AIP 111 · Parents & Caregivers
Family Incident Response
Practice the six-phase response for sextortion, AI-generated fake images, a hacked account, suspected grooming, and a missing or recruited teen.
What you will be able to do
- Run the first hour of a sextortion incident in the right order.
- Respond to an AI-generated fake image without sharing or copying it.
- Recover a hijacked account and check what the intruder touched.
- Interrupt suspected grooming and handle a missing or recruited teen with the right calls.
- Support a child through recovery and lead a blameless review.
1 Module 1 of 5 · 40 min
Sextortion: the first hour
- Put the first-hour actions in the correct order.
- Preserve evidence without copying or forwarding intimate images.
- Use NCMEC CyberTipline and Take It Down correctly.
Most sextortion of teens is financial. A criminal builds quick rapport, gets an image, and threatens to share it unless the child pays. Speed and shame are their tools. Your tools are order and calm: protect the child, preserve what proves the crime, stop contact, report, and remove.
- Reassure the child: ‘You are not in trouble. I will help you.’
- Check safety. If the child talks about self-harm, call or text 988 now.
- Stop replying and do not pay. Do not negotiate.
- Save identifiers and the text of threats: usernames, profile links, phone numbers, payment handles, dates and times. Do not capture or forward intimate images.
- Then block and report the account in the app. Do not delete your child’s account yet.
- Report to the NCMEC CyberTipline (report.cybertip.org or 1-800-843-5678) and use Take It Down (takeitdown.ncmec.org) for under-18 images.
- Contact local police, especially if there are threats of violence or a known adult.
- Don’t message or confront the blackmailer.
- Don’t pay, even once. Payment usually brings more demands.
- Don’t open, copy or forward any intimate image of a minor, even to police.
- Don’t take your child’s phone as punishment.
First words
“You are not in trouble. This is a crime done to you. I am glad you told me, and I am going to help.”
Your 15-year-old comes to you pale and says someone has an intimate photo and wants $300 in gift cards in one hour or will send it to everyone at school.
List your first five actions in order.
Show the debrief
Reassure and check on safety; tell your child to stop replying and not to pay; save usernames, links, payment details and the threat text (not the image); then block and report in the app; report to NCMEC and use Take It Down; contact police. Do not delete the account or confront the person.
Knowledge check
2 Module 2 of 5 · 35 min
AI-generated fake images
- Explain why fake explicit images of a child are treated as exploitation.
- Respond without opening, copying or forwarding the image.
- Report and work with the school.
Today a fake explicit image of a child can be made from an ordinary photo. The child never took a nude, and the harm is still real: shame, harassment and sextortion. Treat it as an exploitation image of a child, whether or not it is ‘real’.
| Situation | What to do |
|---|---|
| A classmate shares a fake image of your child | Treat as image-based abuse. Report, remove and tell the school in writing. |
| Someone threatens to ‘release’ a fake unless the child pays | Use the sextortion steps. The threat is the crime. |
| Your child says ‘it’s not even real’ | Agree it’s fake, and explain it is still harmful and still a crime to share. |
- Reassure your child: ‘I believe you. You did nothing wrong.’
- Note where it appears: accounts, group names, links, dates.
- Report to the platform and the NCMEC CyberTipline.
- Use Take It Down for under-18 images.
- Don’t share the image ‘to warn others’.
- Don’t ask your child to prove it is fake.
- Don’t tell the school to circulate the image to investigate.
A parent sends you a screenshot from a class group chat. It shows a fake explicit image with your daughter’s face and the caption ‘lol’.
What do you do with the screenshot and what do you say to your daughter?
Show the debrief
Do not forward or keep copying the screenshot. Note the group and usernames, and ask the other parent to stop sharing. Tell your daughter you believe her, that she did nothing wrong, and that you will handle reporting. Report to NCMEC and the platform, use Take It Down, and notify the school in writing.
Knowledge check
3 Module 3 of 5 · 30 min
A hacked or taken-over account
- Cut off access in the right order.
- Check what the intruder touched.
- Find the root cause and prevent a repeat.
A taken-over account can lead to impersonation, scams, or sextortion. Responders treat it as three jobs: cut off access, find out what was touched, and fix the cause.
- From a trusted device, change the account password. If locked out, use the platform’s recovery.
- Sign out of all other devices and sessions.
- Turn on two-step verification now.
- Secure the email linked to the account first, since it can reset every other account.
- Revoke unknown connected apps and check email forwarding rules.
- Run a security scan on the device used to log in.
- Tell friends not to click odd links from the account.
Ask the question
A hijacked account is sometimes the first step of sextortion. Gently ask your child whether anyone has also threatened them.
Root cause questions:
- Was the password reused somewhere that was breached?
- Did your child click a link or enter a code for someone?
- Is the device shared or infected?
Related
Your 13-year-old’s account starts posting links and messaging friends. Your child is locked out.
Give the order of your first four actions.
Show the debrief
Use the platform’s recovery from a trusted device, reset the password, sign out everywhere and enable two-step verification. Secure the linked email, then review connected apps. Warn friends, and ask your child whether anyone is also threatening them.
Knowledge check
4 Module 4 of 5 · 40 min
Suspected grooming, and a missing or recruited teen
- Interrupt a suspected grooming relationship without driving it underground.
- Know when a missing teen needs immediate calls and which ones.
- Avoid actions that increase danger.
Grooming is a pattern: attention, gifts, secrecy, isolation, boundary testing. One sign proves little, and a cluster over time matters. When a teen goes missing, the first hours matter most, and the right calls come before everything else.
| Situation | First actions |
|---|---|
| Cluster of grooming signs, child at home | Talk calmly, preserve chats, then block and report. Use the suspected-grooming playbook. |
| Adult asked to meet your child | Call police. Keep the chats. Do not confront the adult. |
| Teen missing, may be with an adult | Call 911, then NCMEC at 1-800-843-5678. You do not have to wait 24 hours. |
| Signs of control by an older ‘partner’ | Call the National Human Trafficking Hotline 1-888-373-7888 or text 233733. |
- Don’t confront or threaten the person.
- Don’t log in as your teen and message the contact.
- Don’t post details publicly before speaking to police and NCMEC.
- Don’t send a message that says ‘you are in trouble when you come home’.
If a teen comes home
“I’m so glad you’re safe. You’re not in trouble. We’ll figure out the next steps together, at your pace.”
Your 16-year-old is not home and not answering. Earlier you noticed a new older ‘friend’ who buys gifts and picks them up.
List your calls in order and one thing you must not do.
Show the debrief
Call 911 to report your teen missing, mention the older contact and share what you know. Call NCMEC at 1-800-843-5678. Preserve devices and accounts. Do not log in as your teen or message the contact, and do not post publicly before speaking to police. Keep any message to your teen loving and free of threats.
Knowledge check
5 Module 5 of 5 · 30 min
Recovery and the blameless review
- Support a child’s recovery without shame.
- Know when to bring in professional help.
- Lead a short blameless review and update the plan.
The incident ends, but the fear and shame often last. Recovery is slower than response and deserves a plan. A blameless review afterwards asks what the system, not the child, can do better next time.
- Check in daily at first: sleep, mood, school, friends.
- Offer counseling and normalize it.
- Let the child decide how much to share and with whom.
- Use 988 immediately if the child talks about self-harm.
The 30-minute review:
- What did we expect to happen?
- What actually happened?
- Why was there a difference?
- What do we change? Assign an owner and a date.
Ground rule
No blame, especially not toward the child. The goal is a better plan, not a verdict.
Related
A sextortion incident is over, but your child has stopped seeing friends and sleeps badly. You want to hold a review.
How do you handle the review and the child’s wellbeing?
Show the debrief
Prioritize wellbeing: check in, offer counseling and use 988 if there is any self-harm talk. Hold the review without blame, and ask the child what would have made telling easier. Update the plan card and the tech agreement.
Knowledge check
★ Capstone
A rehearsed family plan and one run tabletop
The capstone is how you show you can do the work, not just answer questions. It produces something real that you keep.
- Write a family incident plan covering sextortion, an AI-generated fake, a hacked account and a missing teen, with the first five actions for each.
- Run the family tabletop exercise with at least two scenarios and record what the family said and did.
- Write down three gaps the tabletop revealed and one fix for each, with an owner and a date.
- Update the family response plan card and confirm that hotline numbers are saved on adult phones.
How it is reviewed
- Plan puts protection before evidence, and evidence before removal, for each scenario.
- No step involves paying, confronting an offender, or copying an intimate image.
- Tabletop record shows each person answering and a calm debrief.
- Gaps have specific fixes, owners and dates.
- Plan card is current and findable by every adult in the home.
Pass every module check at 80% or better, finish the capstone, then follow the steps on the credentials page to request your certificate.
Counts toward
Companion playbooks
- Sextortion: the family response playbook
- AI-generated fake images (“nudify” and deepfakes): the response playbook
- Hacked or taken-over account: the response playbook
- Suspected online grooming: the response playbook
- A teen is missing, or may be being recruited: the response playbook
- Preserving evidence: a guide for families
- Blameless after-action review
- A 20-minute “what would we do?” family drill
AIP Academy courses are awareness and skills training. They are not legal, medical or clinical advice, and an AIP certificate is not a license, state or professional accreditation, CLE credit, or a promise of employment. In an emergency call 911.
Safety is built before the crisis
Pick your part and see it through. Prevention works when people follow through.