Free Skins or a Locked Phone: How Scammers Use Apple IDs to Blackmail Kids

Gaming scams have long moved past simply stealing in-game accounts. Today, attackers exploit children's trust to hijack their smartphones, and then demand money to restore access. At the heart of this new scheme is social engineering – a manipulation tactic where the victim is convinced to willingly provide access to the device.

Why Are Children the Primary Targets?

Popular online games, such as Roblox, Brawl Stars, Genshin Impact, and others, have long become a platform not only for player communication but also for scammers. Children are promised free in-game currency, rare items, skins, or fully leveled-up accounts.

As a rule, communication begins in the game chat, Telegram, or Discord. The scammer poses as an experienced player and offers a bonus for completing a few simple steps.

It is at this stage that the child faces a request to log into a stranger's Apple ID account on their iPhone or iPad to download a game, receive in-game content, or activate a gift. Many children do not understand that an Apple ID is not just a login, but a key to controlling the device.

How the Scheme Works

After the child logs into a stranger's Apple ID, the attacker gets the opportunity to use Apple services to remotely control the device.

In most cases, scammers:

1. lock the smartphone via the "Find My" service;
2. display a message on the screen claiming that the device is allegedly stolen and provide instructions to contact them;
3. demand a ransom for unlocking the device;
4. threaten to delete data or publish it.

The size of the demands can range from tens to hundreds of thousands of tenge. At the same time, even after transferring the money, scammers often continue their extortion, realizing that the family is ready to pay.

Why This Scheme Works

The main reason for the success of such attacks is not technical vulnerabilities, but the human factor.

Children are used to trusting members of gaming communities, strive to quickly gain gaming advantages, and often do not understand the consequences of transferring access to their device. That is exactly why scammers rely not on hacking, but on psychological pressure and the promise of a "free reward".

How to Protect Your Child

It is impossible to completely eliminate the risk of encountering scammers, but basic rules of digital safety can significantly reduce it.

Explain the main rule to your child: never log into a stranger's Apple ID on your phone, regardless of what the interlocutor promises.

Additionally, it is recommended to:

1. set up the "Family Sharing" feature so that purchases and content downloads are confirmed by parents;
2. add a trusted contact for restoring access to the Apple ID;
3. use a strong passcode to unlock the device;
4. explain to your child that any offers of free in-game currency, skins, or accounts from strangers require verification with adults.

What to Do If the Device Is Already Locked

If the smartphone is locked after logging into a stranger's Apple ID, it is important to act calmly. Do not transfer money to scammers. Paying the ransom does not guarantee restoring access and often leads to new demands.

Instead, it is recommended to:

1. contact official Apple Support;
2. prepare documents confirming the right of ownership of the device (receipt, box with serial number);
3. change the password for your email and Apple ID if there is a possibility the account has been compromised;
4. contact law enforcement agencies if there are signs of extortion.

The Main Rule of Cyberhygiene

Most modern cyberattacks begin not with a complex hack, but with user trust. The better children understand how fraudulent schemes work, the less likely they are to become their victims.

Regular conversations about digital safety, explaining the principles of how accounts work, and monitoring the settings of family devices help prevent such incidents and keep both personal data and access to devices safe.

Also, read our posts on Instagram and follow us: https://www.instagram.com/citizensec.kz/