A Cybersecurity Checklist for Your Parents and Older Relatives

Older adults lose more money to online fraud than any other age group, and it is not because they are less intelligent. It is because they hold more savings, they were raised to be polite to people who call, they are more likely to be alone when the phone rings, and the scripts are specifically written to exploit all three.

The good news is that a single afternoon of setup removes most of the risk, and it works because it does not depend on your parent spotting a scam in the moment. It depends on the accounts and devices being configured so the scam cannot succeed even if they fall for it.

Start With the Conversation, Not the Settings

Get this part wrong and nothing else sticks.

Do not lecture. Framing this as "you might get tricked" invites resistance. Frame it as something everyone does now: "I just set all this up on my own accounts, let's do yours too."

Make it safe to ask. The most damaging outcome is a parent who gets scammed and hides it out of embarrassment, letting it continue for months. Say clearly and more than once: if anything ever feels odd, call me and I will never be annoyed, and I will never judge you.

Give them a script, not a warning list. Rules are easier to follow than judgement calls. Three sentences they can memorise:

• "I don't make decisions on the phone. I'll call you back on the number I have."
• "I never give a code from a text to anybody."
• "I never pay with gift cards, transfers, or crypto."

Write it down. A single printed page next to the phone beats anything on a screen.

The Setup Checklist

1. Secure the email account first

Everything resets through email. Give it a unique strong password stored in a password manager, turn on two-factor authentication, and check that the recovery phone and address are current and correct. Do this before anything else.

2. Set up a password manager together

Most older adults reuse one password everywhere or keep a notebook. The notebook is honestly not terrible for home use, but a password manager with a strong master password is better. Set it up on their phone with biometric unlock so day-to-day use is just a fingerprint.

3. Turn on two-factor authentication on the accounts that matter

Email, banking, and any account holding money. Use an authenticator app if they can manage it; SMS if they cannot. Print the backup codes and put them somewhere they will find them.

4. Call the bank and add extra protections

This is the highest-value phone call you will make. Ask for:

• Transaction alerts for every payment, by text or push
• A lower daily transfer limit — most people never need to move large sums, and a low ceiling caps the damage
• A verbal password or enhanced verification for phone banking
• A trusted contact on the account, where the bank offers it, so they can flag concerns to you

5. Add a carrier port-out PIN

Call the mobile provider and set a PIN or account lock that prevents the number being transferred. This blocks SIM swapping, which defeats SMS-based two-factor.

6. Turn on automatic updates

Phone, tablet, computer, and browser. Unpatched devices are the easiest targets and nobody installs updates manually.

7. Set up scam call and message filtering

Both iPhone and Android have silence-unknown-callers options, and most carriers offer free spam filtering. Turn them on. Fewer scam calls means fewer chances.

8. Freeze their credit

If they are not applying for loans, a credit freeze is free, reversible, and blocks new accounts being opened in their name. Do it at each credit bureau and store the PINs safely.

9. Set up remote help properly

Install a legitimate remote support tool with them, and explain firmly: the only person who ever gets remote access to this computer is me. Tech support impersonation is one of the most common scams against older adults, and it starts with remote access software.

10. Clean up the browser

Remove unknown extensions and toolbars, set a reputable search engine as default, and enable pop-up blocking. Fake virus pop-ups with a phone number are a standard entry point.

11. Agree the family passphrase

A word only the family knows, for any emergency call asking for money. AI voice cloning makes this essential — a cloned voice can sound exactly like a grandchild. Anyone who cannot produce the passphrase is not family.

12. Review who already has access

Check for old shared accounts, remote access tools installed by a previous "technician", browser-saved passwords, and any device or session on the account that nobody recognises.

13. Plan for the future while it is easy

Set legacy contacts on Apple and Google, and make sure someone trusted knows where the password manager master password is kept. This is much easier to arrange now than during a crisis.

The Scams to Warn Them About Specifically

• The grandchild emergency call. A distressed voice claiming arrest, accident, or trouble abroad, asking for money urgently and secretly. The passphrase and the callback rule defeat it entirely.
• Tech support pop-ups. A frightening full-screen warning with a phone number. Real security software never gives you a number to call. Teach them to close the browser or restart the computer.
• "Your account has been compromised, move your money to a safe account." Always a scam. No bank ever says this.
• Government and tax impersonation. Threats of arrest over unpaid tax. Real tax authorities write letters; they do not demand gift cards.
• Romance scams. Often targeting widowed or isolated people, developing over months before any money is mentioned. The tell is that they will never video call and always need money for an emergency.
• Prize and lottery scams. Any winnings requiring an upfront fee or tax payment are fake.
• Fake charity calls, especially after a disaster.
• Medicare, pension, or insurance calls asking to "verify" their number.

Keep It Working

• Do a fifteen-minute check-in every few months. Look at recent transactions together, check for new apps or extensions, and confirm updates are installing.
• Ask casually and without alarm whether anyone has called about their computer or bank recently.
• Be the easy option. If calling you is faster and less stressful than dealing with the caller, they will call you.

If They Have Already Been Scammed

1. Lead with reassurance. "This happens to a lot of people and it is not your fault" gets you the full story. Blame gets you half of it, and the half they leave out is usually the important part.
2. Call the bank immediately and ask for a recall. Speed determines whether the money comes back.
3. If remote access was given, disconnect the computer from the internet, uninstall the remote software, change every password from a different device, and consider a full reset.
4. Change passwords and enable two-factor starting with email, then banking.
5. Freeze credit and place a fraud alert if personal or identity details were shared.
6. Report it — FTC and IC3 in the US, Action Fraud in the UK, or your national body. Reports help, even when recovery does not.
7. Expect the recovery scam. Victims get contacted again by fake "fund recovery" services. Warn them explicitly that this will happen.
8. Check for ongoing access — mail forwarding rules, added recovery emails, new authorised users on accounts, and recurring payments they did not set up.

The Bottom Line

You cannot make anyone immune to a well-written script delivered by a professional. What you can do is build a setup where falling for the script does not cost them anything.

If you only do four things this weekend: secure the email with two-factor, call the bank to add alerts and lower the transfer limit, add a carrier port-out PIN, and agree a family passphrase.

Then say the sentence that matters most, and mean it: call me about anything, any time, and I will never make you feel stupid for asking.