Almost every scam aimed at Indian kids right now has the same opening line, in one form or another: you’ve won something. Free diamonds. Free UC. A limited-time top-up bonus. It arrives in a game chat, a YouTube comment, a WhatsApp forward from a classmate, or a pop-up on a site your child landed on while looking for a mod.
It works because it isn’t really asking for money. It’s asking for a login. And a twelve-year-old who has spent six months grinding for in-game currency will click something for free currency far faster than they’d hand over ₹500.
I want to lay out the exact shape this scam takes, because once you’ve seen the skeleton, it’s recognisable every time.
The anatomy of the reward scam
There are only about four moving parts, and they’re always in the same order.
The bait is currency, not cash. It’s diamonds, UC, V-Bucks, coins, skins — something with real value inside the child’s game but no obvious price tag attached. This is deliberate. Kids have been told not to give out card details; almost nobody has told them not to give out a game login.
The branding looks right. Correct logo, correct colours, a URL that’s one character off from the real one. These pages are cheap to make and they are not crude. Assuming your child will “just tell” a fake site is optimistic — some of them look better than the official ones.
There’s a clock. “Claim in the next 10 minutes.” “Only 43 rewards left.” Urgency exists to stop the one thing that kills the scam, which is your child pausing to ask someone.
The ask is a login, an OTP, or a “small verification payment.” This is where it lands. Sometimes it’s the game username and password, which hands over an account the child may have spent years and real money on. Sometimes it’s an OTP — and an OTP means a payment is already in motion somewhere. And sometimes it’s a ₹10 “verification charge,” which exists purely to capture card details for much larger charges later.
The pattern that does the most damage in India isn’t the one-off ₹500 loss. It’s the slow one: a child uses a parent’s saved payment method on a family phone or console account, small amounts leave every month, and nobody checks the statement closely until it’s been running for half a year. Reported cases have run into lakhs by the time anyone noticed. Not one dramatic theft — just a small leak nobody was watching.
The two rules that actually work
You cannot teach a child to evaluate every link on the internet. What you can do is give them two rules that are short enough to remember under pressure.
Rule one: real rewards never happen outside the game. Every legitimate top-up, reward, or event lives inside the game’s own app or its official store. If a reward requires you to leave the game and log in somewhere else, it is a scam. Not “might be” — is. That’s a clean, binary test a nine-year-old can apply without understanding a single thing about phishing.
Rule two: nobody ever needs your login or your OTP to give you something. This is worth saying in exactly those words, because it generalises. Giving is not a two-way transaction. If someone wants your password or a code from your phone in order to hand you a gift, they are not handing you a gift.
Two sentences. That’s the whole defence, and it covers the overwhelming majority of what’s circulating.
Get the Junio app. Your child spends from a balance you load, and every transaction pings your phone as it happens — so nothing runs quietly in the background. Set up Junio.
There’s a structural point here too, and it’s the reason I care about this more than most scam patterns. The gaming-scam damage is almost always proportional to what the child can reach. A kid paying from a parent’s card that’s saved in a console account can, in principle, reach the whole account. A kid paying from a prepaid card with ₹800 on it can reach ₹800. That’s not a lecture about vigilance — it’s just a smaller blast radius by design. And with a card whose transactions notify you in real time, the slow-leak version of this scam doesn’t get six months of cover. You see the second charge, not the fortieth.
Make it safe to come and tell you
This is the part parents get wrong most often, myself included on occasion.
Roughly four in five of these incidents in India go unreported, and the reason isn’t technical. It’s that the child is embarrassed and expects to be in trouble. So they say nothing, and the account stays compromised, and the charges keep going.
The single most useful thing you can do is make the reporting cost zero, before anything happens. In our house the deal is stated plainly to my daughter: if you click something you shouldn’t have, tell me the same day and there is no punishment — full stop, no exceptions, no “we’ll discuss it later.” The only thing that gets a reaction is hiding it.
That’s not indulgence. It’s arithmetic. A scam reported within an hour usually means a changed password and nothing else. The same scam reported in March because it happened in September is a different problem entirely. I would rather trade the satisfaction of being annoyed for six months of early warning.
And if it does happen: change the game password immediately, change any password reused elsewhere, remove saved payment methods from the account, check the last few months of statements rather than just the last few days, and report it on the national cybercrime portal or the 1930 helpline if money has actually moved.
Skip this if…
If your child plays only offline or single-player games with no in-game store, no chat, and no account login, this particular pattern doesn’t really reach them and you can file it away for later. The scam needs three ingredients — an account worth stealing, a way to message your child, and an in-game currency they want. Remove any one and it has nothing to work with.
But if your child plays anything online with a store attached, assume the message is coming. It will be well-designed, it will be urgent, and it will be free. Teach the two rules, keep the blast radius small, and make it easy to be told.
Have a scam pattern you’d like us to break down? Email [email protected].