Drug Dealers are Using Normal Social Media to Find New Clients – You Call Them Your Kids

A string of emojis on your child’s phone can look completely ordinary. Most of the time, it probably is. But law enforcement has documented another use for some of those same symbols: coded advertising and communication around illegal drugs and counterfeit pills.

That does not mean a snowflake, pill, heart, plug or any other emoji is proof that a child is buying drugs. It means parents should understand that the digital marketplace around their children does not always look like a marketplace.

The Drug Enforcement Administration has published an “Emoji Drug Code | Decoded” reference showing examples found in investigations. Its chart includes examples associated with counterfeit prescription drugs, dealer advertising, potency, quantities and other drugs. The DEA is equally clear about the limitation: the list is not all-inclusive. These codes can change.

That limitation may be the most important part of the chart.

If parents turn it into a decoder ring, they will always be chasing yesterday’s language. The better question is the one I use throughout The $100 Hacker: Which path is still open?

The path matters more than the symbol

DEA material describing social-media drug trafficking lays out a recognizable progression. A prospective buyer encounters advertising or a dealer on a social platform. Contact begins through a comment or direct message. The conversation may then move to a private or encrypted messaging service. Payment can be requested through common payment apps. Delivery can follow.

That is a much more useful model for a parent than trying to remember whether a particular blue circle, snowflake or plug meant something in a chart published several years ago.

Look at context. Who is communicating? Did an unfamiliar account appear? Is the conversation being pushed to a different service? Are messages disappearing? Is there unexplained payment activity? Is someone arranging a meetup or delivery?

None of those things alone proves a drug transaction. Together, they give a parent something concrete to investigate without treating normal teenage communication as evidence of wrongdoing.

The counterfeit-pill problem changes the stakes

The DEA’s current parent guidance, updated with data as of January 2026, warns that drug traffickers use social media to advertise drugs and conduct sales. It specifically tells parents that counterfeit pills are part of the current threat and directs families to its emoji-code material.

The agency’s One Pill Can Kill campaign also warns that pills obtained outside licensed medical professionals and pharmacies can be counterfeit and may contain fentanyl. In other words, the danger is not limited to a teenager knowingly seeking fentanyl. Someone may believe they are buying a familiar prescription drug and receive something very different.

That is why this conversation should not begin with “I caught you.” It should begin before there is anything to catch.

What I would tell a teenager

A pill offered through social media is not the same thing as medication dispensed by a pharmacy. You cannot verify what is inside it by looking at it, by trusting the person selling it, or because a friend has taken something that looked similar before.

And if somebody approaches you online about drugs, you can show your parent or another trusted adult without first having to prove what the person meant. Asking for help is not an admission that you did something wrong.

What I would tell a parent

Do not turn an emoji chart into a reason to search for guilt. Use it as evidence that the environment has changed.

Talk about counterfeit pills before your child is under pressure to make a decision. Make it clear that they can bring you a strange message without automatically losing their phone or being treated like a suspect. If you find something concerning, follow the path: account, conversation, movement to another app, payment, meetup or delivery.

And remember the principle behind almost everything I teach here: you do not need perfect control over the entire digital world. You need to understand enough of the doors around your family to recognize when one of them is being used in a way you did not expect.

Sources / Receipts

·         DEA — Emoji Drug Code | Decoded — The DEA chart identifies representative examples found in investigations and explicitly says the list is not all-inclusive.

·         DEA — What Every Parent and Caregiver Needs to Know About Counterfeit Pills (data as of January 2026) — Warns that traffickers use social media to advertise drugs and conduct sales; directs parents to the emoji-code resource.

·         DEA — Social Media Drug Trafficking Threat Overview — Documents the contact → private/encrypted communication → payment pathway.

·         DEA — One Pill Can Kill — Current parent, teen, counterfeit-pill and naloxone resources.

·         LAPPA — Emoji Codes and Social Media’s Illegal Drug Trade (January 2023) — Explains the evolving cat-and-mouse nature of coded language and social-media drug advertising.

THE $100 HACKER NOTE: An emoji by itself is not evidence of illegal activity. Context and behavior matter. The goal is to recognize a concerning pathway early enough to have a useful conversation.

Source URLs for publication

·         https://www.dea.gov/sites/default/files/2021-12/Emoji%20Decoded.pdf

·         https://www.dea.gov/sites/default/files/2026-03/DEA-OPCK_Parent%20flyer_4Mar2026.pdf

·         https://www.dea.gov/sites/default/files/2022-03/20220208-DEA_Social%20Media%20Drug%20Trafficking%20Threat%20Overview.pdf

·         https://www.dea.gov/onepill

·         https://legislativeanalysis.org/wp-content/uploads/2023/01/Emoji-Codes-and-Social-Medias-Illegal-Drug-Trade.pdf

Collin - The $100 Hacker

Collin McKnight is the founder of The $100 Hacker, where he helps parents, families, and everyday technology users understand digital risks without needing an IT background. A Navy veteran, former police officer, father, and longtime IT professional whose experience includes work with NASA, Boeing, Dell, Houston Methodist, and Shell, Collin focuses on practical human-layer cybersecurity: understanding the risks that matter, closing unnecessary doors, and keeping the technology people actually use working. His operating principle is simple: Harder to target. Not harder to use.

https://www.the100hacker.com/about
Previous
Previous

Your Family Leaves Digital Breadcrumbs Everywhere. Here’s How to Leave Fewer.

Next
Next

Browser Extensions, Sessions, and the Account You Thought 2FA Protected