Learn About Senior Digital Safety Online

Understanding Common Scams That Target Older Adults

Scammers have become increasingly skilled at targeting older adults through various schemes designed to steal money or personal information. According to the FBI's Internet Crime Complaint Center, seniors aged 60 and older lose billions of dollars annually to fraud. Understanding the tactics these criminals use is a critical part of protecting yourself online.

One of the most widespread schemes is the "grandparent scam." In this fraud, someone calls or texts claiming to be a grandchild in urgent need of money for bail, medical bills, or travel expenses. The scammer creates a sense of panic, asking the senior not to tell other family members about the situation. The key warning sign is the urgency combined with a request for immediate payment through wire transfer, gift cards, or cryptocurrency. Real grandchildren typically have multiple ways to reach family members and would not pressure you to keep financial problems secret.

Tech support scams represent another major threat. These typically begin with a pop-up window on your computer or a phone call claiming your device has a virus or security problem. The person on the other end pressures you to call a number or grant them remote access to your computer to "fix" the issue. Once they access your device, they may install malware, steal banking information, or convince you to pay for unnecessary services. Legitimate companies like Microsoft or Apple will not call you unsolicited about device problems.

Romance scams specifically target older adults seeking companionship. A scammer creates a fake profile on a dating website or social media platform, builds a relationship over weeks or months, and eventually asks for money due to supposed emergencies, travel costs, or business problems. These relationships feel real to the victim because the scammer invests significant time in building trust. Red flags include anyone who quickly declares love, refuses to video chat, or eventually asks for money.

Healthcare-related fraud has grown substantially. Scammers may claim to represent Medicare, a health insurance company, or a pharmaceutical provider, requesting personal or financial information to "update your records" or "process a refund." They may also send fake invoices for medical services you never received. Legitimate healthcare organizations do not request sensitive information through unsolicited phone calls or emails.

Prize and lottery scams inform victims that they have won a contest they never entered. To claim their winnings, they must pay taxes or fees upfront. This is a guaranteed indicator of fraud—legitimate contests do not require payment to collect prizes. Similarly, work-from-home scams promise easy money for minimal effort, typically requiring an upfront investment or personal banking details.

Practical Takeaway: When you receive an unexpected request for money, especially one accompanied by pressure or secrecy, pause and verify the story independently. Call the organization directly using a phone number from their official website or statement, not a number provided by the caller. Discuss suspicious contacts with trusted family members or friends before taking any action.

Creating Strong Passwords and Protecting Your Login Information

Your passwords serve as the front-line defense protecting your personal information, financial accounts, and communication tools from unauthorized access. Creating passwords that are difficult to guess while remaining manageable for you to remember is essential to your digital security. The challenge lies in balancing strength with practicality.

A strong password typically contains at least 12 characters and uses a mix of uppercase letters, lowercase letters, numbers, and special characters like exclamation marks or dollar signs. For example, "BlueSky$Mountain92!" is stronger than "password123" because it combines different types of characters and does not rely on dictionary words or sequential numbers that scammers commonly try. Avoid using information that can be easily discovered about you, such as birthdates, addresses, pet names, or anniversary dates. Scammers can find this information through social media or public records.

One effective approach to creating memorable strong passwords involves thinking of a sentence and using the first letter of each word combined with numbers and symbols. For instance, from the sentence "I planted three roses in my garden on June fifth," you might create "IPtriMGoJ5!" This method helps you remember complex passwords without writing them down.

The practice of reusing the same password across multiple websites presents a serious vulnerability. If scammers breach one website and obtain your password, they can use that same password to access your email, banking, and social media accounts. Each important account—particularly email, banking, and healthcare accounts—deserves its own unique password. For less critical accounts, you might use variations of a base password with slight modifications specific to each site.

Managing multiple passwords can feel overwhelming, which is why many security experts recommend using a password manager. These are software programs or services that securely store your passwords behind one strong master password. Examples include Bitwarden, 1Password, and LastPass. A password manager automatically fills in your login information when you visit websites, reducing the need to remember every password. Many password managers also have a feature to generate random strong passwords for new accounts.

When creating passwords for sensitive accounts like banking, email, or healthcare portals, consider enabling two-factor authentication if the website offers it. Two-factor authentication requires a second form of verification beyond your password—typically a code sent to your phone or generated by an authentication app. Even if someone obtains your password, they cannot access your account without this second verification step.

It is important to store passwords securely if you choose to write them down. A locked safe or password-protected notebook kept in a secure location is acceptable, though a digital password manager is preferable. Never store passwords on sticky notes left near your computer or in an unencrypted document on your device. Additionally, never share your passwords with family members, even those you trust. If you need to share access to an account, most services allow you to change the password afterward, or you can provide the person temporary access through their account settings.

Practical Takeaway: Change your passwords every few months, and immediately change any password for an account where you suspect suspicious activity. When you create a new password, write it down in a secure location until you have memorized it, then destroy the written version. Consider setting a calendar reminder quarterly to update your passwords for your most important accounts.

Recognizing Phishing Attempts and Fraudulent Websites

Phishing is a technique scammers use to trick you into revealing personal or financial information by impersonating trusted organizations. Unlike random spam, phishing messages are carefully crafted to look legitimate and often reference real companies or services you use. Learning to spot the subtle signs of phishing can prevent you from inadvertently handing over sensitive information to criminals.

A typical phishing email claims there is a problem with your account that requires immediate attention. You might receive a message appearing to come from your bank stating that your account has been compromised or that you need to verify your information. The email includes a link that looks official, perhaps even using the bank's actual logo and color scheme. When you click the link, you land on a website that looks nearly identical to your bank's real website. You enter your username, password, and perhaps additional security information, which the scammers now possess.

Several specific features can help you identify phishing attempts. Examine the sender's email address carefully. Legitimate companies use official domain names in their email addresses. If an email claims to be from Wells Fargo but the sender's address is "wellsfargo.support@freemail.com," this is a red flag. The domain name after the @ symbol should match the official company website. Similarly, hover your mouse over any links in the email without clicking them. Look at the bottom left of your screen to see where the link actually leads. If the link text says "Click here to verify your account" but the actual address shown is something like "scammers.fake.com," do not click it.

Phishing emails often contain grammatical errors or unusual phrasing. Large companies employ professional writers and editors, so emails with typos, awkward sentences, or strange formatting are likely fraudulent. Additionally, legitimate companies rarely ask you to confirm passwords, Social Security numbers, or full credit card numbers via email. Banks and healthcare providers know these pieces of information already and will never ask you to provide them through email links.

Scammers frequently create urgency in phishing messages. You might receive an email stating that your account will be closed within 24 hours unless you act, or that unauthorized activity has been detected and you must verify your information right now. This artificial pressure is designed to bypass your careful thinking. Legitimate financial institutions may contact you about serious issues, but they typically do so through multiple channels and allow you reasonable time to respond.

Fraudulent websites pose a similar challenge. A scammer's website might look nearly identical to the