Rules
Sextortion scripts teens see on Instagram and Snapchat: a parent's read
A parent's read of the opening lines and escalation scripts strangers use on Instagram and Snapchat, the first-hour steps, and how to lock the account down.
What to take away
- Sextortion scripts usually open as a compliment, a wrong-number message, or a reply to a story, not as a threat.
- The image request lands within minutes, and the threat follows once the photo leaves the phone.
- Save the username, the thread screenshots, and any payment handle before blocking the account.
- Reports go to NCMEC's CyberTipline and, when identity details are used, to the FTC.
- Talk first, then secure the account with new passwords, two factor authentication, and recovery codes.
Opening lines that appear in teen inboxes
A script rarely starts with a demand. The first message flatters a hobby, a pet, or a photo the teen posted. The account behind it often looks thin, with one or two pictures and a bio that says almost nothing.
Instagram and Snapchat both let strangers message an account that does not follow them back. On Snapchat, a fresh friend request plus a quick compliment is a common opening. The request for a picture usually arrives in the same chat.
The escalation script, stage by stage
Most sextortion scripts teens see move through six stages in under an hour, and the first three stages look friendly.
Six-stage sextortion script
- Opener: low stakes chat
- Flattery: build trust quickly
- Trade: make the swap feel fair
- Ask: collect the image
- Threat: demand money or images
- Deadline: stop the teen thinking
The escalation script
| Stage | Message a teen sees | Purpose |
|---|---|---|
| Opener | "You look familiar, do I know you?" | Start a low stakes chat |
| Flattery | "You are prettier than the girls here." | Build trust quickly |
| Trade | A photo presented as the sender's own | Make the swap feel fair |
| Ask | "Send one and I will send more." | Collect the image |
| Threat | "I screenshotted everything." | Demand money or more images |
| Deadline | "You have ten minutes." | Stop the teen from thinking |
The traded photo usually belongs to someone else. The threat arrives within minutes of the send, which leaves little time for a teen to pause and ask an adult.
Some threats skip the photo request and open with a generated image, because deepfake nudes can be built from a handful of ordinary pictures.
Example: one thread on Snapchat
"Hey, is that a corgi in your story?" "You are prettier than the girls at my school." "Send one and I will send mine first, promise." "I have your screenshot. Pay me tonight or I post it."
Read on a lock screen, the first three lines look like ordinary flirting. The fourth line names the harm, and by then the picture is already saved on another phone.
Teen sextortion warning signs in the inbox
Warning signs in the inbox
- Open the message requests folder on Instagram and Snapchat, not only the main inbox.
- Search the chat for the words photo, money, post, and send.
- Flag accounts with one picture, a common first name, and almost no followers.
- Write down any payment app handle that appears in the thread.
You do not have to read every message alone. Sit beside your teen and let them scroll, so the account stays under their control while you look together.
The first hour after a nude is sent
The first hour
- Say out loud that the picture is not the emergency and that you are not leaving.
- Screenshot the full thread, including the username and the timestamps.
- Do not send money. A payment usually raises the next demand.
- Block the account only after the screenshots are saved somewhere else.
- Change the password on the account and sign out every other device.
- Report the account on the platform, then file with NCMEC's CyberTipline.
Keep the phone in the room that night, but do not treat it as evidence to be seized. Teens who lose the phone often stop telling adults about the next message.
First hour after a nude
- Say the picture is not the emergency
- Screenshot the full thread
- Do not send money
- Block only after saving screenshots
- Change password and sign out devices
- Report to platform and CyberTipline
Before any consequence gets discussed, work through six points worth checking, since a threat like this often brings sleep loss and panic.
Reporting a demand without losing the evidence
NCMEC's CyberTipline takes reports from parents and from teens, and it passes them to law enforcement. Filing takes a few minutes and does not require the image itself.
When a stranger also holds a name, a school, or a bank handle, treat it as identity theft. The FTC's identity theft topic page explains how misuse of personal images and stolen details gets reported and handled.
Keep one folder with the screenshots, the usernames, and the dates. Platforms move faster when a report includes a case number from the CyberTipline.
Mental wellbeing and the age question
A threatened teen may hide the phone, skip meals, or avoid school. Ask about sleep, mood, and appetite for the next two weeks, and call a clinician the same day if self harm comes up.
Treat age-by-age guidance as a handover, not a table of fixed ages, because a 13 year old and a 17 year old hold different parts of the decision.
Keep the mental wellbeing rules in view too, since a school counselor, a clinician, and a parent each record different things about a teen.
Locking the account down after the report
Two factor authentication with an app beats a text code, because a swapped SIM defeats texts. NIST's digital identity guidelines recommend long passwords and screening new passwords against known breach lists.
Lock the account down
- Use app-based two-factor authentication
- Avoid text-code two-factor
- Choose long passwords
- Screen passwords against breach lists
- Store recovery codes offline
A password manager for teens comparison is the next stop, with family plan prices in USD and setup steps for both tools.
Store recovery codes somewhere offline. Dashlane and Bitwarden both leave a gap when a teen loses the only device that holds the vault, so write the code down.
