Helping an older relative stay safe online

Helping a parent or grandparent with technology is a common family role, and it is easy to do in ways that either patronise them or leave them more exposed than before.

The goal worth aiming at is not a locked-down device. It is an older adult who is confident enough to use the internet, and equipped with a small number of rules that hold up under pressure.

Start by discarding the stereotype

Older adults are not uniformly bad with technology, and treating them as such is both wrong and counterproductive — it makes people conceal problems rather than mention them.

Two things are true and worth being precise about:

• Older adults are disproportionately targeted for certain fraud, and losses per incident tend to be higher because more wealth is available.
• The vulnerability is usually not technical ignorance. It is social: isolation, a cultural disposition to be polite to authority, reluctance to hang up on someone, and — critically — the fear of being judged incapable if they admit a mistake.

That last point drives the design of nearly everything below. Shame is the mechanism scammers rely on, both to complete the fraud and to prevent it being reported.

The scams that actually target them

The impersonated relative. A call or message: a grandchild is in trouble, has been arrested, has crashed a car, and needs money urgently — and please don't tell my parents. Voice cloning from a few seconds of audio has made this far more convincing.

Defence: a family password. Agree a word now, with everyone. Any emergency request for money must include it. Simple, free, and it defeats the entire category, including the cloned-voice version.

The tech support call. Someone claims to be from Microsoft, Apple, or the internet provider, says the computer is infected, and asks for remote access. Once connected they install software, "find" problems, and take payment — or open the banking site.

Defence: no legitimate company ever calls you about a virus. Not one. This is an absolute rule that is easy to remember.

The bank's "safe account". A caller spoofing the bank's real number says the account is compromised and money must be moved to a new safe account. Because the victim authorises the transfer, it is much harder to reverse.

Defence: hang up and call the number on the back of the card, from a different phone if possible.

The romance scam. A long relationship, built over months, that eventually requires money. Devastating financially and emotionally, and heavily targeted at people who are widowed or isolated. The emotional investment is what makes warnings so hard to hear.

Defence: hard to defend technically. Notice the pattern — someone who is always unable to meet or video call, and whose crises always involve money. Approach with curiosity rather than accusation, because a confrontation usually pushes the person towards the scammer.

Fake invoices and subscription renewals. An email claiming a large charge for a subscription with a number to call to cancel. Calling connects you to the scammer.

Defence: never use contact details from the message itself.

Prize, refund, and government-rebate messages. Tax refunds, lottery wins, energy rebates. Any of these requiring a fee or your bank details is fraud.

Our guide on recognising social engineering covers the underlying structure common to all of them.

The setup that prevents most of it

An afternoon of configuration removes a large fraction of the risk.

On the phone:

• Turn on silence unknown callers or the carrier's spam filtering. Most scam calls simply stop arriving. This is the single highest-value change available.
• Enable automatic updates so security patches install without anyone deciding to.
• Set up emergency contacts and medical ID.
• Increase text size and contrast properly — genuinely helps, and reduces mistaken taps.

On accounts:

• A password manager, set up with them, with the master password written down and stored somewhere physically safe. A written password in a locked drawer at home is a sensible trade-off; reusing one password everywhere is not.
• Two-factor authentication on email and banking. Prefer an authenticator app; keep printed recovery codes with their documents.
• Check the recovery details are current and reachable.
• Correct, current contact details at the bank — many banks will phone to check unusual transactions if they can reach the customer.

On banking, specifically:

• Ask the bank about a trusted contact or third-party notification, where a nominated relative is alerted to unusual activity without gaining any control over the account. Many banks offer this and almost nobody uses it. It preserves independence entirely.
• Set up transaction alerts by text or email.
• Consider a lower daily transfer limit on the main account. Most fraud losses require a large, fast transfer.
• Keep day-to-day money separate from savings.

On the computer:

• Remove any remote access software they did not knowingly install and use.
• Ensure the browser is current, with a reputable ad blocker — malicious advertising is a common infection route.
• Set up automatic backups.

How to help without taking over

The manner matters as much as the settings.

Ask before changing anything. Arriving and reconfiguring someone's device without explanation is disempowering, and they will not know how to undo it or how it now works.

Explain the reason, not just the action. "This stops calls from numbers not in your contacts, so the scam calls won't ring — your friends still get through" produces a person who understands their own device.

Write it down. A single sheet, large print, by the phone: the family password, the three rules below, your number, the bank's real number.

Establish the no-judgement rule, explicitly. Say some version of: "If you ever think you've been caught out by one of these, ring me straight away. It happens to everyone, it will never be a problem between us, and the sooner we ring the bank the better." Then mean it. The delay caused by embarrassment is frequently the difference between recovering money and not.

Do not make yourself the only route. If every question has to go through you, they will not ask when you are unavailable, and they will make decisions alone under pressure. Show them how to find the official contact details themselves.

Watch the direction of the relationship. Removing autonomy has real costs to wellbeing. The aim is a confident user with good defaults, not a supervised one.

The three rules worth memorising

Everything above compresses to three sentences that hold up under pressure. These are the ones to write on the sheet by the phone:

1. Nobody legitimate will ever ask for a code, a password, or remote access.
2. If someone is rushing you, that is the scam. Hang up and call back on a number you already have.
3. No emergency request for money is real without the family password.

If money has already gone

Speed determines the outcome.

1. Call the bank immediately and ask for the fraud team. Same-day reports can sometimes recall a transfer.
2. Report to the national fraud reporting body and get a reference number.
3. Secure the accounts — passwords, second factors, and check for changed recovery details or mail forwarding.
4. Remove any remote access software and have the machine checked.
5. Ask the bank about reimbursement. Rules on refunding authorised push payment fraud have tightened in several countries, and a bank's first answer is not always the final one. Escalate to the financial ombudsman or equivalent if refused.

And say clearly, more than once, that this was not their fault. These operations are run by organised, well-resourced groups who do this professionally against thousands of people. The embarrassment that follows is often more damaging than the financial loss, and it is the thing that stops people reporting — and stops them telling anyone next time.