Cyber safety for ages 8–12

The missions

1. 🔑 Password Power-Up

   Passphrases & password managers

   Silly-word passphrases, a different password for every account, and how password managers help.

   What it teaches, and talking points for home

   Passphrases (the NCSC "three random words" approach), not reusing passwords, data breaches, and what a password manager is.

   • Consider a family password manager plan. Many include child accounts you can oversee.
   • Check whether your family’s email addresses appear in known breaches at haveibeenpwned.com.
   • Agree that your child tells you if they think an account has been taken over.

2. 🎣 Spot the Phish

   Phishing & fake links

   Check the sender, check the link, and go to the real app or website yourself.

   What it teaches, and talking points for home

   Recognising phishing by sender, link and emotional pressure; look-alike domains; phishing from compromised friends’ accounts; and what to do after a mis-click.

   • Forward suspicious emails to report@phishing.gov.uk and texts to 7726. Show your child how.
   • Practise reading a link together: the real site is the bit just before the first single slash.
   • Make it clear they’ll never be in trouble for owning up to a mis-click.

3. 🎮 Free Game Cash? Nope.

   Gaming scams & in-game spending

   Free currency generators, trading scams and fake admins, and why your login is never part of a deal.

   What it teaches, and talking points for home

   Common gaming scams (currency generators, trade scams, fake moderators, chat-server links), account takeover, and asking before spending.

   • Turn on two-step verification on their game and console accounts (most big gaming platforms support it).
   • Set spending limits or require approval for purchases on consoles and app stores.
   • Find out which apps and servers they use to chat with other players, and check the age requirements and settings.

4. 👣 Your Digital Footprint

   Posting, sharing & privacy settings

   Everything you post leaves a trail. Think before you share, and lock down your settings.

   What it teaches, and talking points for home

   Digital footprint, screenshots, location sharing, privacy settings, and pausing before posting.

   • Most social media requires users to be 13+. Talk about which apps are allowed and why.
   • Go through privacy and location settings together on the apps they use, including live map and location-sharing features.
   • Search your child’s name online together and see what comes up.

5. 💬 Be Kind Online

   Cyberbullying

   What cyberbullying is, what to do if it happens, and how to be an upstander.

   What it teaches, and talking points for home

   What cyberbullying is, the screenshot–block–report–tell steps, being an upstander, and where to get help (including Childline).

   • Reassure them that telling you won’t mean losing their phone or console. Fear of that is the main reason children stay quiet.
   • If it involves classmates, the school has a duty to act on bullying, including online.
   • Show them where the report and block buttons are on the apps they use.

6. 🎭 Who's Really There?

   Fake profiles & warning signs

   People online can fake who they are. Know the warning signs and always tell a trusted adult.

   What it teaches, and talking points for home

   That online identities can be faked, the main grooming warning signs (secrecy, moving to private platforms, gifts, requests for images or personal information, meeting up), and how to block, report and tell.

   • Keep the tone calm and practical so they feel able to come to you.
   • CEOP (ceop.police.uk) is where to report concerns about online sexual abuse or grooming. Thinkuknow has age-appropriate resources.
   • Check who can message your child on each platform and restrict it to friends where possible.

7. 🤖 Real or Fake?

   AI, deepfakes & influencers

   AI can fake pictures, voices and videos, chatbots can be wrong, and influencers are often paid.

   What it teaches, and talking points for home

   What deepfakes are, how to check sources, the limits of AI chatbots (accuracy and privacy), and spotting paid influencer content.

   • Many AI chatbots have minimum ages (often 13+). Check the terms of any your child uses.
   • Look at a sponsored influencer post together and talk about how it’s designed to persuade.
   • Agree a family code word to use if someone ever calls claiming to be a family member in trouble. AI voice cloning scams exist.

8. 🔐 Two-Step Verification

   MFA & authenticator apps

   Add a second step to your accounts, never share codes, and know what an unexpected code means.

   What it teaches, and talking points for home

   Multi-factor authentication, authenticator apps and passkeys, never sharing codes, and what an unexpected code means.

   • Set up two-step verification together on their game, email and app store accounts. Consider using your phone for the codes while they are young.
   • Check your own accounts too: email, banking and social media.
   • Explain how scammers try to get codes by pretending to be support.

9. 🛠️ Updates, Apps & Wi-Fi

   Device security

   Install updates, question app permissions, and be careful on public Wi-Fi.

   What it teaches, and talking points for home

   Vulnerabilities and patching, official app stores and app permissions, public Wi-Fi risks, and what HTTPS does and doesn’t mean.

   • Turn on automatic updates and check older devices still receive security updates.
   • Review app permissions on your child’s device together (look in the device’s Settings, under Privacy or Apps, then Permissions).
   • Your home router needs updates too, and the default admin password should be changed.

10. 👀 Peekers, Log-outs & Warnings

    Shoulder surfing, shared devices, browser warnings & anti-malware

    Sign out on shared devices, stop shoulder surfers, trust real browser warnings, and keep anti-malware scanning.

    What it teaches, and talking points for home

    Signing out and not saving passwords on shared devices, locking screens, shoulder surfing, the difference between real browser warnings and fake “virus” pop-ups, and keeping anti-malware on, updated and scanning regularly.

    • Check the family computer’s built-in security is switched on, updating, and running a scheduled scan (daily quick scans are a good habit).
    • Agree a rule for shared and school devices: sign out, close the browser, never tick “Remember me”.
    • Agree what to do if a browser warning or a scary pop-up appears: go back or close the page, don’t call any number, and come and tell you.

11. 🚦 Is That Allowed?

    The Computer Misuse Act: everyday things that cross the line

    Knowing a password isn’t permission. Spot the everyday “jokes” and shortcuts that are actually against the law.

    What it teaches, and talking points for home

    The Computer Misuse Act in everyday situations: using someone else’s login, reading messages on a borrowed device, unlocked school computers, resetting other people’s passwords, locking people out “as a joke”, bypassing school filters, booter sites and “hacking tools”, and legal ways to explore hacking. General awareness, not legal advice.

    • Explain that the law applies to children, and that “it was a joke” or “I knew the password” doesn’t make it allowed.
    • Agree house rules for shared devices: what each person has permission to use, and that reading someone else’s messages isn’t OK.
    • If your child loves this stuff, point them to legal routes: Capture the Flag competitions, CyberFirst, and the National Crime Agency’s Cyber Choices programme.

12. 👑 Your Data, Your Rights

    UK GDPR, cookies & the Children’s Code

    You are a data subject with real legal rights, and apps have to treat children’s data with extra care.

    What it teaches, and talking points for home

    Personal data, the UK GDPR principles, data subject rights (access, rectification, erasure), the UK age of digital consent (13), the ICO’s Children’s Code, and the ICO as regulator.

    • Try a subject access request together for an app your child uses. The ICO website has a template.
    • Children have a particularly strong right to have data deleted that was collected when they were a child.
    • Look at an app’s privacy settings together and switch off anything unnecessary.

13. 🏆 Champion Challenge

    Putting it all together

    Real-life scenarios that bring every mission together.

    What it teaches, and talking points for home

    A single routine (Stop, Check, Tell) applied to mixed real-world scenarios.

    • Ask your child to teach you one thing they learned.
    • Review family settings together: two-step verification, privacy, spending controls, location sharing.
    • Celebrate the Level 2 certificate.

Teachers: every mission has a free printable lesson sheet on the For teachers page.

▶ Start Cyber Level 2