How to Protect Elderly Parents from Scams: A 2026 Family Playbook

If you’re reading this, something probably already happened. Maybe your mom mentioned a weird phone call from “the Social Security office.” Maybe your dad started getting unusually protective of his phone. Maybe a sibling forwarded a news story and said, “this is going to be Mom next.”

You’re not paranoid. The numbers are genuinely that bad, and they got worse again last year.

That’s 201,266 complaints from people over 60 in a single year, with an average loss of $38,500, according to the FBI’s 2025 Internet Crime Report, published in April 2026. More than 12,000 of them lost over $100,000 each.

The FTC’s Consumer Sentinel data tells a complementary story: adults 60+ reported $2.4 billion lost to scams in 2024, up from about $600 million in 2020, and older adults reported losing more than $3 billion in 2025. And those are just the people who reported. The FTC estimates the real cost to older Americans could be as high as $81.5 billion once you adjust for the shame that keeps most victims silent.

This playbook is for the adult child who wants to help without taking over. It is built from FTC, FBI IC3, and AARP Fraud Watch data from 2024 and 2025, the scam types spiking right now, and the practical conversations that actually move the needle with a parent who insists they’d “never fall for something like that.”

How do you protect elderly parents from scams?

Skip the “don’t click suspicious links” lecture — it doesn’t work anymore. Instead, watch for unusual money movement, set up practical guardrails like a credit freeze and a trusted contact on their accounts, rehearse a family “safe word” for emergency calls, and agree on one rule: any urgent money request gets verified with you first. The full setup checklist is below, along with what to do if it’s already happened.

Why the usual advice isn’t working

Most “protect your parents” articles say something like: “Tell them not to click suspicious links.” That advice is thirty years old. It was written for a world where scams looked like scams — where the emails had typos, where the person claiming to be from Microsoft had a thick accent, where the bank text came from a number that obviously wasn’t a bank.

That world is gone. In 2025, scammers used AI-generated voices that sounded exactly like a victim’s daughter, AI-generated text with perfect grammar and personalized context pulled from LinkedIn, and video calls with deepfake faces. The FBI’s 2025 IC3 report documented $893 million in losses specifically attributed to AI-enabled scams, and that’s only the subset the agency could identify.

Meanwhile, the part of the brain that processes fear and urgency — the amygdala — doesn’t get slower with age. If anything, it gets faster. Your 74-year-old father isn’t less smart than he was at 40. He’s dealing with a class of attack that didn’t exist at 40.

Which means telling him to “be more careful” is roughly as useful as telling someone to “just be faster” in a car race against a vehicle that didn’t exist last year.

Which scams hit adults 60+ hardest right now?

Before you can have a useful conversation, you need to know what’s actually out there. The FBI’s 2025 report breaks out every complaint filed by someone 60 or older, and ranked by money lost, the top of the list looks like this:

Figure 01 · Top losses, age 60+ ScamDrill

Source: FBI Internet Crime Complaint Center, 2025 Internet Crime Report (April 2026), complaints filed by people 60 and older. The cryptocurrency figure overlaps the categories above. Amber marks the threat.

Two things stand out. First, the money is concentrated in slow, high-dollar schemes. Phishing was the most-reported problem, with 48,064 complaints from people over 60, but it accounted for $77 million. Investment fraud drew about a third as many complaints and $3.5 billion in losses. Second, crypto runs through all of it: it was involved in $4.35 billion of what people over 60 lost, across categories.

Here’s what each of the big ones looks like from your parent’s side of the phone, plus one the FBI table doesn’t break out.

1. Investment & pig-butchering scams

Investment fraud is now the single biggest loss for people over 60: $3.52 billion reported to the FBI in 2025, nearly double the $1.83 billion of the year before. Many start on social media or with a “wrong number” text that blossoms into weeks of friendly conversation before the scammer introduces a “can’t-miss” crypto opportunity. This scam has its own name — “pig butchering” — and its own dedicated playbook on our blog.

If your parent wants to start investing online, that isn’t the problem. The rule that matters is where the account lives: at a firm they found and checked themselves on FINRA’s free BrokerCheck, never on a platform a new online friend recommended.

2. Tech support scams, fake “renewals,” and warranty calls

Tech and customer support scams were the second-biggest loss for people over 60 in 2025: $1.04 billion. These typically start with a pop-up that locks the browser (“Your computer has been infected! Call Microsoft support now!”) or an unsolicited call. Once the scammer gets remote access to the computer, they can see banking details, drain accounts, or lock the machine and demand payment. The FTC’s tech support guidance gives you two lines worth repeating at the kitchen table: legitimate tech companies won’t contact you out of the blue about a problem with your computer, and real security pop-ups never ask you to call a phone number.

A close cousin arrives by email: a “renewal” notice from Geek Squad, Norton or McAfee for a few hundred dollars your parent never agreed to pay. The same FTC guidance describes the script, and the agency has a separate alert on the Geek Squad version. You call to cancel. They ask for remote access to “process the refund,” claim they refunded too much, and want the difference back in gift cards, a wire, or crypto. The check takes thirty seconds: look at the card statement. No charge, no renewal.

Then there are the calls about a car’s “extended warranty.” The FTC’s advice on these robocalls is blunt: the companies behind them aren’t with the dealer or the manufacturer, what they’re selling is a service contract that can run hundreds or thousands of dollars, and the right response is to hang up.

3. Romance scams, and the new partner who needs money

Confidence and romance scams cost people over 60 $584 million in 2025, up from $389 million the year before, per the FBI. Older widowed or divorced adults are disproportionately targeted on Facebook, dating apps, and Words With Friends-style games. If you’ve ever thought “I wonder who Mom is messaging so much lately,” that instinct is worth a conversation. The FTC’s rule is one sentence: never send money or gifts to a sweetheart you haven’t met in person.

The harder version is the partner who is real, lives nearby, and is moving fast on money: a joint account, a name on the deed, a new will or power of attorney. You can’t forbid a competent adult from falling in love, and you shouldn’t try. Even Adult Protective Services, which takes exploitation reports in every state, has to balance safety against an adult’s right to make their own decisions. What you can protect is the process. Ask that any change to a will, a deed or a power of attorney go through your parent’s own lawyer, with the new partner not in the room, and keep the trusted contact and alerts from the checklist below in place. If you see pressure, isolation from the rest of the family, or money moving in ways your parent can’t explain, that can be financial exploitation, and APS is who you call. The Eldercare Locator, 1-800-677-1116, will connect you to the right office. For the online version, we have a separate guide on what to say when a family member is in love with a scammer.

4. Imposter scams — government, bank, and “fraud department” calls

The FTC reported in August 2025 that impersonation scammers stealing tens or even hundreds of thousands of dollars from older adults had grown more than four-fold. The FBI’s numbers point the same way: government impersonation alone cost people over 60 $413 million in 2025, nearly double the $208 million of 2024. The scammer poses as someone with authority — a Social Security officer, the FBI, Amazon fraud prevention, “your bank’s fraud team.” They invent an emergency: your account has been compromised, your identity is being used for crimes, you’re about to be arrested. They offer to “help” by walking the victim through moving money to a “secure account” (which is actually theirs). One of the most common 2026 versions is the jury duty “arrest warrant” call, which threatens arrest over a missed summons. Another is the “pay yourself” scam, where a fake bank fraud department talks your parent into a Zelle transfer to “protect” their money.

The call often includes a real-sounding transfer to a “federal officer” or “supervisor” to add legitimacy. Some victims spend hours on the phone, being walked step-by-step to a Bitcoin ATM or a wire transfer counter. Two facts are worth having ready before the call comes. The FBI, which tied nearly 61,000 complaints and more than $1.6 billion in losses between January 2025 and July 2026 to people posing as police and officials, says in a September 2026 warning that real officials never ask for payment by prepaid card, crypto or courier. And Social Security’s inspector general says its real employees don’t send photos of badges, demand immediate payment, ask for gift cards, gold bars, crypto, wires or cash, or threaten arrest.

5. Grandparent & family-emergency scams — now with AI voices

The classic grandparent scam — “Grandma, it’s me, I’m in jail, don’t tell Mom” — is not new. What’s new is that the voice on the line now actually sounds like their grandchild. Scammers scrape 10-30 seconds of audio from TikTok, Instagram, or a voicemail greeting and use consumer AI tools to clone it. The FBI’s 2025 report counts more than $5 million in losses to voice-cloned “distress” calls and says the scheme is spreading to imitate other relatives and close friends, too.

In July 2025, Sharon Brightwell of Dover, Florida, lost $15,000 in cash to a courier after hearing what she was sure was her daughter’s voice, sobbing, confessing to a car accident that killed a pregnant woman. It wasn’t her daughter. It was 30 seconds of her daughter’s voice fed into a cloning tool. We wrote a detailed breakdown of this specific scam in our guide to AI voice cloning scams.

6. Medicare and health-insurance scams

These don’t get their own line in the FBI table, but they’re aimed squarely at people on Medicare. The common version is a “free” genetic test or cheek swab offered by phone, at a health fair, or at the door. The HHS inspector general warns that the point is the Medicare number, and that if Medicare denies the claim your parent could be billed for the whole test, potentially thousands of dollars. If a test kit arrives that their own doctor didn’t order, refuse it or send it back.

Medicare.gov is clear that Medicare will never call to sell anything or visit your home. Suspicious calls go to 1-800-MEDICARE (1-800-633-4227). A newer twist arrives through the patient portal; we broke it down in our MyChart “Medicare kit” guide.

The framework: Observe, Equip, Rehearse, Verify

This is the four-part framework we recommend to every family that signs up for ScamDrill. It’s based on what actually works, not what feels productive.

Step 1: Observe (before you say anything)

Before you bring it up, pay attention. Warning signs aren’t what you’d expect. They’re rarely “Mom talked about a Nigerian prince.” They’re more often:

• New secrecy around finances or the phone. A parent who used to leave their laptop open now closes it when you walk in.
• New online “friend” or “advisor” who only communicates by text, WhatsApp, or Telegram, and whom no one in the family has met.
• Unusual purchases of gift cards — iTunes, Google Play, Target, Amazon — in amounts over $100. Gift cards are the number-one payment method in impersonation scams. The FTC specifically flags this as a red flag worth acting on immediately. Our holiday scams guide has a one-line rule about gift cards that is easy to pass on at the family table.
• Wire transfers or cash withdrawals that the parent can’t quite explain, or explains in convoluted language.
• New remote-access software installed on a computer: AnyDesk, TeamViewer, LogMeIn, Splashtop.
• Emotional volatility around a specific app or contact — anger when asked about “Michael,” tears when a phone call is interrupted.

If you see any of these, the conversation has become urgent. If you see two or more, call your parent today.

Step 2: Equip (the conversation that actually works)

Now, the conversation. We’ve watched thousands of these unfold and there are two dominant failure modes:

Failure mode 1: The lecture. You sit your dad down and explain scams to him like he’s an eight-year-old. He shuts down. He feels infantilized. Next time something happens, he tells you less, not more.

Failure mode 2: The intervention. You arrive with a sibling, a spreadsheet of red flags, and a printed copy of their bank statement. Your parent experiences this as an ambush, and you lose the relationship for six months.

What works instead is a specific, collaborative conversation framed around you:

1. “Dad, I just read something scary. I want to set up a family code word so if I ever call you in an emergency, you’ll know it’s really me. Can we pick one?”
2. “If anyone — anyone — calls claiming to be from my company, the IRS, or Medicare, and they say it’s urgent, can you just text me first? I promise I’ll answer within 15 minutes. Deal?”
3. “I keep getting these weird texts about packages. You too? Let’s compare — I want to see what the latest ones look like.”

Notice the pattern: none of these positions your parent as the person who might be fooled. All of them build a habit of pausing that protects them when a real attack happens.

Step 3: Rehearse (this is the step everyone skips)

Here is the uncomfortable truth that corporate security teams have known for fifteen years: knowing about scams does not protect you from scams. Rehearsal does.

A 2025 UC San Diego study of more than 19,500 healthcare employees found no correlation between the recency of annual security-awareness training and phishing-failure rates. Reading about scams, watching videos about scams, even taking quizzes about scams — none of it reliably changes behavior when a real scam arrives.

What does? Being walked through a near-miss — in the moment — by a trusted source. Research consistently shows that susceptibility to phishing drops by an average of 40 percent when training happens immediately after a click on a simulated attack, because that’s when the brain is primed to learn.

This is the exact gap ScamDrill was built to fill for families. You add your mom, dad, or grandparent to a family plan. We send them realistic-but-safe simulated scam emails — calibrated to their situation — on a schedule they never see, plus short scam-prevention tips by text. If they fall for one, they see a gentle, friendly “gotcha” page that walks them through the red flags they missed. If they spot it, they get a small celebration.

Step 4: Verify (close the easy holes)

Rehearsal covers the moment of the call. Verification covers what happens if a scam gets through anyway: who notices, how fast, and how much can leave before anyone does. It’s mostly account and phone settings, and it gets its own section.

What should you set up to protect an elderly parent?

Most of these take one phone call or ten minutes in a settings menu. Do them together, at their kitchen table, on their devices. None of them hand you their money or their passwords, which is exactly why they’re easier to agree to than you’d think.

Figure 02 · Setup checklist ScamDrill

Based on guidance from FINRA, the CFPB, the FTC, Apple and Google, linked in the steps below. Blue marks the safe move.

1. Name a trusted contact at the bank and every brokerage

A trusted contact is someone the firm is allowed to call if it can’t reach your parent or suspects they’re being exploited. At a brokerage, FINRA Rule 4512 requires the firm to make reasonable efforts to get one, and under Rule 2165 the firm can put a temporary hold on a suspicious withdrawal while it looks into it. Naming you doesn’t let you trade, move money, or act for them; FINRA’s investor guide is explicit that a trusted contact has no authority over the account. Some banks and credit unions offer the same thing. The CFPB’s guide to trusted contacts suggests naming more than one person, in case the first one is ever the problem.

2. Turn on alerts that reach you, too

Ask the bank which text and email alerts it offers, and turn on the ones for withdrawals over an amount your parent chooses, new payees, and password or address changes. Have them go to your parent and, where the bank allows a second contact, to you. Address and password changes matter as much as big withdrawals, because they can be the first sign that someone else is in the account.

3. Ask for read-only access, not a joint account

If your parent wants you to keep an eye on things, ask the bank whether it offers read-only (sometimes called view-only) access for a family member. The CFPB has urged banks to offer exactly this: a way for a relative to watch for irregularities without having access to the money. Where there’s no such option, ask the bank to send you copies of the statements instead.

What to avoid is the reflex of adding yourself as a joint owner. The same CFPB advisory warns that a joint owner can withdraw the money for their own use, that the account is exposed to the joint owner’s creditors, and that it can undo an estate plan. If your parent needs help paying bills, ask about a convenience account, which lets a helper deposit and write checks without changing who owns the money. Then make the statements a habit: our 20-minute monthly statement review is how one family found $200 a month in tech-support charges.

4. Freeze their credit at all three bureaus

A credit freeze stops anyone from opening new credit in their name, even with their Social Security number. Per the FTC, it’s free to place and lift, it lasts until they lift it, and it doesn’t affect their credit score. It has to be done separately at Equifax, Experian and TransUnion; IdentityTheft.gov lists all three. Keep the logins somewhere both of you can find them, because the day they need new credit is the day they’ll need to lift it.

5. Put a filter on the phone

Register the number at DoNotCall.gov or 1-888-382-1222. It’s free and never expires, but know its limit: the FTC says it won’t stop calls from scammers, who ignore it. The settings that actually help are on the phone itself.

• iPhone: Settings › Apps › Phone › Screen Unknown Callers › Ask Reason for Calling. Callers who aren’t in contacts have to say why they’re calling before the phone rings (Apple’s instructions).
• Android with Google’s Phone app: Call Screen does something similar, and on Pixel phones in the US it can screen likely spam automatically (Google’s instructions).
• Then save the family. Add every relative, the doctor, the pharmacy and the bank’s real number to their contacts, so the calls that matter ring straight through. And ask their carrier what spam-call blocking comes with their plan.

6. Lock the front doors: email and banking logins

Turn on two-step sign-in for their email and every bank and brokerage login, and replace any password they use in more than one place. Email comes first, because it’s where every password reset goes. While you’re there, turn on the browser’s built-in phishing protection and remove any remote-access app (AnyDesk, TeamViewer and the like) that they didn’t install themselves for a reason they can name.

7. Pick a family safe word

One phrase that anyone calling “in trouble” has to know, plus the rule that goes with it: no safe word, hang up and call back on the number you already have. It’s the main defense against cloned voices. There’s more on it in the last section, and the full method is in our family safe word guide.

8. Talk about a durable power of attorney while it’s an easy conversation

A financial power of attorney names someone to manage money if your parent no longer can. Without one, a court may have to appoint a guardian or conservator, the CFPB’s financial caregiver guide notes. Have it drawn up by an elder-law attorney your parent chooses, and pick the agent with care: the same guide says to avoid anyone struggling with their own money, and that an agent should never mix your parent’s money with their own. Ask for a health care power of attorney at the same visit.

How to bring this up without insulting them

The trick is the same one from Step 2: start with yourself. Three lines that tend to land:

1. The freeze. “I just froze my credit after another data breach letter. Took twenty minutes. Want to do yours while I still remember how?”
2. The trusted contact. “My brokerage asked me to name a trusted contact. It’s just who they call if they can’t reach me — they can’t see or touch anything. Can I put you on mine, and you put me on yours?”
3. The power of attorney. “If I got hit by a bus tomorrow, somebody would need to pay my mortgage. I’m doing my power of attorney this month. Want to do yours at the same time?”

None of these is about their age, and all of them are true for you too. That’s why they work.

How do you protect parents from data leaks?

You can’t stop a hospital, a retailer or a data broker from leaking your parent’s information. You can make the leak far less useful. People over 60 filed 11,705 personal-data-breach complaints with the FBI in 2025, with $324 million in reported losses, so this isn’t abstract.

• The credit freeze above does the heavy lifting. A leaked Social Security number can’t be used to open new credit at a frozen bureau.
• Get an IRS Identity Protection PIN. Anyone with a Social Security number who can verify their identity can get one, and it stops someone else from filing a tax return in their name. A new one is issued every year.
• Opt out of prescreened credit offers at optoutprescreen.com or 1-888-567-8688. The FTC explains the options: five years online or by phone, or permanently with a signed form. Fewer pre-approved offers in the mailbox means fewer to steal.
• If they live in California, one free request through the state’s Delete Request and Opt-out Platform (DROP) goes to more than 600 registered data brokers, which began processing requests in August 2026. Elsewhere, removal is site by site.
• When a breach letter arrives, use IdentityTheft.gov/databreach for steps matched to what was exposed, and treat any unexpected call “about the breach” as the next scam until proven otherwise. If a Social Security number is already out there, our step-by-step SSN plan covers the rest.

What to do in the first hour if your parent has already been scammed

Then, in this order:

1. Stop the conversation. Hang up, close the chat, and don’t call back any number the scammer gave. If someone had remote access to the computer, shut it down and keep it offline until it’s been checked.
2. Call the bank or card company on the number printed on the card or statement. Ask them to stop or recall any transfer and to flag the account. The FBI’s advice for a fraudulent transfer is that time is of the essence: call the bank immediately and request a recall.
3. File at ic3.gov, whatever the amount, with the full transaction details. The FBI’s Recovery Asset Team works with banks to freeze stolen funds. In 2025 it took on 642 cases involving victims over 60 and helped freeze $32.9 million of the $65.4 million reported, about half, according to the 2025 IC3 report.
4. Call the National Elder Fraud Hotline: 1-833-FRAUD-11 (1-833-372-8311). It’s a free service for people 60 and older, set up by the Justice Department’s Office for Victims of Crime, and it’s staffed weekdays 10 a.m. to 6 p.m. Eastern. Case managers help file the IC3 and FTC reports and connect you to local help; they don’t investigate. You can make the call together.
5. Report it to the FTC at ReportFraud.ftc.gov, and change the passwords on email and banking from a different, clean device.
6. Freeze their credit if they gave out a Social Security number or ID, and get a recovery plan at IdentityTheft.gov.
7. Expect a second call. People who’ve just been scammed are prime targets for “recovery” services that promise the money back for an upfront fee. Here’s how to tell a real agency from the second con.

For the minute-by-minute version, use our first 60 minutes after a scam plan. The AARP Fraud Watch Network Helpline, 877-908-3360 (weekdays 8 a.m. to 8 p.m. Eastern), is there for guidance and for the emotional side of this, which is often the harder part. And if you suspect someone your parent knows is behind it, Adult Protective Services takes that report; the Eldercare Locator at 1-800-677-1116 will point you to the right office.

The one conversation to have this weekend

If you read this entire article and do nothing else, do this:

Call your parent today. Not to talk about scams. Call to set up a family safe word — a specific, meaningless phrase that only the two of you know. “Blue giraffe.” “Uncle Larry’s boat.” Whatever.

Tell them: “If anyone ever calls you claiming to be me in an emergency, ask them for the safe word. If they don’t know it, hang up and call me back.” Then add: “I’ll do the same if I get a call claiming to be you.” For the full method — picking a word that sticks, where to store it, and how to test it — here’s our step-by-step guide to the family safe word.

That two-minute conversation is one of the highest-leverage pieces of scam protection available to a family in 2026. It costs nothing. It works against voice cloning, against emotional manipulation, against urgency-based attacks. And your parent will thank you for treating it as a mutual protection pact rather than a “you’re old and might fall for something” lecture. If you want one page to work from together on that call, we keep a short version: the four scams that do most of the damage, and the single rule that beats all of them.

Then sign them up for ScamDrill (or don’t — but do set up some form of ongoing rehearsal). One conversation is a start. A habit of pausing is the actual defense.

Further reading on ScamDrill: our breakdowns of AI voice cloning scams, pig butchering crypto cons, and how to help a family member who thinks they’re in love with a scammer. For two practical companion routines: the 20-minute monthly statement review that catches scam-related charges before they auto-renew, and our age-by-age guide to teaching kids about online scams without scaring them — useful in households where grandkids and grandparents share devices.