Kids' accounts get targeted because attackers know parents will pay to fix them quickly. Don't pay. Work the order.
Contain. Sign out of all sessions on the affected platform (most apps have a "Sign out everywhere" button in Security). Change the password from a clean device — yours, not theirs.
Recover. Use the platform's account-recovery flow with an email *the attacker doesn't have access to*. Enable MFA on the recovered account. Check connected apps, payment methods, and saved addresses for anything unfamiliar.
Learn. Sit with your kid (no blame) and trace it back: did they click a link, share a code, install a "free skin" mod? The lesson sticks because the consequence is fresh.
If you're stuck at any step, escalate to a specialist from the Monitoring page — a real human will guide you through it.