AI scammers are not improvising. They are running tested, refined scripts designed for specific targets. Here are the three most common variations hitting American high schoolers right now, and exactly how each one works.

Scam Script

The Brand Ambassador

A rep from a recognizable US brand (Lululemon, Sephora, a gaming brand).

The Scout or Coach

A local high school sports scout, music instructor, or community organizer.

The Lost Phone Peer

A classmate or mutual friend claims they broke their phone and lost contacts.

Each of these scripts shares the same underlying structure: establish contact through an innocuous opening, build rapport over time, and then present a request that feels reasonable given the relationship that has developed. 

The AI makes each step feel natural because it genuinely adapts to the conversation rather than running a rigid script.

The “Brand Ambassador” scam does not present the account takeover request in the first message. It might take three or four exchanges before the “verification” ask appears. By which point the teenager has been conditioned to cooperate.

The verification code scam needs its own section. It is the most common and effective trick used by AI scammers. Understanding exactly how it works is the single most important thing you can teach your teenager.

Here is the sequence.

A teenager gets a message from someone who seems to be from a brand or group. They say they are offering something attractive, like free stuff, a chance to join something, or a spot on a team.

After talking for a bit, the "representative" says they need to check your account or confirm who you are before they can move forward. They ask the teenager to share a code that will arrive on their phone by text.

What the teenager does not know is that the scammer has already gone to the login page for their Instagram, Snapchat, or TikTok account and clicked "forgot password."

The code that arrives on the teenager’s phone is not a verification code from the brand. It is the account recovery code.

The moment the teenager texts it back, the scammer uses it to reset the password, lock the teenager out of their own account, and take ownership of everything inside it: their followers, their private messages, their contacts, their personal photos.

The rule is simple and absolute: a verification code that arrives on your phone is a digital key to your account. No legitimate brand, organization, coach, or person will ever ask you to send that code to them. Ever.

If someone asks for it, they are stealing your account. End the conversation immediately.

A brand ambassador scam text messages exchange: friendly, specific, flattering, and building toward a “verification code” request that will hand the scammer full control of the teen’s account.

A brand ambassador scam text messages exchange: friendly, specific, flattering, and building toward a “verification code” request that will hand the scammer full control of the teen’s account.

The formal term for text-based phishing is smishing (SMS phishing). It has existed for years, but the AI-powered, linkless version of it is a fundamentally different threat from the smishing of even three years ago.

Traditional smishing relied on urgency and links.

​A fake bank alert. A fake package delivery notice. A fake prize notification.

These were easy to spot because they looked like what they were: impersonal, generic, and almost always containing a link that was slightly off from the real domain.

AI-powered smishing is personal. It uses the teenager’s name, references their interests, mirrors their communication style, and never asks them to click anything.

It is indistinguishable from a real conversation by appearance alone, which means the only reliable defense is behavioral, not visual. You cannot spot an AI scam by looking at it. You can only spot it by recognizing the pattern of what it is asking for.

That pattern is always one of three things: access (a code, a password, account credentials), money (a Venmo request, a CashApp transfer, a gift card), or a download (an app, a file, a link framed as something legitimate). Every scam (however elaborate the conversation that precedes it) ends at one of those three asks. Teaching teenagers to treat any of those requests from a new contact as an automatic red flag is the most reliable protection available.

The concept of “stranger danger” made sense for a world where strangers had a recognizable appearance, an unfamiliar face, an unfamiliar voice, and an unfamiliar car. Your child could see them coming.
​
AI has eliminated that visibility.

The “stranger” in 2026 arrives in the same interface as your teenager’s closest friends. It uses the same text bubbles, the same emoji, the same casual energy. It may know your teenager’s name. It may reference something your teenager posted publicly. It feels, in every sensory and emotional dimension, like a person.

The definition of “stranger” needs to be updated accordingly. A stranger is not just someone your teenager has never seen. A stranger is any contact whose real-world identity cannot be independently verified.

However convincing the conversation, if the contact cannot be verified offline, they are a stranger. And the rules that apply to strangers apply here.

The old rules are not wrong. They are just incomplete. Here is what needs to be added.

Teach your teenager a new baseline rule: if a text arrives from an unknown number asking for someone else, or asking anything at all, do not reply. Delete the message and block the number.

This is a significant behavioral shift because the instinct to correct a wrong number feels polite and harmless.

“Wrong number, sorry” seems like the decent thing to say. It is not harmless. It is the mechanism the scam depends on.

The scammer does not care about the content of the reply. They care that a reply happened. Silence is the only safe response to an unknown number.

This one needs to be taught as an absolute, with no exceptions: a code that arrives on your phone belongs to you and only you. No legitimate entity (no brand, no coach, no school organization, no friend, no family member) will ever need you to read that code back to them.

The moment someone asks for a code that arrived on your phone, the conversation is over. Block the number. Tell a parent.

It helps to explain why. The code is a password reset key. Giving it to someone is literally handing them the key to your account. Once they have it, you may not be able to get back in.

The account, the followers, the memories, the private conversations, may be gone.

Because AI allows scammers to build rapport over days or weeks, parents need to know when a new “friend” suddenly dominates their teenager’s text log. This is not about reading messages. It is about noticing patterns.

The question to ask is simple: “How did you meet this person?” If the answer is “they texted me” or “they DM’d me out of nowhere,” that is the conversation worth having.

Teach your teenager to recognize the three things every scam is ultimately trying to get: access (a code or password), money (a payment request), or a download (an app or file). Any new contact making any of those three requests is running a scam, regardless of how convincing the conversation leading up to it was. The request is the tell, not the conversation.

If your teenager receives what appear to be scam text messages, report it. In the US, forward suspicious texts to 7726 (SPAM), a shortcode maintained by major carriers that feeds into text message fraud detection systems. File a report with the FTC. These reports help carriers and authorities identify and shut down active scam operations, protecting other families in the process.

Most parental control apps work at the app layer; they can block certain websites, monitor screen time, and filter content categories. They cannot read the content of encrypted text messages. They cannot detect an AI scam conversation unfolding in iMessage or WhatsApp. By the time any monitoring tool would flag something, the code may already have been shared and the account already taken.

This is the same structural gap we see across child safety technology. App-layer tools are tenants in a system they do not control. They can see what they are allowed to see. Text messages, especially in encrypted apps, are usually not included in that.

Aqua One addresses this differently. Because it's monitoring is built into the operating system rather than installed as an app, it captures what appears on your child’s screen at the display layer, including the content of text conversations, WhatsApp chats, and any other messaging app, regardless of encryption.

A parent using Instant Replay can see an AI scam chat happening right away. They can watch when a request for a verification code comes up, before the teenager replies.

That visibility is the gap between finding out after the account is gone and finding out while there is still time to intervene.

Not in the traditional sense, replying to a text does not install malware on your phone. But replying does change how your phone’s operating system treats the sender, moving them from an unknown filtered contact to a trusted one with full notification access. More importantly, replying opens a conversation that an AI scammer will use to build trust and eventually request something valuable, a verification code, a payment, or a download. The reply is the first step in the trap, even if it feels harmless.

A wrong number text scam is a scam that opens with a message appearing to be sent to the wrong person, “Hey, is this Sarah?” or “Sorry, did I get the wrong number?” The goal is to get the recipient to reply.

Once they do, the phone treats the sender as a trusted contact, filters are bypassed, and the scammer begins building a relationship through an AI-powered conversation. The “wrong number” opener is not a mistake. It is the hook.

A verification code scam tricks a teenager into sharing a password reset code that arrives on their phone by text. The scammer, posing as a brand, a coach, or an organization, asks the teenager to read back a code “to verify their identity.” The code is actually a one-time password reset token for the teenager’s social media account. Sharing it gives the scammer complete access to the account, allowing them to lock the teenager out and take ownership of the profile, messages, and contacts inside.

Smishing is SMS phishing. Text message scams rather than email. The AI-powered version targeting teens today is significantly more sophisticated than traditional smishing. It contains no links, no suspicious attachments, and no obvious red flags. It uses conversational AI to maintain convincing, personalized dialogue over time before making its ask.

The defense is not visual; it is behavioral: any request from a new contact for access, money, or a download is a scam, regardless of how genuine the conversation felt.

A brand ambassador text scam involves a scammer posing as a representative of a recognizable brand, a clothing label, a beauty brand, or a gaming company, and offering a teenager free products or payment in exchange for posting about them. After some friendly conversation, they ask the teenager to “verify their identity” by sharing a code sent to their phone. That code is a password reset token for the teenager’s Instagram account. Sharing it results in immediate account takeover.

Do not reply; not even to say “wrong number.” Delete the message, block the number, and report it by forwarding the message to 7726 (SPAM). If an account has already been compromised by a verification code scam, contact the platform’s support immediately and report the incident to the FTC. Act fast. Account recovery is significantly easier before the scammer has had time to change the recovery email and phone number.

At Cyber Dive, we research the platforms and tools your kids are using so you do not have to figure it out alone. If this was useful, share it with a parent who needs it.