Know the Signs: Dark Web and Online Exploitation — What Schools Must Recognise
Young people are accessing the dark web at younger ages than ever. This "Know the Signs" briefing covers exactly what to look for — the behavioural changes, the technology indicators, and the language — that suggest a pupil may be involved in dark web activity or online criminal exploitation.
Photo: The Safeguard Hub — dark web and online safety for schools
The National Crime Agency estimates that children as young as 10 have been found accessing dark web markets.[1] The most common pathways are through online gaming communities, peer-sharing of Tor browser links, and recruitment by older young people already involved in county lines or cybercrime networks. Most schools have no specific protocol for identifying or responding to dark web involvement — this briefing gives you one.
Know the Signs: What to Look For
Technology Indicators
- Use of Tor browser, VPNs, or privacy-focused operating systems (Tails OS)
- Cryptocurrency apps or wallets on a phone or laptop
- Receiving physical packages addressed to someone else or to a false name
- Multiple encrypted messaging apps (Signal, Session, Wickr)
- Talking about "being anonymous online" or "they can't trace me"
Behavioural Indicators
- Unexplained income or expensive purchases (common with cybercrime or drug market activity)
- Extreme secrecy about online activity — closing windows, leaving rooms to take calls
- New online "friends" who are older, unknown, and who the pupil is reluctant to name
- Knowledge of drugs, weapons, or hacking tools that seems beyond their experience
- Anxiety or distress linked specifically to online activity
Language Indicators
- References to "onion sites", "hidden services", or "the dark net"
- Discussion of buying things "where nobody can see" or "without ID"
- References to specific dark web marketplaces (these change regularly — report any unfamiliar terms to the DSL)
The Money Mule Risk
Dark web criminal networks frequently recruit young people as money mules — using their bank accounts to launder proceeds. This is a criminal offence under the Proceeds of Crime Act 2002, even if the young person didn't know what they were doing. Signs: receiving unexplained bank transfers; being asked to withdraw cash and give it to someone; being asked to open a new bank account.
What to Do If You're Concerned
Record the concern immediately and refer to the DSL. The DSL should: make a referral to the local MASH; consider a referral to the National Cyber Crime Unit (NCCU) via Action Fraud if there is evidence of criminal activity; and contact the Cyber Choices programme if the pupil appears to be involved in hacking (Cyber Choices provides early intervention and diversion for young people involved in cybercrime).
Citations
[1] National Crime Agency (2024). Cyber Crime: Young People and the Dark Web. NCA.
[2] Internet Watch Foundation (2024). Annual Report 2023. IWF.
[3] CEOP (2023). Threats to Children Online: The Offender and Victim Profile. NCA/CEOP.
[4] Home Office (2023). Cyber Choices: Diversion Programme for Young People. Home Office.