cost — and when it's exploitation that needs safeguarding
Investment "flips", crypto "opportunities" and fake jobs — reading the incentive behind the offer
AI-boosted scams: cloned voices and celebrity-deepfake endorsements — the same skeleton in a better mask (see our deepfakes teaching guide)
Sextortion — the scam playbook applied to images, and exactly what to do if it happens

Sources

Go deeper

RSHE statutory guidance (2025 update)

DfE — names scams, fraud and financial exploitation in the content secondary schools must cover from September 2026

Safer Internet Day 2025 research

UK Safer Internet Centre — the Censuswide survey of 2,013 UK 8–17-year-olds behind the statistics in this guide

Money mules: Cifas and UK Finance

The under-21 money-mule figures (first half of 2023), how recruitment works — and free lesson plans and assembly resources for schools

Phishing scams: recognising and reporting

NCSC — official guidance on scam emails, texts, calls, websites and adverts, including the 7726 and report@phishing.gov.uk routes

Report Fraud

City of London Police — the fraud reporting service that replaced Action Fraud from December 2025, covering England, Wales and Northern Ireland

Online safety lessons for KS3 and KS4

Cloak — where scam awareness sits in a sequenced online safety curriculum

Sextortion: what schools need to know

Cloak — the scam that needs its own lesson and its own incident response

Teaching deepfakes and AI-generated content

Cloak — the AI layer now being bolted onto ordinary scam scripts