Sextortion, which is the one to know about
Financially motivated sexual extortion is the threat that has changed the picture, and it is aimed overwhelmingly at boys aged fourteen to seventeen and young men in their twenties. Most parents have never heard of it, and most of the warnings teenagers have absorbed are about the wrong risk and the wrong sex of victim.
The pattern is consistent enough to describe exactly. Contact comes from an account that looks like a girl of about the same age — either an unfamiliar account or the hacked account of someone genuinely known. The conversation turns sexual quickly, often with an image sent first to make it seem reciprocal. It moves onto a private encrypted messaging app. An image or video is obtained. Then the tone changes within minutes: a demand for money, usually by transfer, gift card or cryptocurrency, backed by a screenshot of the image alongside the victim's friends list and family members, and a threat to send it to all of them. It is organised crime, usually run from overseas, and the people doing it work at volume.
What matters is the response, and it is counter-intuitive at every step.
- Do not pay. Paying does not stop it. It identifies a victim who will pay, and the demands continue. Where money has already been sent, the advice is to send no more.
- Do not delete anything. The instinct to wipe the messages and the images destroys the evidence. Social media accounts can be deactivated rather than deleted, because deletion can make the data unrecoverable.
- Block, and stop all contact on every platform. No reply, no negotiation, no explanation.
- Report. Under-eighteens can speak to any trusted adult, who can report to the police, or use the CEOP Safety Centre directly if there is no adult they can face. Adults report to the police on 101, or 999 if there is immediate risk.
- Get the images taken down. Report Remove, run jointly by the Internet Watch Foundation and Childline, lets anyone under eighteen report an image for removal across the internet, with a Childline counsellor supporting them through it and keeping them informed. It is free and it works.
And the thing that needs saying out loud, because the shame is what keeps a teenager quiet and quiet is what the criminals are relying on: it is not the victim's fault. They were targeted by professionals using a script that works on adults too. The National Crime Agency puts it in exactly those terms.
For a parent, the response that helps is calm and immediate — no shouting, no removal of the phone as a punishment, no judgement about the image. The Internet Watch Foundation is explicit that children stay silent precisely because they expect to lose their devices, and that expectation causes more harm than the image does.
Nudes between teenagers, and the law
This is where parents most often get the facts wrong in a way that makes things worse.
Creating or sharing a sexual image of anyone under eighteen is an offence in the UK, under the Protection of Children Act 1978 in England and Wales, with equivalent provisions in Scotland and Northern Ireland. That applies to images children take of themselves and of each other. Sharing someone's private sexual images with intent to cause distress is a separate offence under the Online Safety Act 2023, and sexual communication with a child under sixteen is an offence under the Serious Crime Act 2015.
But the law exists to protect children, not to prosecute them, and the system reflects that. Since 2016, police in England and Wales have been able to use Outcome 21, which records that a crime took place while formally deciding that action against the child is not in the public interest. It is intended for exactly these cases — not abusive, not persistent, no exploitation, no profit motive, no malice. Such records are unlikely to show up on later vetting checks, though that is not an absolute guarantee. Police in Scotland and Northern Ireland cannot use Outcome 21 but are similarly unlikely to prosecute a child where it is not in the public interest.
The practical consequence is the point. A teenager who believes they will be arrested for sending a picture will not tell anyone, which is the condition under which blackmail works. Knowing that the law is pointed at the adults and not at them makes disclosure possible.
Worth knowing too that AI now features in this routinely: ordinary clothed photographs from a public account can be altered into fake nudes and used for blackmail, which means a teenager who has never sent anything can still be targeted.
Why password surveillance backfires
Older advice on this subject routinely recommended demanding a teenager's password and reading their messages. It is worth saying plainly why that is a poor trade.
Monitoring of that kind buys a limited and decaying amount of visibility, because a teenager who expects to be read simply moves the conversation somewhere else, and there is always somewhere else. What it costs is the thing that actually protects them: the willingness to come and say that something has gone wrong. A fifteen-year-old being blackmailed at eleven at night does not need a parent who has been reading their messages. They need a parent they are prepared to wake up.
Which is not an argument for no oversight at all. Age-appropriate restrictions on a younger child's device are reasonable and normal, and so is knowing which platforms are in use. The distinction worth holding is between structure, which is fine, and covert reading, which trades a lot of trust for very little information.
Settings that are actually worth changing
Most privacy advice is a long list that nobody completes. These are the ones that bear on the threats above.
- Who can send a message or a request. Restricting direct messages to existing contacts removes the opening move of almost every sextortion approach.
- Who can see the friends or followers list. This is the specific thing that makes the blackmail threat credible — without visible contacts, the threat to send an image to everyone they know loses most of its force.
- Location off, in the camera app as well as the social apps, and no live location sharing with anyone outside a short known list.
- Accounts private, which also limits the supply of photographs available to be altered.
- Two-factor authentication, because a hacked account of a real friend is one of the standard approach routes, and the friend in that story is someone else's child.
Bullying, and the part that is not criminal
Most online harm to teenagers is not organised crime. It is other teenagers — exclusion from group chats, screenshots circulated, a photograph shared as a joke, pile-ons that run for weeks. It is relentless in a way that playground bullying was not, because it follows a child home and into their bed.
The useful responses are unglamorous: screenshots kept with dates, the platform's own report and block tools used, and the school's designated safeguarding lead involved, since online bullying between pupils is squarely within a school's remit even when it happens at the weekend. Where there are threats of violence, or the sharing of sexual images, it stops being a school matter and becomes a police one.
Childline is on 0800 1111, free and confidential, and for adults the NSPCC helpline is on 0808 800 5000. Both are worth having in a phone before they are needed.
What platforms now have to do
The regulatory position has changed and is worth knowing, if only to calibrate expectations. The Online Safety Act 2023 placed duties on platforms to protect children, enforced by Ofcom, and since 2025 sites hosting pornography and other content harmful to children have been required to use age checks rather than a tick-box declaration. Platforms also have duties around the material pushed at children's feeds.
What this does not do is make any of the above unnecessary. Age assurance is uneven in practice, determined teenagers get round it, and none of it touches a direct message from a stranger pretending to be sixteen.
The conversation that works
Research on this is consistent and slightly deflating: the thing that predicts whether a teenager discloses is not how many talks they have had about online safety, but whether they expect to be helped rather than punished.
Which makes the most valuable sentence a short and specific one, said in advance and more than once — that if anything online goes wrong, however it started and whatever they sent, the response will be to help sort it out, and the phone will not be taken away for it. That is a promise worth keeping on the night it gets tested, because it only works once.
The National Crime Agency publishes current guidance on sextortion for both victims and parents, and the Internet Watch Foundation sets out what to do first, including the advice not to delete anything.