Zephyr Cyber Labs
← All posts

Behind the Avatar: Protecting Children from Online Grooming and Coercion

An online friendship can begin with something ordinary: a shared game, a helpful teammate or someone who seems to understand a child’s interests. The danger emerges when that relationship becomes a source of secrecy, pressure and fear.

For parents, protecting children requires more than identifying unsafe content. It also means recognizing unsafe relationships and making it possible for a child to ask for help.

The violent online network known as 764 and criminal cases involving Roblox illustrate different forms of exploitation. They are not interchangeable. The Roblox cases discussed here do not establish membership in 764, and they cannot tell us how frequently abuse occurs across the platform. They do show how offenders exploit trust and move children toward situations they struggle to escape.

When Friendship Becomes Leverage

In its March 6, 2025 advisory, the FBI warned that 764 and similar networks target minors through social media, gaming platforms and messaging applications. Offenders may establish apparently trusting or romantic relationships before using manipulation and threats to demand increasingly harmful behavior. Their goals can include control, notoriety and violence, rather than money alone.[1]

On October 9, 2026, the Justice Department announced that Prasan Nepal, identified as a senior 764 leader, had pleaded guilty the previous day to conspiracy to sexually exploit a child. Court documents described coordinated recruitment and coercion across a network operating internationally.[2]

The important lesson is the mechanism. A relationship that offers belonging can become a means of control. Threats to expose private information can leave a child believing that compliance is the only option. Parents need to challenge that belief before an offender has the opportunity to reinforce it.

Two Roblox Cases, Two Warning Signs

In August 2026, Ryan Dookhan received a 30-year prison sentence for sexually exploiting a minor. According to DOJ, he met an eleven-year-old on Roblox, moved the conversation to an application designed to delete messages, and coerced the child into producing abuse material.[3]

The warning sign was the transition from a game to a more private communication channel. Parents who know only which games a child plays may miss the conversations happening elsewhere.

A separate case demonstrates the weakness of claimed identity. In January 2025, John Matthew Piecuch received a 188-month sentence after pleading guilty to producing child abuse material. DOJ reported that he met a twelve-year-old on Roblox while pretending to be thirteen. Her mother discovered messages and contacted law enforcement.[4]

An avatar, shared interests and a claimed age did not establish who the other person was. These cases also predate some current Roblox protections, so they should not be treated as evaluations of every safeguard available today.

What Parents Should Notice

NCMEC identifies tactics including false identities, rapid requests for intimate images, relationship building and moving conversations between platforms. The FBI also describes isolation and fear surrounding a new online contact.[1][5]

Pay attention when someone:

  • Insists that parents must not know about the relationship.
  • Pressures a child to move to private or disappearing messages.
  • Requests intimate images, personal information or harmful acts.
  • Threatens exposure, humiliation or retaliation for refusing.

Withdrawal, disrupted sleep or anxiety around messages should prompt a calm conversation. These changes can have many causes and are not proof of exploitation. The question is whether a child feels pressured, frightened or unable to leave a relationship.

Build Protection Before a Crisis

Make asking for help safe. Tell your child: “If someone pressures or threatens you, you can come to me, even if you shared something or broke a rule. We will work through it together.” NCMEC emphasizes that the blackmailer, not the child, is responsible for the abuse.[5]

Know the online environment. Ask your child to show you favorite games, friends and communication features. Discuss how they know each person and what happens when someone asks to move the conversation. Make this routine rather than an interrogation prompted by suspicion.

Use the available controls. Roblox’s current guidance describes linking a parent account, managing communication and content restrictions, reviewing friends and controlling private-server access. Options depend on age and region, and some control shifts to children as they grow older. Review the settings on your child’s actual account rather than assuming an older tutorial still applies.[6]

Set boundaries around private contact. Agree that requests for secrecy, intimate images or meetings require help from a trusted adult. Younger children need closer supervision; older teenagers need clear boundaries and a reliable route to support. Restrictions on one platform cannot cover every conversation moved elsewhere.

If Threats Have Already Started

Start with reassurance: “You are not in trouble for telling me. We are going to get help.” Address immediate safety before focusing on rule violations.

Do not assume paying or sending more material will end the demands. NCMEC advises seeking help, reporting the account and blocking the offender without deleting the profile or messages.[5]

Preserve usernames, profile links, dates and non-explicit threats. Do not download or forward sexual images of minors to gather evidence. Report suspected exploitation through NCMEC’s CyberTipline and the FBI, and seek professional support when needed. Call 911 for an immediate threat to life.[1][7]

NCMEC’s Take It Down service can help limit the sharing of intimate images taken before age eighteen. It creates a digital fingerprint without uploading the image itself. Use the service on the original device containing the images, following NCMEC’s instructions. Its coverage is limited to participating services and is not a guarantee of removal everywhere. Do not download images or ask anyone to send copies for submission; if the original device is unavailable, ask NCMEC for assistance.[7]

Keep the Door Open

Parents cannot personally verify every online contact. They can reduce opportunities for private coercion, notice changes and respond without making disclosure more frightening.

Start with one account review and one honest conversation. A child who knows how to recognize pressure, leave a conversation and ask for help has more options when an offender tries to take those options away.

Make it easier for your child to tell you than for someone else to silence them.

Notes

[1] Federal Bureau of Investigation, “Violent Online Networks Target Vulnerable and Underage Populations Across the United States and Around the Globe,” March 6, 2025.

[2] U.S. Department of Justice, “Leader of Global Violent Extremist Network ‘764’ Pleads Guilty to Conspiracy to Sexually Exploit Minors,” October 9, 2026.

[3] U.S. Attorney’s Office, Western District of Michigan, “School Security Guard Sentenced to 30 Years in Prison,” August 14, 2026.

[4] U.S. Attorney’s Office, Central District of California, “Riverside County Man Sentenced to Over 15 Years in Prison for Producing Sexually Explicit Images of Children He Met Online,” January 31, 2025.

[5] National Center for Missing & Exploited Children, “Sextortion,” accessed October 13, 2026.

[6] Roblox, “Parental Controls Overview,” accessed October 13, 2026.

[7] National Center for Missing & Exploited Children, “Frequently Asked Questions,” Take It Down, accessed October 13, 2026.

Bibliography

Federal Bureau of Investigation. “Violent Online Networks Target Vulnerable and Underage Populations Across the United States and Around the Globe.” March 6, 2025. Source.

National Center for Missing & Exploited Children. “Frequently Asked Questions.” Take It Down. Accessed October 13, 2026. Source.

National Center for Missing & Exploited Children. “Sextortion.” Accessed October 13, 2026. Source.

Roblox. “Parental Controls Overview.” Accessed October 13, 2026. Source.

U.S. Department of Justice. “Leader of Global Violent Extremist Network ‘764’ Pleads Guilty to Conspiracy to Sexually Exploit Minors.” October 9, 2026. Source.

U.S. Attorney’s Office, Central District of California. “Riverside County Man Sentenced to Over 15 Years in Prison for Producing Sexually Explicit Images of Children He Met Online.” January 31, 2025. Source.

U.S. Attorney’s Office, Western District of Michigan. “School Security Guard Sentenced to 30 Years in Prison.” August 14, 2026. Source.