When Your Kid Cracks the Password: Family Cybersecurity Lessons

Hackers & Hooks | Season 1, Episode 9

Most parents set a passcode and hope for the best. The Ankolekar family learned that a curious child treats every passcode as a puzzle, and every new lock as the next level of a game.

On this episode of Hackers & Hooks, Nick Gipson and Isaac Reed, joined by Nick’s Gipson Cyber colleague Don Wilson, talk with Vish about life with a son who has a real gift for technology. What started with a wish for more video games and YouTube turned into an ongoing contest between parents and child, plus one fake game download that caused real trouble. The lessons apply to any household, and to any family-owned business where home and work devices overlap.

Every Passcode Is Just Another Level

Vish said it began when the family put limits on what could be watched on the TV. As he put it, necessity is the mother of invention. His son started finding ways around the passwords. Each new code would hold for a couple of months, and then he would figure out the pattern: the way his parents moved their fingers when they unlocked a phone, sometimes in the car, and even a passcode caught in a reflection.

Harder passwords did not end the contest. They raised the stakes. If he learned part of a code, he would work out the rest by trying combinations.

“It’s more like a level-wise game. He clears level one, we give level two, and then he clears level two and then he goes to level three. For him, it’s more of a challenge.”

Vish, Hackers & Hooks

There were costs along the way. A movie got rented on a streaming service without anyone meaning to, so the family added purchase locks, then app-by-app passwords, and eventually separate codes for watching, editing settings, and buying. Each streaming service and profile got its own password, so getting into one would not unlock the rest.

Vish also compared notes with other parents. Some had given their children a separate, tightly restricted tablet. Others allowed no devices at all. Both can work, he said, until a child gets hold of a friend’s or relative’s phone. During one visit, a grandparent’s phone ended up with a couple dozen new games on it.

“It’s almost like living with an insider threat, is what we call it in our industry: someone that’s inside the house that has access to the things and can do some damage if left unrestricted.”

Nick Gipson, Hackers & Hooks

When a Fake Game Landed on the Phone With the Banking Apps

The most serious moment came a few weeks before the recording. Vish’s son downloaded what looked like Roblox, one of his favorite games, onto Vish’s phone. It was not the real app. The phone started loading and crashing over and over, and Vish had to dig through the settings to get it back under control. That same phone, like most of ours, held banking apps and work email.

That is what makes this more than a parenting story. Fake versions of popular games, along with “free” add-ons and cheats, are a well-known way to spread malware. Some of it is built to collect saved passwords and logged-in sessions from whatever device it lands on. When a child’s download reaches a parent’s phone or laptop, the risk is not just a broken device. It can mean exposed bank logins, a compromised work account, and a problem that follows the parent into the office.

None of this is a failure of parenting. The family did what good security teams do: they added layers, watched how each one was beaten, and adjusted. Nick praised that persistence and noted that many families give up after the first few rounds and simply hand over access to everything, which is not the answer either.

Lessons for Families and Family-Owned Businesses

• Assume someone is watching you unlock. Kids, and strangers in a coffee shop, learn codes by watching fingers and screens, a trick known as shoulder surfing. Use face or fingerprint unlock where you can, choose longer passcodes, and shield the screen when you type.
• Use separate locks for separate risks. Like the Ankolekar family, set different controls for watching, changing settings, and buying. Apple’s Ask to Buy and Google Play’s purchase approvals let a parent approve purchases and downloads before they happen.
• Keep kids off the device that holds your money and your work. Give children their own restricted device or profile instead of the phone with your banking apps and business email. In a family business, the same rule applies: the family tablet should not double as the computer that runs payroll.
• Only install apps from official app stores. If a game, add-on, or cheat comes from a link, a video description, or a chat group, treat it as unsafe. Fake versions of popular games are a common way malware gets in.
• Use a password manager. It makes unique passwords practical. Nick added that one shared with a spouse can double as a family contingency plan, so someone you trust can reach important accounts in an emergency.
• Bring grandparents and relatives into the plan. An unlocked phone at a relative’s house is the easiest workaround there is. A quick conversation about screen locks and purchase approvals closes that gap.

How Gipson Cyber Helps

Vish and his family have kept pace with a determined young hacker through patience and trial and error. Nick pointed out that many parents do not have the time or the technical background to do the same, and that this is exactly the kind of problem the family service was built for. If you want help bringing family cybersecurity protection into your home, start with our family protection page.

For family-owned businesses, home and work rarely stay separate. Gipson Cyber’s Business SOCaaS provides 24×7 monitoring with real human responders, and it works alongside your existing IT team or MSP rather than replacing them. If a download has already caused trouble on a device that touches business accounts, our Business DFIR team can help you find out what happened and what to do next, with clear reporting along the way.

No set of controls will outsmart every curious kid or stop every bad download. Layers, good habits, and someone to call can reduce the risk a great deal. If you think you are being hacked right now, go to 800cyber.com.