Catfishing and Online Manipulation: A Parent's Guide to Protecting a Vulnerable Teen

What catfishing really is

The word entered ordinary conversation through entertainment. A 2010 documentary, then a long-running television series, fixed the term in the public mind as a format: a hopeful person, an online sweetheart who is not quite who they claim, a confrontation, a reveal. The story was usually framed as a curiosity, occasionally as a comedy, and almost always as something that happened to other people who should have known better.

That framing is the problem. It files catfishing under entertainment, and it quietly attaches a verdict — that the target was naive — to anyone it happens to. Both ideas are wrong, and both are dangerous when the person being targeted is your child.

Catfishing is the use of a fabricated identity — an invented name, borrowed or AI-generated photographs, a manufactured backstory and personality — to build a relationship with someone under false pretenses. When the target is an adult, the fabricated identity is often a prelude to fraud, and the fraud is the point. When the target is a teenager, the fabricated identity is rarely the goal at all. It is the doorway. It is the tool that gets a manipulator past every instinct a child has, and into their emotional life.

A catfish persona costs almost nothing to build and can be reused without limit. The same photographs, the same backstory, the same opening lines and emotional script can run against dozens of teenagers at the same time, on different platforms, from anywhere in the world. This is not a romance gone wrong. It is closer to a small business, and your child is not the customer — they are the product being worked.

For that reason, this guide does not treat catfishing as a genre. It treats it as the first move in a sequence. Understand the sequence, and you can see the rest of it coming.

A common pattern: six stages of online manipulation

Online manipulation aimed at a teenager often follows recognizable patterns. Fraud investigators and child-protection specialists who debrief these cases describe a recurring arc — especially in organized sextortion, grooming, and fraud — though real cases vary in speed and sequence, and some are far more opportunistic than scripted. The arc below is a model, not a fixed timetable. It is useful because each stage exploits a normal, healthy developmental need — and nothing about it requires the teenager to be foolish.

Consider a composite, fictionalized from cases reported to investigators. A fifteen-year-old — we will call him the son — has autism-spectrum social-communication differences. He has always found friendship online easier than friendship at school. Over a few weeks his parents notice he has withdrawn, that he is guarding his phone in a way he never used to, and that he has begun mentioning a girlfriend the family has never met or seen on a call. With the boy’s knowledge, his father sits down with him and looks at the device together. What they find is not a girlfriend. The account is operated by a group; the photographs belong to someone else; the warm, attentive partner of the last month does not exist. The relationship had already moved from affection to secrecy to a first request for money, and the next step the group was steering toward would have made the boy a courier for funds stolen from other victims. His father intervened before any money changed hands, brought in the boy’s clinician and his school, and filed a report. The boy had done nothing wrong. He had been read, selected, and worked.

Stage one is contact. It is deliberately low-pressure and almost always flattering. It arrives through a game lobby, a comment on a post, a direct message that references something the teen genuinely cares about, or a friend request that shares a few mutual followers and so looks safe. Nothing alarming happens. That is the design.

Stage two is love bombing — a flood of intense, accelerated affection and attention. The manipulator tells the teen they are special, understood, and uniquely connected, far sooner and far more emphatically than any real relationship would. To a teenager who is not getting that elsewhere, it does not feel like manipulation. It feels like finally being seen.

Stage three is isolation. Secrecy is reframed as intimacy: this is our thing, your parents would not understand, your friends would be jealous. The manipulator works to become the teen’s primary confidant, because a teenager with no one else to check the story against is a teenager who cannot be talked out of it.

Stage four is dependency. The relationship becomes emotionally load-bearing. The teen reorganizes sleep, schoolwork, and moods around the other person’s availability and approval. By this point the bond is real to the teen even though the person is not, which is exactly why a blunt “they’re fake” from a parent rebounds so badly.

Stage five is the ask. Money, an explicit image, a favor, the login to an account — the first request is almost always small and is framed as proof of trust. Stage six is escalation: once one ask has been met, charm is no longer necessary. Threats and coercion take over, and the case becomes sextortion, a cycle of repeated demands, or recruitment into moving stolen money. Not every case runs the full arc in order: financial sextortion in particular often compresses or skips the middle stages, moving from first contact to the ask within hours. However it unfolds, the arc is engineered. It is not a story about a gullible child.

Scammers create fake profiles and build relationships to gain trust — and then exploit that trust. The relationship is the tool, not the goal.

— U.S. Federal Trade Commission, consumer guidance on online relationship scams

Four situations that can raise vulnerability

Any teenager can be targeted, and plenty of well-supported, confident teenagers are. But manipulators are not casting at random. They are running a numbers game, and they screen — through opening messages, through the way a teen responds, through what a public profile reveals — for the patterns that make manipulation easier and faster. Child-safety practitioners repeatedly point to four situations that can raise the risk. They are not a formal taxonomy, and they are not labels of weakness or fault. They are descriptions of need, and need is what is being exploited.

The neurodivergent teen

Teenagers on the autism spectrum, with ADHD, or with social-communication differences may face added risk, for reasons that have nothing to do with intelligence. A teen who reads language literally may not register the small inconsistencies that would alert a peer; a teen who tends to trust completely rather than provisionally has no halfway setting to fall back on; a teen who already finds offline social life effortful may find an attentive online relationship a genuine relief. Manipulators value exactly these traits, because they make a target predictable. The protective move is not to restrict the teen’s online life — for many neurodivergent teens it is a real and valuable source of connection — but to teach the specific, concrete checks in the verification section below, as rules rather than as intuitions.

The socially isolated teen

A teenager with few offline friends — after a house move, after being bullied, after a friendship group dissolved, or simply because they have not yet found their people — is not choosing online attention over a full social life. They are filling a vacuum that is real and that hurts. That is what makes the love-bombing stage so effective: it is not competing with anything. The protective work here is partly online and largely offline. A teen with even one or two solid real-world relationships has somewhere to check a story against, and someone whose absence they would notice.

The teen in a life transition

A parents’ separation, a death in the family, a new school, a serious illness — any major disruption raises a teenager’s need for stability and reassurance at precisely the moment the adults around them are most stretched and least available. This profile is unlike the others because it is temporary; the same teen may be at elevated risk for a few months and not before or after. Manipulators are good at spotting it, often because the teen has said as much in a public post. Parents navigating their own hard season are understandably depleted, but this is the window where a few minutes of unhurried, non-interrogative attention does the most good.

The teen seeking validation

This profile is the one parents most often miss, because the teen does not look vulnerable. They may be visibly social, active online, and image-conscious — and underneath it, acutely hungry for affirmation about how they look, where they rank, and whether they matter. A manipulator who supplies a private, endless, perfectly tailored stream of approval offers something the teen’s ordinary life does not, and quickly becomes the most rewarding relationship of the day. The four profiles overlap constantly, and overlap compounds risk: a neurodivergent teen who has just changed schools and is hungry for approval is being described by three of these paragraphs at once.

Warning signs you can see

Parents often assume that online manipulation is, by its nature, invisible — that the whole problem is happening inside a device they cannot read. The encrypted message itself may be out of view, but the manipulation almost always announces itself for days or weeks in a teenager’s behavior before it reaches a crisis. These signals are not exotic. They are the ordinary signs that a young person is under stress, preoccupied, or hiding something. What has changed is how often the cause is now a relationship on a screen.

• Secrecy A phone that is suddenly always face-down or carried everywhere, screens turned away or apps closed when you enter, new passcodes, or messages deleted at night but not by day.
• The unseen friend Frequent mention of a partner or close friend met online whom the family has never seen on a call and who always has a reason video chat cannot happen.
• A push to move platforms Pressure to leave the app where they met and continue on WhatsApp, Telegram, Snapchat, Discord, or another private or disappearing-message channel — one of the earliest and most common manipulation markers, because it moves the conversation somewhere harder to see.
• Sleep Late-night or all-night device use, exhaustion in the morning, waking to reply — a relationship in another time zone or with an attacker driving urgency.
• Mood swings tied to the phone Elation, anxiety, or distress that tracks notifications rather than real-world events, and irritability when separated from the device.
• Withdrawal Pulling away from family routines, hobbies, or existing friends — often the isolation stage doing its work.
• Money and gift cards Requests for money, missing cash, new gift-card purchases, or unfamiliar payment-app or crypto activity — a strong indicator that the ask stage has begun.
• A second account or device A phone you did not buy, or a duplicate account on a platform — a classic response to being told to stop.

No single item on that list is, on its own, evidence of anything. Teenagers are entitled to privacy, to bad moods, and to friends their parents have not met. What matters is clustering: two, three, or four of these signs appearing together within a short window deserves a calm, careful response. And the response begins with the relationship, not the device. Open with the young person — ask how they are, what has been on their mind, who they have been talking to — rather than with what you have noticed on a screen. The device conversation comes second. If you lead with it, you teach the lesson the manipulator has been teaching all along: that adults are a threat to be managed rather than a resource to be used.

A second, quieter class of signal is worth training yourself to notice: the change in pattern rather than the dramatic event. A teen who begins posting late at night on a platform they previously used only after school is often responding to a relationship that has started to set the rhythm of their day. A follower count that jumps by hundreds in a single week usually means the teen has been pulled into one of the networks of older accounts that harvest minors on that platform. A teen who starts deleting one particular conversation thread before bed, while leaving everything else untouched, is drawing a boundary around one specific person. None of these is a crisis, and confronting a teen with any one of them as an accusation will backfire. Each is simply worth a gentle, curious question. The hardest signal of all is the absence of one: a previously talkative teenager who becomes uniformly, smoothly blank about the online part of their life is often managing something they do not yet have words for. Silence, in a child who used to narrate their day, is information.

Where catfishing leads

Catfishing is almost never the destination. The fabricated identity and the manufactured relationship are infrastructure — the access that the rest of the scheme is built on. Three outcomes recur, and a single case can pass through more than one.

The first is grooming. Child grooming is the deliberate process of building a child’s trust and emotional dependence in order to abuse or exploit them, sexually or otherwise. A catfish persona is a natural opening move: it lets an adult present as a peer, or as a slightly older and more interesting almost-peer, and removes the instinctive caution a teenager would bring to a stranger who was visibly an adult. The National Center for Missing & Exploited Children, which operates the US CyberTipline, has reported sharp recent increases in CyberTipline reports involving online enticement.

Grooming does not run on a single timetable. Some cases unfold slowly across months, with the manipulator content to wait and deepen the bond; others move in days, especially when the aim is a quick image rather than a long-term hold. What is consistent is the way the fabricated identity collapses the distance an adult stranger would otherwise have to cross. By the time any abuse is attempted, the teenager does not experience the other person as a stranger at all. They experience them as the person who understands them best — which is precisely why a teen in this position so rarely asks an adult for help, and so often defends the relationship when one intervenes.

The second is sextortion. Financial sextortion is a scheme in which an attacker obtains — or fabricates — an explicit image of a young person and then threatens to release it unless they are paid. It has become one of the most aggressive crimes aimed at minors, and it disproportionately targets teenage boys, who are typically approached by an account posing as a girl their age. The pattern is fast and brutal: a quick, flattering contact, a request for an image presented as a normal exchange, and then, within minutes of receiving it, a demand for money backed by the threat of sending the image to the teen’s entire contact list.

In a 2022 national public safety alert, the FBI and its partners warned of an explosion in financial sextortion targeting minors — a crime in which children are coerced into sending explicit images and then extorted for money.

— FBI, National Public Safety Alert on Financial Sextortion Schemes

The scale is not abstract. In that 2022 alert, law enforcement reported having received more than 7,000 reports of online financial sextortion of minors, tied to at least 3,000 victims — primarily teenage boys — and more than a dozen suicides. The accounts that approach these boys most often pose as a girl of a similar age.

The third is recruitment as a money mule — someone who receives and forwards funds stolen from other victims, masking the money trail for the criminal group. Teenagers and students are actively sought for this role, sometimes through what looks like a romantic relationship, sometimes through an offer of easy work. Recruitment is usually dressed up as something ordinary: a flexible online job, a favor for a partner who is briefly unable to use their own bank account, a chance to earn a commission for almost no effort. The money that passes through the teen’s account, though, has typically been taken from other victims of the same kind of scheme, and banks and law enforcement treat the account holder as a link in the chain. A teenager can finish one of these schemes with a closed bank account, a fraud marker that follows them for years, and in serious cases a criminal investigation — having never met the people whose money they moved. Outcomes vary with the teen’s age, what they understood at the time, and the jurisdiction; consequences are not automatic or identical for everyone recruited, but the exposure is real. The throughline across all three outcomes is the same: the fake relationship was only ever the way in. Recognizing the access for what it is — early, before stage five — is what keeps a case from reaching any of these endings.

Is this online person real?

When a parent suspects the person on the other end of a teenager’s phone may not be genuine, the instinct is to look for proof in the photographs. That instinct is now only half useful, and it is worth knowing why before you rely on it. Generative AI has made convincing fake faces and even live-looking video cheap to produce, so an image that survives scrutiny no longer clears anyone. The reliable signal has shifted from what a person looks like to how they behave. Verification is best done with your teen, not behind their back — framed as something sensible people simply do, the way they would check a review before buying something.

A handful of checks separate most genuine connections from manufactured ones. Run the person’s profile photos through a reverse image search; stolen photos frequently appear on other accounts under other names. Look for a thin or inconsistent footprint — an account created recently, few or no real-world friends in common, a posting history that does not match the age or life the person describes. Notice any refusal of live verification: a person who always has a broken camera, bad signal, or a dramatic reason a video call cannot happen, week after week, is telling you something. Watch the pace — declarations of love, talk of soulmates, and a first request for money or images arriving within days is not how genuine teenage intimacy develops. And treat one thing as an absolute bright line.

Two principles make the checks land. First, behavior outranks appearance: a profile that passes every photo test but fails the pace-and-pressure test is the dangerous one. Second, a real person tolerates verification and a manipulator resists it. Suggesting a group video call or a reverse image search is not an accusation; it is a test that costs an honest person nothing. The stream of plausible, sympathetic, never-ending excuses that a manipulator produces in response is itself the clearest evidence your teen will ever get — and far more persuasive, coming from the manipulator’s own behavior, than the same warning delivered by a parent.

If your teen is already in it

Discovering that your child is in the middle of one of these situations is frightening, and the fear pushes parents toward exactly the wrong first moves. The single most important thing you can do is stay calm and slow down. Your teen has been manipulated by a practiced criminal, possibly an organized group; this is not a failure of parenting and not a failure of character, and treating it as either will close the conversation you most need to have open.

Lead with the relationship. Make it unambiguous that your teen is not in trouble, that you are not angry at them, and that you are going to handle this together. Shame and the fear of punishment are the forces that keep these cases hidden and let them escalate; removing both is the most protective thing a parent can do in the first hour. Do not begin by confiscating the phone or grounding the teen — punishment confirms the manipulator’s script that adults overreact and cannot be told things, and it often pushes a teen onto a hidden device where you have no visibility at all.

• Preserve the evidence Screenshot conversations, profiles, usernames, and payment records before anything is blocked or deleted. Do not delete messages — they are what a report is built on.
• Do not pay, and do not send more Paying a sextortion demand marks your teen as a paying target and invites further demands. Complying with any ask funds the next stage.
• Do not confront or warn the other person A tipped-off manipulator deletes the account, destroys the trail, and reappears under a new identity.
• Block, after the evidence is saved Cut contact once everything is captured, and report the account to the platform.
• Bring in support Loop in your teen’s school if classmates may be affected, and a clinician or counsellor if your teen is distressed — sextortion in particular can hit hard, and fast.

Once the immediate situation is contained, it is reasonable to think about how to restore visibility going forward. In many places a parent or legal guardian may use age-appropriate monitoring on a child’s device — though the rules vary by country, state, and custody situation, so check what applies where you live. After an incident it can be a sensible layer of protection, but how you do it matters. Covert surveillance, if your teen discovers it, proves the manipulator’s point that adults cannot be trusted and teaches your teen to route around you. Transparent, age-appropriate monitoring — your teen knows the tool is there, knows what it does, and knows it exists because something genuinely serious happened — works with the relationship instead of against it. Think of it as scaffolding: visible, temporary, and gradually removed as trust and autonomy are rebuilt.

The legal and reporting map

You do not need proof, certainty, or a complete picture to make a report. Reporting bodies expect incomplete information and would far rather receive a report that turns out to be minor than miss one that was not. This section is a map, not legal advice; for anything involving potential criminal charges, including money-mule exposure, consult a qualified lawyer in your jurisdiction.

In the United States, the central channel for anything involving the sexual exploitation, enticement, or sextortion of a minor is the NCMEC CyberTipline, which routes reports to the appropriate law-enforcement agencies. Crimes with an online or financial component can also be reported to the FBI through the Internet Crime Complaint Center (IC3), and the financial-fraud side — money lost, mule recruitment, scam payments — to the Federal Trade Commission at ReportFraud.ftc.gov. For explicit images of a minor, the free Take It Down service, operated by NCMEC, can help limit their spread: it creates a digital hash of the image that participating platforms use to detect and block matching copies. It is not a universal delete button — its reach depends on which platforms take part — but it meaningfully slows further sharing. Federal law criminalizes the online enticement and sexual extortion of minors, and the 2024 REPORT Act expanded the reporting duties platforms owe, extending them to online enticement and child sex trafficking rather than child sexual abuse material alone.

In the United Kingdom, concerns about a child being groomed or exploited online can be reported to CEOP, part of the National Crime Agency, and image-removal help for under-18s is available through the Internet Watch Foundation and Childline’s Report Remove tool. Across the European Union, national hotlines coordinated through the INHOPE network and the Better Internet for Kids programme handle reports of illegal content and child exploitation; the relevant national hotline can be found through those bodies. If you are outside these regions — in Switzerland, Australia, Canada, or elsewhere — contact your national or local police and your country’s child-protection or cyber-tip hotline; many national hotlines worldwide are listed through the INHOPE international network. Wherever you are, report to the platform as well — it creates a record and can trigger an account takedown — but treat the platform report as an addition to the law-enforcement channel, never a replacement for it.

Resources and further reading

Where to turn depends on what you need. The bodies below publish free, regularly updated material, and the reporting channels are the same ones named in the section above.

• To report — the NCMEC CyberTipline in the US, CEOP in the UK, the FBI’s Internet Crime Complaint Center, and ReportFraud.ftc.gov for financial fraud.
• For image removal — Take It Down, operated by NCMEC, and, in the UK, Childline’s Report Remove tool.
• For parent guidance — the child-safety research nonprofit Thorn, Internet Matters, the NSPCC, and the FTC’s consumer education site.
• For research — the Pew Research Center’s ongoing work on teens and technology, a reliable guide to how young people actually use the platforms where this manipulation happens.

Frequently asked questions