Children can be exposed to ‘execution videos and escort services’ via social media ‘with little effort’, an investigation has found.
Tech providers have increasingly beefed up child safety checks, including age-verification and restricted accounts for teens.
But Malwarebytes found that by using tricks that a child could use, some checks could be bypassed, such as looking at a website without an account or faking their date of birth.
‘It was very easy,’Pieter Arntz, a senior researcher at the cybersecurity firm, tells Metro. ‘A little curiosity and the search bar for the most part found toxic content.’
Gaming platform Roblox allows adults to chat with others after verifying their ages, but this is not needed for communities, akin to chat rooms.
Metro made an account where we said we were five years old, the minimum age a Roblox user is required to be.
Metro was able to search for and join the communities flagged by Malwarebytes as using names and terms linked to fraud.
However, our underage account could not access conversations on any community’s forum or ‘wall’, where users can publicly post.
One community identified by experts included Fullz Ent., a group with more than 740 members that says it offers ‘High quality Clothing’.
‘Fullz’ is slang used in cyber crook circles for stolen personal information, according to Arntz. ‘New clothes’ is used by criminals to refer to stolen payment card data.
Such terms ‘wouldn’t probably be flagged as criminal by most parents’, Arntz adds.
Fullz Ent. includes a disclaimer in its about section that says: ‘We Are Not Affiliated With Any Gangs.’
Malwarebytes’ investigation was carried out in December – the following month, Roblox made facial age checks mandatory to chat to limit communication between adults and children younger than 16.
How underage users are accessing YouTube without accounts
Researchers found that underage users can access inappropriate content on YouTube that is available to those without an account.
YouTube Kids is a version of the video-sharing service for youngsters by employing rigorous video filters and parental controls.
No account is needed for basic viewing and browsing of YouTube and Malwarebytes found content can be viewed by a minor if they make a ‘Guest’ account via Google, which owns YouTube.
By doing so, Metro was able to view a video shared by a French news outlet of a Tunisian member of ISIS being executed, as well as view content shared by ‘how to’ fraud accounts.
Malwarebytes said that adult content on age-gated apps Twitch and TikTok was ‘easy to fake’.
It said: ‘While most platforms require users to be 13+, a self-declaration is often enough. All that remains is for the child to register an email address with a service that doesn’t require age verification.’
Metro was able to access a Twitch account offering ‘call-girl services’ in India on the streaming site after self-reporting our age as over-18.
The account includes a link to a website where users can browse ads for escorts and WhatsApp them, the site claims.
When Metro messaged one of the accounts, a man asked in Hindi: ‘How much time do you need?’
TikTok requires new users to input their birthday – if under-18, they have default privacy settings, limited features and enhanced parental controls.
If a user says they are an adult, such restrictions are not in effect. This allowed Malwarebytes to find content about ‘providing credit card fraud and identity theft tutorials’, which Metro verified.
Malwarebytes said that when using a teen-restricted account on Instagram, researchers were able to find profiles promoting financial fraud.
Metro similarly made an account where we listed our date of birth as 15 and were able to find the accounts by using the app’s search function.
Teen Instagram accounts, for users aged between 13 and 17, were introduced on Instagram in 2024.
Parental controls are on by default, meaning accounts are automatically private and have the strictest content filters in place. They will be limited to messaging only those they are already connected with.
Meta, which owns Instagram, extended this to Facebook and Messenger users the following year.
‘Today’s young people are simply more tech-savvy’
Arntz says that Malwarebytes’ findings don’t show how any one platform is failing. Rather, today’s young people are simply more tech-savvy than the adults designing online child safety policies.
Some youngsters are even using AI-generated documents to bypass ID scans, Arntz adds.
‘The problem isn’t children being especially deceptive; it’s that age gates rely on self‑reported trust in an environment where anonymity is effortless,’ he says.
‘Without robust digital identity verification or parental supervision, these measures serve more as legal cover for companies than real protection for young users.’
Roblox told Metro that the firm is moving beyond self-reported age checks, having been the first gaming company to embrace age-checks.
A spokesperson said: ‘We also restrict access to certain content based on a player’s verified age, have a wide range of additional safety features like default chat filters, and have extremely strict policies to guard against users discussing or engaging in any form of illegal activity, with our teams taking swift action against users and communities found to be breaking the rules.
‘While no system is perfect, our commitment to safety never ends, and we continue to strengthen protections to help keep users safe.’
Twitch said the live-streaming platform is ‘continuing to increase’ its investment in youth safety tools, including content filters.
A spokesperson added: ‘Using automated tools and behavioural signals, we monitor Twitch 24/7/365 for content and channels that may violate our youth safety policy.’
Machine-learning technology and other detection models are used to estimate whether a user is under the age of 13.
Google, TikTok and Meta have been approached for comment.
Get in touch with our news team by emailing us at [email protected].
For more stories like this, check our news page.
MORE: I left my boyfriend for 5 months to go travelling alone – people say I’m selfish
MORE: The £80,000 job no one believes actually exists
MORE: I begged doctors to remove my arm – I have the ‘suicide disease’
