Took me 3 hours to find out my kid clicked a fake password reset link

Last Sunday I was just sitting on the couch watching football when my phone blew up with alerts from my bank app. Someone tried logging into my checking account from a city 4 states away. I froze up for a second and then checked my email history. Turns out my 14 year old got a phishing email that looked like it was from Netflix saying his password expired. He clicked the link and typed in our family email password without thinking. I spent the next 3 hours resetting every single account we own, turning on 2FA for everything, and yelling myself hoarse. The bank stopped the login attempt before it went through thank god. Now I check his browser history every few days and we had a long talk about clicking random links. Has anyone else had to clean up a mess from a family member falling for one of these?

2 comments

2 Comments

lee_bailey651mo ago

and honestly the best thing I did after my kid fell for something similar was put the family password manager on his phone instead of letting him type passwords manually. once the phishing link gets that one password they try it everywhere, so having unique generated passwords for everything saved me a ton of headache. stick with the browser check for a while too, that's smart, I set up my kid's phone to forward every link he clicks to my email for a month just to be safe.

elizabeth_king1mo ago

You mentioned the password manager idea which is solid, but here's something nobody's bringing up - you might want to check if that 14 year old has been sharing passwords with friends. My nephew did this exact thing last year, and it turned out he and his buddies all used the same password for their school accounts and gaming logins. So when one of them clicked a fake link, suddenly three families were scrambling to lock down their bank accounts and emails. The phishing scam was just the trigger, the real problem was that kid culture of "hey use my login for this game" or sharing Netflix passwords with classmates. Might want to ask yours directly if he's been swapping passwords around, because even with great 2FA, if some random friend from school has the same password and clicks something dumb, you're back to square one.