If you’re reading this, you’re probably the family member who handles these things. This is the complete plan: the conversation, the five scams hitting parents right now, a 60-minute tech hardening session, and exactly what to do if it’s already happened. It’s written to be forwarded to siblings.

Why parents get targeted – and why shame is the scammer’s best weapon

Scammers target older adults deliberately: authority pressure, fake emergencies, medical or government impersonation, romance and investment stories, and a heavy dose of shame. The FBI’s IC3, the SSA, Medicare, and the FTC all point to the same practical pattern: pause, verify through an official channel, protect accounts, and report quickly when money or identity data is involved. Everything in this guide is built around removing shame: the response to “I think I did something stupid” is always “thank you for telling me,” never “how could you.”

Step 1: The conversation first

Software is the second step. The first is a conversation that doesn’t condescend. Scripts that work:

• “Someone tried this on me last week – can I show you what it looked like?” (you go first, so it’s not about their competence)
• “The banks say even their own staff get fooled by these now. They’re that good.”
• “Can we agree that for anything involving money or passwords, we call each other first? No exceptions, even when it sounds urgent – especially when it sounds urgent.”

Step 2: The five scams hitting parents right now

1. The grandparent / voice-clone call. “Grandma, I’m in trouble, don’t tell Mom.” The voice may be cloned from a 10-second social clip. The tell: urgency plus secrecy plus untraceable payment. The response: hang up, call the grandchild’s real number, use the code word.

2. Tech support pop-ups. A screen-filling warning with a phone number, or a cold call “from Microsoft.” The tell: real companies never put phone numbers in virus warnings or call you first. The response: close the browser or power off; nothing is actually wrong.

3. Romance scams. Months of patient warmth, then a crisis needing money – always a reason they can’t video call. The tell: requests for gift cards, wire transfers, or crypto from someone never met in person. The response: no money to anyone not met face to face, full stop – and no blame, because these are professionals running a script.

4. Government impersonation. “This is the IRS/Social Security – there’s a warrant unless you pay today.” The tell: government agencies don’t call demanding payment, don’t take gift cards, and don’t threaten same-day arrest. The response: hang up. Hanging up is not rude. Then call the agency’s published number if worried.

5. Phishing texts and emails. Fake delivery notices, bank alerts, “suspicious activity” messages with a link. The tell: any message that wants a click plus a login. The response: never log in from a link – go to the bank’s site or app directly.

Step 3: The 60-minute tech hardening session

Do this together, on their devices, one sitting, in this order:

Step 4: When to add paid protection

Everything above is free, and for many families it is enough. Paid monitoring can still make sense when the adult wants alerts, recovery help, and someone other than a family member coordinating paperwork after identity theft. Treat it as optional support, not a replacement for credit freezes, bank alerts, password changes, and direct reporting.

If they’ve already been scammed

1. Bank within 24 hours – fraud departments can sometimes reverse or freeze transfers if reached fast.
2. Report to the FBI at ic3.gov – it feeds real investigations and is required for some recovery routes.
3. Freeze credit at all three bureaus if any personal information was given.
4. No blame. Reported fraud can be fought; hidden fraud compounds.

What to do now

Safer browsing setup for an older adult

Start with browser updates, a password manager, two-factor authentication for email and banking, spam-call filtering, and a written recovery plan. If your parent uses hotel, hospital, cafe, or community Wi-Fi, add mobile data or a reputable VPN for sensitive sign-ins. Be clear about the limit: a VPN cannot tell whether a message is a scam, whether a caller is real, or whether a payment request is safe.