A Family Plan to Protect Aging Parents From Online Scams

Most online scams aimed at older adults do not start with a brilliant hack. They start with a message, call, email, pop-up, or social media contact that feels urgent. Someone pretends to be a bank, grandchild, government agency, tech-support worker, delivery company, romantic partner, investment adviser, or familiar business. Then they push fear or excitement and ask for something unusual: a gift card, crypto transfer, payment app transfer, wire, mailed cash, remote computer access, password, or one-time code. NCOA describes that shared pattern as impersonation, urgency, emotion, and an unusual payment demand.[1]

So the family rule should be just as simple: no unusual payment, password reset, account transfer, code, download, or urgent financial action gets handled inside the call, text, email, pop-up, or app message where it began. End the contact. Open a known website yourself, call the number on the back of the card, use the bank’s saved number, or call a trusted family contact first.

That rule is not a lecture about being gullible. It is a way to remove the scammer’s advantage: speed. A parent who knows exactly what to do next does not have to prove they are calm while someone is shouting that an account will be frozen, a warrant is coming, a package is stuck, or a grandchild is in trouble.

The rest of the plan has two paths. Use the first path before anything happens. Use the second path if money, account access, or personal information has already moved.

Why this is worth a weekend

The loss numbers are large, but they come from different reporting systems, so they should be read carefully. The FTC said adults 60 and older reported about $2.4 billion in fraud losses in 2024, about four times the roughly $600 million reported in 2020.[2] NCOA, citing IC3’s 2025 data, reported more than 201,000 complaints from adults 60 and older and more than $7.7 billion in reported losses, with complaints up about 37% and losses up about 59% compared with 2024.[1]

Those FTC and IC3 figures are not measuring the same exact universe. People report different crimes to different places, and many victims never report at all. The FTC’s older-adult report cites research estimating that only about 4.8% of mass-market fraud victims complain to a government agency or the Better Business Bureau.[2] For families, the practical conclusion is not to memorize one perfect number. It is to assume the risk is common enough, expensive enough, and underreported enough to justify controls before a crisis.

The high-dollar cases are especially punishing. FTC data showed reports of older adults losing $10,000 or more to business and government imposter scams rose more than fourfold, from 1,790 reports in 2020 to 8,269 in 2024.[3] The same FTC older-adult reporting found that adults 80 and older reported a median loss above $1,600.[2] One bad afternoon can become weeks of calls, affidavits, police reports, family arguments, and account cleanup.

Path 1: set up the safeguards before the scammer creates urgency

This is the weekend version. It does not require buying a specific app or becoming the family IT department forever. It does require doing the boring parts in the right order, because some controls reduce the chance of new-account fraud, some reveal suspicious activity, and some give the parent a script to follow when the pressure starts.

1. Freeze credit at all three bureaus

Start here if your parent is not actively applying for new credit. A credit freeze restricts access to the credit report, which makes it harder for someone to open new credit in your parent’s name. The FTC says freezes are free, last until lifted, do not affect the credit score, and must be placed separately with Equifax, Experian, and TransUnion.[4]

Do not do only one bureau and call it done. Put the freeze confirmation details somewhere the parent and the designated helper can find later, because the freeze may need to be temporarily lifted for a legitimate loan, apartment application, utility account, phone plan, or credit card application.

• Equifax: freeze directly through Equifax
• Experian: freeze directly through Experian
• TransUnion: freeze directly through TransUnion

A freeze does not stop every scam. It will not reverse a gift-card payment, prevent a bank transfer your parent authorizes, or block a fake tech-support pop-up. Its job is narrower and still valuable: reduce the damage if a scammer gets enough personal information to try opening accounts.

2. Turn on bank, card, and account alerts

Next, make money movement visible. Set alerts for credit cards, debit cards, checking accounts, savings accounts, brokerage accounts, and payment apps your parent actually uses. The useful alerts are the ones that catch behavior quickly: purchases over a chosen amount, online or phone transactions, international transactions, ATM withdrawals, account-profile changes, new payees, new external transfers, low balances, and failed logins.

If the bank or card issuer allows alerts to go to both the parent and a trusted helper, use that option only with the parent’s informed agreement. If it does not, decide who gets what. Some parents will want every alert themselves and will forward suspicious ones. Others may prefer a helper to receive large-transaction alerts because too many notifications become noise.

The FDIC advises older adults and families to watch for scams that pressure people to move money or share sensitive information, and to contact the financial institution using a trusted number when something seems wrong.[5] Alerts help because they shorten the time between the transaction and the first phone call.

3. Add trusted-contact or monitoring arrangements where available

A trusted contact is not the same as handing over control. It usually gives a financial institution someone to contact if staff suspect exploitation, cannot reach the account owner, or notice behavior that raises concern. Availability and exact rules vary by institution, so ask banks, brokerages, retirement-plan providers, and insurance companies what they offer.

Keep the parent in the chair for this part. The point is to protect their money without quietly replacing their judgment. If siblings or other relatives need to be involved, write down who receives alerts, who has online access, who can call the bank with the parent present, and who has legal authority if a power of attorney is already in place. Do not assume a customer-service representative can talk to you just because you are the adult child.

For broader financial context, families may also want to review how deposit insurance and account protections work in ordinary institutions; CareWise Guide’s article on safe places for retirees to keep savings besides a bank pairs well with this step.

4. Secure passwords and multi-factor authentication

The target is not password perfection. The target is to stop one stolen password from opening five doors.

• Use a password manager if your parent can tolerate one, or if a trusted helper will assist with setup and recovery.
• Give every important account its own password: email, bank, credit card, Social Security, Medicare, phone carrier, pharmacy, payment apps, shopping accounts, and cloud backup.
• Turn on multi-factor authentication for important accounts, preferably with an authenticator app or hardware key where realistic; text-message codes are still better than no second factor for many families.
• Protect the email account especially well, because password resets for other accounts often flow through email.
• Write down the recovery plan: where emergency codes are stored, who can help, and what happens if the phone is lost.

The FTC’s phishing guidance warns that scammers use emails and texts that look like familiar companies, often pushing people to click a link, confirm personal information, or act fast.[6] A password manager can help because it fills passwords on the real site, not a lookalike domain, but it is not magic. The family still needs the rule: do not enter passwords from a link in a scary or exciting message.

5. Update devices and security software

Update the phone, tablet, computer, browser, and security software. Turn on automatic updates where possible. Remove remote-access tools your parent does not knowingly use. If a real technician, family member, or home-care office uses remote access for legitimate support, write down the name of the tool and the rule for when it may be opened.

The rule should be blunt: no caller, pop-up, or text gets permission to take over the computer. If a bank, government agency, or software company supposedly needs remote access, end the contact and call the known number independently. For families helping a parent with an iPhone, the related CareWise Guide articles on iPhone safety features for seniors and Safari changes in iOS 27 may help with device-specific settings.

6. Reduce scam contact before it reaches your parent

You cannot block every bad call, text, ad, email, or social message. You can lower the volume.

• Turn on carrier-level spam-call blocking if the phone plan offers it.
• Enable phone settings that silence unknown callers if that will not interfere with doctors, pharmacies, rides, or caregivers.
• Use built-in junk filtering for texts and email.
• Unsubscribe cautiously from legitimate marketing email, but do not click unsubscribe links in obvious scam messages.
• Review social media privacy settings so strangers cannot easily see family names, travel plans, grief posts, or other details used in impersonation.
• Delete saved payment cards from shopping accounts your parent rarely uses.

Be careful with any setting that blocks too aggressively. A parent who misses legitimate medical calls may turn the whole thing off. It is better to reduce the flow by half and keep the system usable than to create a perfect-looking setup nobody can live with.

7. Put the verify-first family rule somewhere visible

The rule needs to be short enough to remember under stress. Put it near the computer, inside the checkbook cover, on the refrigerator, or in the phone’s notes app:

“If someone contacts me and wants money, gift cards, crypto, a wire, a payment app transfer, a password, a code, remote access, or urgent account action, I stop and verify outside that contact.”

Then define “verify” in plain family terms. For one family, it may mean calling the adult daughter and then the bank. For another, it may mean calling a sibling, a neighbor, and the card issuer. The parent should help choose the order. If they dislike feeling supervised, make the rule mutual: everyone in the family agrees to verify urgent money requests, including messages that appear to come from the parent or adult child.

A workable version might be:

• No gift cards, crypto, wires, payment-app transfers, mailed cash, or new “safe account” transfers because of a surprise call or message.
• No one-time codes read aloud to a caller.
• No remote access unless the helper was scheduled in advance and confirmed through a known family contact.
• No secrecy. Anyone who says “do not tell your daughter,” “do not tell the bank,” or “do not tell the police” is treated as suspicious.
• If the message claims to be from family, call back using the number already saved in contacts, not the number or link in the message.

This is also where newer scams belong in the conversation, including AI-written messages or cloned voices. The family does not need to debate whether a voice sounds real. It needs an out-of-band verification habit. CareWise Guide’s explainer on AI chatbots for seniors and caregivers can help families who want more context without turning this plan into a technology seminar.

Path 2: if money or information has already moved

If your parent has already sent money, shared a password, given remote access, bought gift cards, moved crypto, mailed cash, or read a code aloud, do not start with a family meeting. Start with the provider tied to the payment method. The FTC’s recovery guidance is organized this way because the first possible stop point depends on how the money moved.[7]

Policies vary by bank, card issuer, payment app, gift-card company, crypto exchange, ATM operator, and local authority. These steps are general guidance, not legal or financial advice, but they give the person doing the cleanup a sane order.

For bank transfers and wires, move fast

Call the bank or credit union first. Use the number on the bank’s website, app, statement, or card, not a number in the suspicious message. If it was a wire, IC3 advises contacting the financial institution to request a wire recall and asking for a hold-harmless letter or letter of indemnity, then protecting credit and reporting to local authorities and IC3.gov.[8]

Write down the time you called, the name or ID of the representative, the case number, and exactly what the bank said it could or could not do. If the parent is on the account and you are not authorized, have the parent present for the call if possible. If you have legal authority, say so early and ask how to submit the document.

If passwords, codes, or device access were shared

Assume the scammer may try again quickly. From a clean device, change the email password first, then financial accounts, phone carrier, cloud account, shopping accounts, and any account where the same or similar password was used. Turn on multi-factor authentication. Sign out of other sessions if the account offers that option. Remove unknown forwarding rules from email. Review recent account changes, saved payment methods, and new devices.

If remote-access software was installed, disconnect the device from the internet until someone trustworthy can remove it or evaluate the device. If the scammer may have seen banking activity, call those institutions even if no transaction has posted yet.

Then protect credit and identity

If the scammer received a Social Security number, date of birth, account numbers, driver’s license image, Medicare number, or enough details to impersonate your parent, place or confirm credit freezes at all three bureaus. If a freeze is not appropriate because your parent is actively applying for credit, ask the bureaus about fraud alerts. The FTC explains both credit freezes and fraud alerts and notes that freezes must be handled with each credit bureau.[4]

Check recent bank, card, and payment-app activity line by line. Do not stop at the one transaction your parent remembers. Scammers sometimes test small charges, add new payees, change contact information, or come back with a second story claiming they can recover the first loss.

Report, even if recovery is uncertain

Reporting does not guarantee reimbursement. It does create records that banks, investigators, local agencies, and sometimes insurers may ask for. Use the channels that fit what happened:

• Report fraud to the FTC at ReportFraud.ftc.gov.
• Report internet-enabled fraud to IC3 at IC3.gov.
• Call local police or sheriff’s office and ask how to file a report for financial fraud or elder fraud.
• If there is suspected exploitation, coercion, neglect, or an unsafe living situation, contact Adult Protective Services through the Eldercare Locator at 1-800-677-1116.
• For mailed cash, contact the U.S. Postal Inspection Service.
• For elder-fraud guidance, the National Elder Fraud Hotline is listed by IC3 as 1-833-FRAUD-11 or 1-833-372-8311, Monday through Friday, 10:00 a.m. to 6:00 p.m. Eastern. Hotline hours appear inconsistently across sources, so verify current hours if timing matters.[8]

Keep copies of everything: receipts, gift-card numbers, crypto wallet addresses, transaction IDs, tracking numbers, screenshots, emails, texts, phone numbers, caller names, remote-access app names, bank case numbers, police report numbers, and the date each account password was changed.

What not to spend time on during the first hour

Do not argue about whether it was “obviously” a scam. Do not make your parent retell the story to every sibling before anyone calls the bank. Do not search random recovery companies. Do not pay someone who claims they can get crypto, gift-card money, or wire money back if you pay a fee first. Do not keep texting the scammer to prove a point.

The first hour is for stopping what can still be stopped, locking what can still be locked, and preserving the record. The family debrief comes after the provider calls and reports are underway.

After the immediate cleanup

Once the urgent calls are done, document the incident in one place. A simple timeline is enough: first contact, what the scammer claimed, what was sent or shared, who was called, case numbers, accounts changed, reports filed, and what still needs follow-up. This prevents the same work from being repeated by three relatives and helps if the bank or police ask for details later.

Then tighten the missing safeguard. If the scam began with a fake bank text, adjust the verify-first rule and saved bank contact. If it worked because the same password was reused, finish the password manager setup. If no one saw the transaction for days, change the alert settings. If the scammer used personal family details, review social media privacy and whether public posts are giving away too much.

Watch for repeat contact. Scammers may return pretending to be law enforcement, a refund department, a hacker who can recover funds, or even a sympathetic helper. The second story often uses the first loss as proof that the parent needs urgent rescue. The same family rule applies: stop, verify outside the contact, and do not pay for recovery promises.

Also watch for patterns beyond one scam. Missed bills, unusual purchases, repeated password confusion, new secrecy around money, or trouble judging risky offers may simply reflect stress, grief, unfamiliar technology, or an unusually persuasive scammer. They can also be a reason to add support. AARP, reporting on a 2020 Johns Hopkins study in JAMA Internal Medicine, says financial slips can precede a dementia diagnosis by up to about six years.[9] That finding should not be used to diagnose a parent from one mistake. It does justify paying attention if financial trouble is new, repeated, or paired with other changes.

Protection is not one warning poster, one app, or one awkward talk. It is a family system that removes as many panic decisions as possible before the scammer creates urgency, and gives everyone a known sequence to follow if the scam has already succeeded.

References

1. The Top 5 Financial Scams Targeting Seniors and How to Avoid Them, NCOA
2. FTC Issues Annual Report to Congress on the Agency’s Actions to Protect Older Adults, Federal Trade Commission, December 2025
3. False alarm, real scam: How scammers are stealing older adults’ life savings, Federal Trade Commission, August 2025
4. Credit Freezes and Fraud Alerts, Federal Trade Commission
5. Scams Targeting Older Adults, FDIC, July 2025
6. How To Recognize and Avoid Phishing Scams, Federal Trade Commission
7. What To Do if You Were Scammed, Federal Trade Commission
8. Elder Fraud, IC3
9. How to Keep a Loved One With Cognitive Decline Safe From Scams, AARP