Ask calmly what happened after the link was opened and whether the child entered information, installed anything, or approved a request.
If a password was entered, change it through the real service and review account activity.
If a suspicious file or app was downloaded, do not open it and check the device using its normal security tools.
Use the incident that matches what happened next rather than assuming that simply clicking a link proves the device was compromised.