How do I protect my elderly parents from scams?

Build a system around them: become a trusted contact on their bank and brokerage accounts, set transaction alerts to your phone, freeze their credit at all three bureaus, install a robocall blocker, install reputable antivirus, set up a family safe word for AI voice scams, and migrate them to a password manager. Have the tech-support-scam conversation explicitly: Microsoft and Apple never call, never give remote access. The goal isn't to make your parent perfect — it's to catch the inevitable mistake before it costs them everything.

What is a fake AV (fake antivirus) scam?

A pop-up appears on the computer claiming the device is infected and instructing the user to call a number. The 'helpful' person on the other end asks for remote access to 'fix' the problem. Once they have access, they install a backdoor that gives them ongoing surveillance — capturing every password and account login. The defense is teaching: never call a number from a pop-up, never give remote access, and call a trusted family member first.

At what age should I have the financial Power of Attorney conversation?

Have it while they're sharp. The point is to document who has authority to act if cognitive decline or sudden incapacity makes it necessary — not to take control today. Frame it as estate hygiene every adult should do. Most attorneys can prepare a Durable POA for $200-500. Do not wait until it's needed; that's when it's most painful and most expensive.

Secure Your Parents Checklist — You're Already a Target

👵👴 Adults 60+ lost $4.8 billion to scams in 2024. The defense isn't asking parents to be perfect — it's building a system around them so they don't have to be.

From the book: A close family member of Corey's saw a pop-up: "WARNING: Your computer has been infected. Call this number." They called. A "helpful" person asked for remote access to fix the slowness. They gave it. The attackers installed a backdoor that captured every password they typed for weeks. They weren't careless — they were being the same trusting, helpful person they'd been their entire life.

This is a Fake AV attack. It's devastatingly effective. The protection isn't more vigilance — it's a system that catches the mistake before it does damage.

🏦 Financial Account Oversight

Become the second set of eyes on every account — without taking away their independence.

Add yourself as a "trusted contact" on their bank and brokerage accountsMost major banks (Schwab, Fidelity, Chase, Wells Fargo, BofA) let you be notified about suspicious activity without granting you transaction power. Set up: read-only alerts to your phone for every transaction. Freeze their credit at all three bureausExperian, Equifax, TransUnion. Free, takes 30 minutes. Stops new accounts being opened in their name. Do this even if they "have nothing to steal" — synthetic identity fraud doesn't care about wealth. Set transaction alerts to YOUR phone, not theirsIf $1+ comes out of their account, you get the text. They get a duplicate, but you see it first. You'll know within minutes if something looks off. Set up a secondary "spending account" with limited fundsTheir primary savings stays locked. Day-to-day spending happens from a second account with $1,000-2,000 max. If that account gets drained, the damage is bounded. Discuss financial Power of Attorney (POA) before it's neededHave the conversation while they're sharp. Document who has authority to act if they can't. This is a love conversation, not a takeover.

📞 Phone & Tech-Support Scams

The #1 attack on older adults isn't sophisticated — it's a phone call from a "helpful" stranger.

Install a robocall blocker on their phoneRoboKiller, Hiya, or the carrier's blocker (T-Mobile Scam Shield, AT&T ActiveArmor, Verizon Call Filter). Free or low-cost. Blocks 80%+ of scam calls before they ring. Have the "tech support" conversation explicitlyMicrosoft, Apple, Google, and the IRS will NEVER call. Never call a number from a pop-up. Never give remote access. If a screen says you're infected, close the browser and call you instead. Establish a family safe word for emergency callsAI voice cloning is here. Pick a word only family knows. If anyone calls in distress asking for money or bail, the safe word is required. No safe word = it's a scam. Set up call screening on iPhone or PixeliOS: Settings → Phone → Silence Unknown Callers. Pixel: Phone app → Settings → Caller ID & spam → Verified Calls. Strangers go to voicemail.

💻 Device Hardening (Without Taking Over)

Set up devices once so attacks can't take root, then leave them alone.

Install a password manager and migrate their accounts1Password, Bitwarden, or Apple Passwords. Walk through the setup in person. Use the emergency-kit / family-vault feature so you can recover their passwords if needed. End the era of sticky-note passwords. Enable 2FA on email + bank + key social accountsUse SMS or an authenticator app on their phone. Yes, set it up for them — security has to fit the user, not the other way around. The tradeoff is worth it. Install reputable next-generation antivirusSentinelOne, Microsoft Defender (built into Windows), or Apple's built-in protections. Avoid the popups-asking-you-to-pay free tier products — they create the very confusion that fake-AV scams exploit. Set up DNS-level filtering on their home WiFiNextDNS, Cloudflare 1.1.1.1 for Families, or OpenDNS Family Shield. Free. Blocks malicious sites at the network level so the device never even sees them. Disable remote-access software they don't actively useTeamViewer, AnyDesk, Quick Assist, Chrome Remote Desktop. If they don't need it daily, uninstall it. Tech-support scammers walk customers through installing these on the call.

📧 Email & Inbox Hygiene

Most scams arrive via email. Make their inbox forgiving.

Migrate them to a managed mail provider (Gmail or iCloud)Both have strong default spam + phishing filtering. Avoid older ISP-provided email (att.net, comcast.net, aol.com) which have weaker protection. Teach the "if in doubt, screenshot and ask" ruleDon't expect them to be a phishing detector. Establish: if any email looks even slightly off, screenshot it and text you. Make it easy. Reward asking. Block known scam senders proactivelyEvery "you've won," "package delivery failed," "IRS" email — block the sender. The list is small. After a few weeks, the inbox calms down.

🩺 Healthcare & Medicare Fraud

Medicare scams cost seniors $60B+ a year. Add oversight here too.

Review Medicare statements monthly for charges they didn't getLook for services billed they never received. Report unauthorized charges to 1-800-MEDICARE. Identity thieves use stolen Medicare numbers heavily. Set up MyMedicare.gov account accessWith permission, you can view their claims and EOBs. Spot fraud the day it shows up. Teach the "Medicare won't call" ruleMedicare does not cold-call. Anyone calling claiming to be from Medicare is a scammer. Hang up.

📜 Estate & Digital Legacy

When the day comes, make sure their digital life isn't a locked vault.

Document where their accounts and recovery methods are storedA printed sheet in the password manager's emergency kit OR a sealed envelope with the executor. Email, banking, password manager master password, phone PIN, computer login. Set up Apple Legacy Contact, Google Inactive Account Manager, Facebook MemorializationEach major platform has a way to designate who gets access if they pass. Set them all up while alive — it's painful to do retroactively. Discuss what happens to accounts in case of death or incapacityBank, brokerage, retirement, social media, email, photos, subscriptions. The conversation is uncomfortable. Having it now is a gift to whoever inherits the work.

💜 The Loving Cadence

This isn't a one-time setup. It's a forever practice — done with love, not control.

Quarterly 30-minute "tech check-in" with each parentNot a security audit. A casual "how's everything?" that includes: any weird emails or calls? Any new apps installed? Any new charges they don't recognize? Treat it like a routine doctor's check-up for their digital life. Reward asking instead of guessingIf they call asking "is this real?" — celebrate it. Even if it's the tenth time today. The day they stop asking is the day a scam succeeds. Make sure they know exactly who to call (you, or a backup)A sticky note on the computer monitor: "Before clicking, calling, or paying anything that feels weird — call [your name and number] FIRST." Cheap, effective.

This checklist is from You're Already a Target by Corey White.

Take the Security Scorecard → Back to Master Checklist →