A Weekend Setup That Makes a Parent's Devices Harder to Scam
Two hours of setup removes a real share of the ways scams reach an older parent. A practical checklist for the phone, the computer, and the accounts.
Most of what families do about scams is talk. A warning at Thanksgiving, an article forwarded in March, a slightly tense conversation after something almost happened.
Talking is the weakest available intervention, and there's a reason: the moment a scam is actually working, your parent is being spoken to by a professional in real time, and nothing you said in November is in the room. What is in the room is the phone, the computer, the accounts, and whatever friction has been built into them.
So build the friction. It takes about two hours, it's a one-time cost, and it works whether or not anyone remembers the conversation.
A note before starting: do this together, not secretly. Setup done behind a parent's back gets discovered, gets resented, and gets undone — and the resentment costs you far more than the settings gained. Frame it as household hygiene, the same as changing smoke detector batteries. Most people will happily accept help with settings while flatly refusing help with their judgment.
Part 1 — The phone (about 30 minutes)
The phone is where the largest losses actually happen. In FTC data on older adults who lost $10,000 or more to business or government imposter scams, the largest share said contact began with a phone call — well ahead of email or pop-ups. The screen may start it; the phone finishes it.
Turn on carrier-level scam blocking. All four major US carriers offer free spam and scam call filtering, and it's frequently not enabled by default. It's an app or a line-item on the account. This single step removes a meaningful volume of attempts before they ever ring.
Silence unknown callers — carefully. Both iPhone and Android can route calls from numbers not in contacts straight to voicemail. It's the most effective setting available and the most disruptive, so the honest advice is: only do this if the contact list is genuinely complete, including the pharmacy, the doctor's office, the church, and any adult child's work number. A parent who misses a call from their cardiologist will turn it off within a week, and you'll have lost the setting and some credibility.
Fill in the contact list properly. Under-appreciated, and it does double duty. A named caller is verified; an unnamed one is a decision. It also makes the callback rule easy — "call the bank" only works if the bank's real number is already in the phone. Add the bank, the card issuer, the doctor, the pharmacy, the insurer, and every family member.
Enable spam filtering for text messages. iPhone: Settings → Apps → Messages → Filter Unknown Senders. Android varies by device, usually under Messages → Settings → Spam protection.
Remove any remote access apps that nobody can explain. AnyDesk, TeamViewer, LogMeIn, QuickSupport and similar. These are legitimate tools with legitimate uses — and they're what tech support scammers ask people to install. If it's there and nobody knows why, that's a finding.
Part 2 — The computer (about 45 minutes)
Turn on automatic updates for the operating system and the browser. Unglamorous and among the highest-value items on this list.
Install a reputable ad and pop-up blocker. A large share of the fake security alerts that begin tech support scams arrive through malicious ads on otherwise ordinary websites. Blocking them removes the entry point rather than relying on your parent to correctly identify the alert as fake — which, given how good the fakes are, is the wrong place to put the burden.
Do the pop-up drill together. Show them what a fake security alert looks like. Then show them how to close it: close the browser; if it resists, hold the power button and restart the machine. Then say the rule out loud — a real warning never gives you a phone number to call. Practicing the exit is worth more than describing the danger, because in the actual moment the problem isn't recognition, it's not knowing how to make the alarming thing stop.
Check what's installed. Anything remote-access related that nobody can account for. Browser extensions nobody remembers adding. Any "PC optimizer" or "system cleaner" software, which is frequently the residue of an earlier scam and sometimes the vector for the next one.
Set up the browser's password manager, or a proper one, and use it. The realistic alternative is one password reused everywhere or a notebook by the desk, and both are worse. Start with the two that matter: email and the bank.
Part 3 — The accounts (about 45 minutes, and this is the part that matters most)
Devices reduce exposure. Account settings reduce loss, which is a different and more important job.
Secure the email account first. Not the bank — the email. Email is the reset mechanism for every other account, which makes it the master key. Strong unique password, multi-factor authentication turned on, and recovery options reviewed so an old defunct address isn't sitting there as a back door.
Then multi-factor authentication on the bank and any brokerage. Text-message codes are the weakest form and still enormously better than nothing. An authenticator app is better if your parent will actually use it; a method that gets abandoned protects no one.
Turn on transaction alerts, set low. Most banks will text or email on any transaction over an amount you choose, on any wire or ACH transfer, on any change to contact details, and on any new payee. Set the threshold lower than feels necessary. These alerts are how a family finds out on day one instead of day forty — and in large-loss cases, that gap is most of the damage.
Add a trusted contact. Brokerages are required to ask for one, and many banks now offer the equivalent. A trusted contact is not power of attorney and confers no authority over the account — it simply gives the institution someone to call if they see something concerning. Low cost, no loss of autonomy, occasionally decisive.
Ask about a verbal password or callback verification on wires. Many institutions will add a step requiring a code word or a callback to a number on file before executing a transfer. This is precisely the friction that phantom hacker and distress scams are built to avoid.
Set up read-only visibility if your parent agrees. View access to accounts, or forwarded monthly statements, or a shared spreadsheet — the format matters much less than the fact that someone is looking. This is visibility, not control, and the distinction is worth stating plainly to your parent because it's the thing they're actually worried about.
Freeze the credit at all three bureaus. Equifax, Experian, TransUnion. Free, reversible in minutes when needed, and it blocks new accounts opened in their name. If your parent isn't applying for credit, there's essentially no downside.
Register on the Do Not Call list at donotcall.gov. It won't stop criminals, who ignore it, but it reduces legitimate telemarketing volume — which matters more than it sounds, because a phone that rings constantly with unknown numbers trains a person to answer them.
Part 4 — The rules (fifteen minutes, and worth more than the previous three hours)
Settings fail. Filters miss. What has to hold in the moment is a very small number of rules, and the smaller the set, the better it survives.
Rule one: hang up and call back on a number you look up yourself. Not the number they gave you. Not the caller ID. This defeats nearly every impersonation scam and requires no judgment about whether the caller sounds legitimate.
Rule two: no money moves without a second family member. Mutual, not imposed — it applies to you too. Removes the shame from checking.
Rule three: any instruction to keep something from the family means it's a scam. No exceptions, no matter how reasonable the reason sounds. It's the one element present in nearly every large-loss case.
Rule four: nobody legitimate wants gift cards, cryptocurrency, wire transfers to a "safe account," cash by courier, or gold. Payment method is the cleanest possible signal.
Write them on an index card. Tape it where the phone lives. This looks unsophisticated and it works better than almost anything else on this page, because during a live call nobody scrolls through an article — but people do look at what's in front of them.
What to do about the awkward part
Some of this will feel intrusive to your parent, and the conversation goes better if you name that directly rather than pretending it's nothing.
A framing that tends to land: this is about the criminals getting better, not about you getting older. Which happens to be accurate. Grammar mistakes used to be the giveaway and generative AI erased them. Caller ID used to mean something. A voice used to be proof of identity, and it's now cloneable from a few seconds of audio. Anyone competent would update their defenses in response to that, at any age.
The other framing that works is honest self-interest: I want to stop worrying, and this is what would let me. Most parents will accept a fair amount of structure to spare their children anxiety — considerably more than they'll accept to be protected from themselves.
And leave the autonomy intact. Visibility instead of control, alerts instead of restrictions, mutual rules instead of one-sided ones. Every element above can be built without a single thing being taken away, and that isn't only kinder — it's more durable, because arrangements that feel like a loss get quietly dismantled.
Frequently asked questions
What's the single highest-value thing on this list? Transaction alerts on the bank account, set at a low threshold. They don't prevent anything, but they collapse the time between a first transfer and someone noticing — and in the large-loss cases, that interval is where nearly all the damage accumulates.
My parent won't accept any of this. Where do I start? The index card. Four rules, no settings changed, nothing surrendered. Then carrier scam blocking, which is invisible to them. Build from there; the account-level items are much easier to raise after something minor has happened and been handled well.
Are the paid identity-theft services worth it? They mostly monitor and alert rather than prevent, and much of what they offer — credit freezes, transaction alerts — you can set up yourself for free in an afternoon. Some people value the recovery assistance and the single point of contact. Just don't mistake a subscription for a defense against the scams described here, which don't involve stolen identity at all.
Should I have access to my parent's accounts? View access, with their knowledge and consent, is reasonable and useful for most families. Control is a bigger step with legal and relational consequences, and it's worth talking to an elder law attorney before pursuing power of attorney rather than improvising it. Start with visibility; it solves most of the problem.
Ommpo Care monitors a parent's recurring bills, utilities, and known charges and flags anything new or unusual to the family — and staffs a live line your parent can call before acting on something urgent. Plans from $49/month.
General information, not legal, financial, or technical advice. Menu paths vary by device and version. Sources: FTC data spotlight on imposter scams, August 2025; FBI IC3 2025 Annual Report.
