A 13-year-old in Bangalore loses ₹800 to a “free Roblox skins” Discord bot. A 15-year-old in Delhi gets ₹2,400 stolen via a fake gaming top-up site. A 12-year-old in Hyderabad shares an OTP and a parent’s UPI account is drained of ₹35,000 before they notice.

We see these stories every week in Junio support. They’re not rare and they’re not the result of bad parenting. The internet has gotten more sophisticated than what most family conversations cover, and Indian kids — heavy users of WhatsApp, Instagram, YouTube, Discord, and the gaming ecosystem — are exposed to scam attempts almost daily.

This is a practical playbook: the patterns, the conversation, the tooling, and what to do if money is lost. Written for parents and useful enough that older kids can read it themselves.

The four scam patterns to know

Most online scams targeting Indian kids cluster into four shapes. Once your child can name them, they’re 80% of the way to safety.

Pattern 1: “Free in-game stuff” scams

The promise: free Robux, free V-Bucks, free Free Fire diamonds, free PUBG UC, free FIFA points. Show up as Discord bots, YouTube videos, Instagram DMs, fake websites that look exactly like the real game’s site.

The hook: “Just enter your account ID and a captcha — we’ll add free credits in 24 hours.” Sometimes it’s “Verify with a small ₹50 payment to unlock the freebie.”

What’s actually happening: account theft (they take over the gaming account and resell it), or small-payment scam (the ₹50 “verification” goes to them and the freebie never comes), or worse — phishing for the parent’s UPI / OTP via a redirect.

The rule for kids: No legitimate game gives free in-app currency for entering your ID anywhere outside the game itself. If a “free” offer requires a website, payment, OTP, or account ID — it’s a scam. 100% of the time.

Pattern 2: Fake e-commerce / fake gaming top-up sites

The kid wants to buy something — game credits, sneakers, an action figure, a course. They Google it. Click an Instagram ad or a Google ad. Land on a site that looks legitimate. Pay via UPI. Receive nothing. The seller disappears.

The hook: prices 30-60% below normal. Stock that’s “selling out fast.” Urgency banners.

The rule: Buy game currency only inside the game’s own app, or from the company’s own website. For other shopping, stick to known marketplaces (Amazon, Flipkart, Myntra, Croma, Reliance Digital). Never buy from a Google ad without checking the URL is the actual brand’s site.

Pattern 3: OTP / UPI handle scams

The kid gets a call or a WhatsApp message: “I’m calling from [bank/Junio/Transcorp/PhonePe]. We’ve detected an issue. Please share the OTP to fix it.” Or: “I’ll send you ₹500 — share your UPI PIN to receive it.”

What’s actually happening: the scammer is initiating a debit against the kid’s (or parent’s) account using stolen card details, and the OTP / UPI PIN is the final consent step. The moment it’s shared, the money is gone.

The rule: You never need an OTP or UPI PIN to receive money. Only to send it. Anyone asking for an OTP is asking permission to take money from you. Period. The kid should learn this exact sentence and repeat it like a reflex.

The follow-up rule: real Junio / bank / payment company support will never call you out of the blue and ask for OTPs. Real support resolves issues in-app or via email, with no urgency. Anyone urgent is fake.

Pattern 4: Social-engineering on chat platforms

A “friend of a friend” on Instagram or Discord befriends the kid over a few weeks. Eventually asks a small favour — “Can you send ₹500, I’ll send you back ₹600 next week?” or “Can you receive a payment for me, I’ll forward it to you minus a small cut?”

The first one steals ₹500. The second one launders money through the kid’s account, which can result in the bank/PPI freezing the account and treating the kid as suspect.

The rule: Money never moves between you and people you’ve only met online, regardless of how nice they seem. Even small amounts. Even when “they’ll send back more.” Real friendships don’t need this kind of test.

The conversation to have

Not a formal lecture. A regular, low-key set of family rules that get repeated until they stick.

A short version that works:

Online money rules in this family:

  1. If anything online promises free money, free game stuff, or sounds too good — it’s a scam. Always.
  2. If anyone asks for an OTP or UPI PIN — even if they say they’re from the bank — it’s a scam. Always.
  3. If anyone asks you to send money to them online — even a friend of a friend — talk to me first. No exceptions.
  4. If you mess up and lose money, tell me immediately. I won’t be angry. We’ll fix it. The faster you tell me, the more we can recover.

Repeat point 4 often. The reason kids hide scam losses for weeks isn’t that they don’t trust you — it’s that they’re embarrassed. They think they should have known. Make it explicit that the expectation is to tell you, not that they should never make a mistake.

Tooling that helps (without being controlling)

A few specific things that reduce risk without making the kid feel surveilled:

On the kid’s phone:

  • Disable in-app purchases without password authentication. (iOS: Screen Time → Content & Privacy. Android: Google Play → Settings → Authentication.) This stops accidental ₹3,000 game purchases.
  • Install a known ad-blocker for the browser they use most. Removes most fake-ad scams from the surface.
  • Don’t let them save your UPI app password / fingerprint on their phone. Their UPI = their PPI card only.

On the Junio card:

  • The card’s natural balance limits already act as a cap on damage. A scammer can’t drain ₹50,000 from a card that only has ₹1,000 on it.
  • Use the in-app spending limits: per-transaction limits, daily limits, merchant category limits.
  • Keep V-KYC unlocked — the higher limits also enable the better fraud-detection signals.

For the parent’s account:

  • Never link your primary bank UPI directly to the kid’s phone. Always use the kid’s PPI card as the intermediate layer. Smaller blast radius if anything goes wrong.
  • Set transaction notifications on your bank app — not the kid’s phone, yours. You want a passive feed of what’s happening.

Get the Junio app. Spending limits, transaction notifications, and the natural ₹10,000 / ₹2 lakh PPI ceilings are built in. Download Junio.

If money is lost — the recovery playbook

Speed matters. Here’s the order of operations:

Within minutes of finding out:

  1. Block the card in the Junio app (or your bank app, if it was a bank-card scam). One tap. Stops further losses immediately.
  2. Note down the exact amount, time, and merchant / receiver UPI handle if visible. Take screenshots of everything — the transaction, any chat messages, the website URL.

Within an hour:

  1. Call your bank / Junio support to report. They’ll lodge a formal complaint. Get a complaint reference number.
  2. File a complaint at cybercrime.gov.in — the Indian government’s cyber crime portal. There’s also a 1930 helpline. The earlier you file, the higher the chance of recovery.

Within a day:

  1. If the amount is significant (₹10,000+), file an FIR at the local cyber-crime cell. Bring screenshots and the complaint reference.
  2. Follow up with the bank / Junio every 48 hours until resolved. The faster you push, the better.

Recovery rates in India for online fraud have been improving — banks have been mandated to refund unauthorised transactions reported within specific windows. Smaller scams (₹500-2,000) usually don’t recover. Larger ones (₹10,000+) often do, partly. The Cyber Crime Coordination Centre at cybercrime.gov.in is the highest-leverage filing.

What we tell parents who feel guilty about a scam

Almost every parent reaches out the first time embarrassed. “I should have caught it.” “I should have set up better controls.” “The kid should have known.”

The honest framing: scams are a tax on participating in the modern internet. Your child is going to encounter dozens over the next decade. The goal isn’t to prevent every single one — it’s to keep the cost of any individual one low, and to make sure your child reports them quickly so each one gets less expensive than the last.

A 13-year-old who lost ₹800 once, learned the lesson, and now spots scams in 5 seconds is well ahead of the parent’s adult colleague who falls for the same pattern at 38 because nobody ever taught them. Treat the early small loss as the school fee for a lifelong skill.

A short list to print and stick somewhere

  • Free game stuff for entering your ID = scam.
  • Anyone asking for OTP / UPI PIN = scam.
  • Online “friend” asking to send / receive money = scam.
  • Game credits only inside the game itself.
  • Tell parents fast if anything weird happens.
  • Block card → call support → file at cybercrime.gov.in → FIR if significant.

If your kid can repeat these from memory, you’ve done the work.