Scammers target older adults deliberately: more savings, more landline hours, more trust in institutions, and, cruelly, more shame afterward, which is why so much of it goes unreported even inside families. If your parents are online, and they are, someone will eventually run the imposter script on them. This guide is the one-afternoon setup that changes how that call goes, built to respect one constraint the security industry ignores: they are adults, and it is their money and their life. The goal is rails, not custody.
The conversation comes before the settings
Warnings do not work; scripts do. "Watch out for scams" evaporates on contact with a caller who knows their bank and sounds official. What works is agreeing on two rules, in advance, framed as family policy rather than concern about their competence. Rule one: no money moves and no codes get read on any inbound call, ever; whoever calls, we hang up and call the real number ourselves. Rule two: a family password, one word a real grandchild in real trouble would know, because voice-cloned "emergency" calls now sound exactly like the grandchild. Frame both honestly: these rules exist because the scams are engineered to beat smart people, and following them is the competent move, not the fearful one.
The one-afternoon setup
Do it together, on their devices, with them driving where possible. Freeze their credit at all three bureaus: retirees are rarely applying for loans, so a freeze costs them nothing and removes the single worst outcome outright. Secure their email account: unique password, the strongest second factor they can operate comfortably, and check the recovery methods, which on long-lived accounts often point at dead numbers. Set up a password manager, or, honestly, if that is a bridge too far, a paper notebook kept at home: written-down unique passwords beat memorized reused ones, and the burglar is not the realistic threat model here. Add the SSN locks if their number has been in a breach, which for anyone with decades of accounts, it has. Finally, turn on transaction alerts on their cards, routed to their phone, and, if they want it, yours too.
- New secrecy or anxiety around the phone, mail, or computer.
- Mentions of a new "advisor," a prize, an investment, or an online romantic interest who cannot meet.
- Gift cards in the house with no obvious recipient.
- Unfamiliar charges, transfers, or a suddenly tight budget.
If money already left
Lead with the fact that matters: this happens to sharp people, in numbers that would astonish them, and the shame is part of the scam's design. Then move fast and matter-of-factly: their bank's fraud line first, wires can sometimes be recalled in the first hours; then IdentityTheft.gov if identity data was involved, and its recovery plan becomes the checklist. Being the person they can tell without an "I told you so" is, over the long run, the strongest security control in this entire guide.
Start the afternoon with their scan
Run their email through the free scan together. Seeing their own exposure, concretely, does more than any warning.
Run the Free Breach Scan →