My teenage nephew got a RAT malware, that someone used to record him watching porn. Then they used that to blackmail him, saying that they would report him to the FBI for watching porn as minor or something. I believe looking for crypto as a payout.

My brother (his dad) caught wind of it and had some fun messing with the attacker. But for a moment my nephew was in some serious deep shit that he would have sneaked around to buy and send crypto to get out of.

So that's a scenario that could have happened, and would explain why he wouldn't want to tell the truth.

Alternatively - Ledger got hacked and a list of customers for the Nano S was stolen. So someone could use that for a targeted phishing attack. Perhaps the above would be a similar strategy

Edit: Aha! There are indeed warnings of active phishing attacks from Ledger: https://www.reddit.com/r/ledgerwallet/comments/ck6o44/be_car...

Your nephew got phished, and is leaving that bit of the story out