September marks the beginning of a new school year; students of all ages, including children, return to classrooms to learn new subjects and build skills. Many schools integrate online learning with classroom instruction through school-issued devices with educational applications installed. This time spent learning is often balanced with online activities such as recreational gaming, social media use and connecting with peers on messaging platforms.
Technology gives kids new ways to learn, create and connect with others; but it also comes with inherent risks. Cybercriminals use tools like artificial intelligence (AI), malicious QR codes and social engineering tactics to craft highly deceptive scams that are difficult to detect, even for a skilled user. Kids often encounter fake content, suspicious messages or requests for personal information without even knowing it is a scam.
For this back-to-school season, brush up on some newer technology terms and learn how you can teach the kids in your life how to be safe online.
Be Careful With Artificial Intelligence (AI)
AI has quickly become a tool commonly leveraged by kids and adults alike. AI can summarize information, generate images and texts, answer questions and help with schoolwork. In parallel, cybercriminals can also use AI to create convincing phishing emails, social media posts and text messages. AI quickly and accurately provides fake images and realistic audio that imitate someone you or the child knows.
While AI can be useful, kids should understand that the information provided is not always accurate or trustworthy. AI creates images and videos that look real, accompanied by fabricated stories and information. Children are especially likely to trust something that looks real or sounds convincing, so it is important to teach them not to automatically believe everything they see online.
What can you do to protect yourself and your kids?
- Talk with kids about when and how they are using AI.
- Remember to not enter any personal information, school information, passwords or other sensitive details into AI tools.
- Encourage them to double-check information they receive with a trusted source.
- Explain that AI photos, videos and messages may look real, even if they are not.
- Always remind kids to tell a trusted adult if something seems strange, upsetting or too good to be true.
Quishing: A New Spin on Phishing
Quishing, or QR code phishing, leverages malicious QR codes, which send users to fraudulent websites. These websites may look legitimate but are set up to steal passwords, financial information or other sensitive data. The QR code could install malware that will steal your information before you are aware. QR codes have become a convenient way to access websites and information; you may scan one to view a restaurant menu, pay for parking, access a form or register for an event. Kids may see them as a quick and easy way to access a website, video or promotion. But not every QR code leads where users are expecting.
Since a QR code hides the website address (URL) until after it has been scanned, it can be harder to tell where it will lead. This is especially risky for kids who may be used to scanning first and asking questions later. Teach kids to treat QR codes the same way they would treat an unfamiliar link.
Before you scan:
- Consider where the QR code came from.
- Be cautious of QR codes received unexpectedly by text, email or social media.
- Check the web address that appears after scanning and before tapping it.
- Avoid entering your sensitive information or clicking any links if the URL seems unusual.
- Be cautious of QR codes that promise prizes, free items or exclusive access.
Teaching kids how to use QR codes safely is essential as they are commonly used in school. They may appear on flyers, games, advertisements and other materials that are sent home by their teachers or coaches. Encourage them to check with a trusted adult before scanning the QR code or entering personal information into a website.
Deepfakes: Seeing Isn’t Always Believing
A deepfake is an image, video or audio recording that has been manipulated or generated using AI. A deepfake can make it appear that a real person said or did something that never happened. For kids, deepfakes can be confusing because they may feature celebrities, classmates, influencers or someone they know. Fake content can be shared as a joke to embarrass or bully someone, or it can be created to trick people as part of a scam.
What to Discuss With Your kids?
- Check where the content came from before believing or sharing it.
- Ask if the account is trustworthy. Do you recognize who it belongs to? Is it really the person or organization it claims to be? If the account, image, video or messages seem unusual, notify an adult.
- As a family, create a family code word or safe word if anyone receives a phone call, text message or another communication from someone in the family claiming to need help or money.
- It is also important to remind children not to create or share fake content about other people. Even if something is meant to be a joke, it can hurt someone or spread false information quickly.
Social Engineering is Changing
Cybercriminals have long used phishing scams that rely on fear, curiosity, urgency and other emotions to convince people to click the links, share their information or act without stopping to think. Kids may be more likely to engage with a message when it involves something they care about like a favorite game, social media account or a friend. Social engineering attacks are not new, but they are now more convincing than ever before. AI assists scammers by creating polished, personalized messages without many of the spelling and grammar mistakes that have been traditionally associated with phishing attacks. Information that is publicly shared online can be used to make a message seem more believable.
Adults may see messages pretending to come from an employer or a bank, while kids may see different versions of the same tactics. A cybercriminal may pretend to be a friend, offer free game currency, claim their game account is locked or ask a kid to clink on a link to win a prize.
Teach kids to ask themselves key questions everyone should ask when receiving online messages:
- Was I expecting this message?
- Do I know this person in real life?
- Am I being promised something for free?
- Am I being pressured to act quickly?
- Is someone asking for a password, payment, verification code or any other sensitive information?
- Can I check with a parent, teacher or another trusted adult first?
- Does the request make sense based on what I know about the person or organization contacting me?
When teaching kids cybersecurity, simple rules are best: if a message is trying to rush you or scare you, stop before responding and talk to an adult.
Protecting Personal Information
Kids may not always realize how much personal information they share online. A username, sports team, school name, birthday, location tag or mention of an upcoming trip can all reveal information about a child’s identity and their routine.
Review privacy settings together with your kids and talk about what information should always be private. Encourage kids to think before posting online and remind them that once something is shared, it cannot be taken back.
Children should avoid publicly sharing their:
- Full name and address.
- Passwords.
- Phone numbers.
- School name and schedule.
- Location.
- Financial information.
- Photos that reveal specific locations, like where they live and where they regularly spend their time.
Parents and caregivers should also be considerate and wary of what they share about their children online.
Online Friends and Messages
Many kids communicate through games, school social platforms and apps. Remind children that someone online may not always be who they say they are. They should be cautious if a stranger asks them to move the conversation to a private app, keep a conversation private, send photos or share personal information. Kids should know they can always stop a conversation, block an account and tell a trusted adult (and they should be reassured that they will not get into trouble when asking for help). Keeping communication open at home can make it more comfortable for children to speak up when something online does not feel right.
Back to the Basics
Even though the threats may change, having good cybersecurity habits will go a long way in keeping everyone, including kids, safe online.
- Use strong, unique passwords.
- Enable multifactor authentication (MFA) whenever possible.
- Keep all devices and software up to date.
- Be cautious with unexpected emails, text messages, attachments, links and QR codes.
- Use parental controls and privacy settings and review them periodically as kids get older or when they start using a new platform.
- Instruct kids on how to report suspicious or harmful content on the platforms they use.
For families, back to school is the perfect time to sit down and review the kid’s devices and accounts that they use for school and at home. The most important thing is to remind kids that they do not have to figure everything out on their own. Cybersecurity is something we all continue to learn, no matter our age. Helping kids build good online habits will give them the skills they need to make safer choices at home, at school and wherever their technology takes them.
Cyber Habit of the Month: Go Straight to the Source
Knowing how to find and navigate an official website is an important skill for adults and kids alike. Instead of clicking on a link found through an unexpected email, text message, social media post or QR code, make it a habit to go directly to the organization’s official website.
- Identify the organization, school, business or government agency you need to reach.
- Look closely at the domain name in a link. Watch for misspellings, extra words or unusual characters. For example, government websites will often use “.gov” for their trusted domain.
- Once you’ve reached the official site, use its menu, search feature or other navigation tools to find the page, service or information you need.
- A website appearing at the top of a search does not automatically mean it is the official website. Check the web address before clicking.
- If you aren’t sure if the website is legitimate, stop before entering a password, making a payment or providing any personal information.
Practice with your kids, and show them how to recognize a secure website address (look for the lock symbol in the URL bar), find the official homepage and use the site’s navigation instead of clicking on the first link they see.
Don’t just follow the link; find the source!
Additional Resources:
