How to scam-proof your parents without insulting them

The phone rings at 11:40 at night. The voice is crying, and it says it's your grandson. He's been in a wreck, he's in a county jail two states over, the lawyer needs $9,000 for bond by morning, and please, please don't tell Mom.

Every part of that's engineered. The hour, so nobody's thinking straight. The tears, so the voice doesn't have to match. The secrecy, so nobody checks. The deadline, so there's no time to.

There's one rule that beats it, and it doesn't require your mother to become a cybersecurity analyst at 71.

Hang up. Call the person back on a number you already have.

Not the number that called. Not the number in the text. The number in her own contacts, or on the back of her own debit card, or on the paper bill. If the grandson answers his own phone from his own couch, the whole thing collapses in nine seconds.

That's the entire method. Everything below is just making it stick.

Teach the shape, not the story

If you teach your dad "watch out for the grandson-in-jail call," he'll be ready for exactly that call and blindsided by the Medicare card call, the Amazon refund call, and the pop-up that says his computer is infected.

Teach the shape instead. Nearly every one of these has the same three parts, and they're easy to name at the kitchen table:

• Urgency. It has to happen now. Today. Before the office closes.
• Secrecy. Don't tell your son. Don't tell the teller why you're withdrawing it. This is an active investigation.
• An unusual payment. Which is the biggest tell of them all.

When a caller asks for gift cards, a wire transfer, cryptocurrency, cash handed to a courier, or a payment app like Zelle or Cash App, the conversation is over. The IRS doesn't take Apple gift cards. Neither does Social Security, the electric company, the sheriff's office, or Publishers Clearing House. Those payment types get chosen for one reason: once they're gone, they're gone.

Say that out loud to your parents in one sentence and make them repeat it back. Nobody legitimate has ever needed a gift card.

The family password

Voice cloning is real, it's cheap, and it doesn't take much audio. A grandkid with a church solo on Facebook or a TikTok account has given away plenty. So the old reassurance — "I'd know his voice" — isn't the protection it used to be.

Fix it with something a machine can't guess. Pick a family password: a phrase nobody outside the family would say, and nothing that's ever been posted online. Not the dog's name. Not the street you grew up on. Not your mother's maiden name, which is a security question on half her accounts.

Something like "green canoe." Weird, memorable, and absent from the internet.

The rule: any emergency call asking for money requires the password. No password, no money, no exceptions, and it's not rude to ask. Write it on an index card and tape it inside a kitchen cabinet door, not on the fridge where a contractor can read it.

While you're at it, add the other verbal rule: never read a code out loud to anyone. Those six-digit texts are the keys to her email, her bank and her Facebook. Scammers ask for them by pretending to be the bank's fraud department, which is a beautiful piece of theater and works constantly.

The Saturday afternoon setup

Do this at their house, on their devices, with coffee. An hour, tops.

On the phone: turn on silence-unknown-callers (iPhone: Settings, Apps, Phone. Android: the Phone app's spam and call screen settings). Legitimate callers leave voicemail. Robocallers don't. Teach the habit of never pressing a key to "be removed from the list," because pressing a key confirms a live human.

On the computer: check for remote-access software they didn't install. AnyDesk, TeamViewer, LogMeIn, UltraViewer. A fake tech-support crew talks people into installing these, then watches the online banking session. If it's there and nobody can explain why, uninstall it.

Teach the pop-up truth: that full-screen red warning with the siren sound and a Microsoft logo is a web page. It's not a virus scan. It can't see anything. Close the browser, or hold the power button until the machine shuts off. Microsoft and Apple don't put a phone number on your screen.

Freeze the credit at Equifax, Experian and TransUnion. It's free by federal law, it takes about fifteen minutes total, and it stops somebody opening a card in their name. Save the PINs somewhere they'll actually find them.

Set up two-factor on email and banking, and make sure the recovery phone number is theirs and current, not an old landline.

The forwarded meme is the same problem in a different coat

Media literacy and scam defense are the same muscle. Both are about slowing down the sixty seconds between feeling something and acting on it.

A fake quote card is the cheapest content on the internet. A photo of a politician, a quotation in white text, no date, no place, no outlet. They're manufactured about Republicans and Democrats in roughly equal measure, and they spread fastest among people who already dislike the target.

Give your parents one question for those: when and where did he say it? A real quote has a date, a venue and a reporter. Type six words of it into a search bar with the person's name. If the only results are other memes, it's a meme.

Fake charity appeals follow every disaster within about a day, so add the second question: did I go find them, or did they find me? Giving is good. Giving to a text message that arrived during a hurricane is how the money ends up in Bucharest.

How to have the talk without starting a fight

Lead with yourself. "Dad, I almost got taken last week by a text about a package." Then the story. This reframes the whole conversation from you're getting old to these people are good at their job, which happens to be true.

Concede the point they're about to make, because it's correct: younger people get scammed constantly, often more often. The difference is that older Americans tend to have more in the account when it happens, so the losses are bigger. It's not a competence gap. It's a target-selection problem.

And make the ask small. You're not asking for control of their finances. You're asking for one phone call: "Before you move money because somebody told you to, call me first. Even at 2 a.m. Even if you think it's fine. Especially if they told you not to."

Give them a reason to say yes that protects their pride. "I'd rather be woken up for nothing than find out Tuesday."

If it already happened

Move fast and skip the lecture entirely. Shame is why people hide it for three weeks, and three weeks is how the money leaves the country.

Call the bank's fraud line on the back of the card, not a number from a search result. Change passwords from a different device. If gift cards were involved, call the card issuer immediately, since a fast call sometimes freezes the unspent balance. Report it at ReportFraud.ftc.gov and, for anything online, at IC3.gov. Ask local police for a report number, because banks often want one.

Then tell them the thing they need to hear more than the security advice: this was a crime committed against you, by professionals, and you're not the first sharp person they've fooled.

The whole business model lives in those sixty seconds between the ringing and the hanging up. Make sure your number is the one they think of first.