Start by avoiding blame. The priority is understanding what happened and stopping further contact.
Save screenshots and relevant account details before blocking or reporting if the evidence may be needed.
If the child shared a password or verification code, change the affected credentials immediately.
If the message involves threats, sexual exploitation, extortion, or immediate danger, use appropriate child-safety and reporting channels.