What to do if your elderly parent is being scammed — and how to keep it from happening again

If your elderly parent has paid a scammer, contact the bank or payment provider immediately and ask whether the payment can be stopped or reversed. Recovery is not guaranteed. The FTC sets out the steps for each payment method. Then secure compromised accounts and consider a free credit freeze with each of the three nationwide credit bureaus. A freeze helps prevent new credit accounts; it does not protect money in existing accounts or stop a payment your parent authorizes. Keep checking account activity, and make it safe for your parent to tell you what happened.

Here is the afternoon that taught me the order, and what each piece of it was for.

My mom got scammed — what do I do first?

The phone rang at four-ten on a Tuesday, and my mother opened with, "I think I've been hacked." Not hello. Just that.

Eight months earlier, a company Sophia buys hearing-aid batteries from had mailed her a letter. Their systems had been breached; her information was among the data taken; and here, with apologies, was a year of free credit monitoring. She signed up because the letter told her to, and she had not thought about it since.

That morning the monitoring service emailed her. Her phone number had been found on the dark web. That was the entire message. No account named, no dollar amount, no instruction beyond a button that said "view details," which she had not pressed, because she is seventy-nine and has been told, correctly, never to press buttons in emails.

So she called me. Does this mean all my accounts are compromised? And the true answer, the useless one, was no. A phone number on a list is close to nothing. It leaked eight months ago. It has been bought and sold a dozen times since. But I could not prove it was nothing. Not from my kitchen, an hour away, with no more visibility into her financial life than the alert had.

If you have ever spent forty minutes proving a negative to a frightened parent, you know this call. You are not investigating a crime. You are performing reassurance, badly, because a product that was sold to reassure her has produced terror on a Tuesday afternoon instead, and handed you the job of calming it down.

Now, that was an alert, not a scam. Nobody had taken anything. But the call is the same call, and the first move is the same, whether the money is gone or only threatened. The first move is not to figure out what happened. It is to make sure nothing else can.

If money has actually moved, the institution it moved from is the first phone call, before your mother has finished telling you the story. A bank or a brokerage can stop a payment, flag an account, or refuse a transfer still in motion, and every hour makes that less likely. Ask for the fraud line. Say the words out loud: my mother is being scammed, and I need this stopped. They have heard it before, and they have a procedure for it.

Then, and only then, you sit down and lock the doors. Because the scam that just happened is over. The one that comes next is the one you can still do something about.

Why does my elderly parent keep getting scammed?

Here is the thing I did not understand until that afternoon. The alert was not an investigation. It was a notification, and that difference is the whole story.

A monitoring service scans breach dumps and dark-web listings for strings you gave it: a phone number, an email address, a Social Security number. When one of your strings turns up, it tells you. It does not know whether the listing is new, whether anyone bought it, or whether a single one of your accounts has actually been touched. It cannot know. It is watching a sewer, not your house.

And the economics run one direction. A missed alert is a lawsuit; a needless alert costs the company nothing, and in fact proves the subscription is doing its job. So the system is built to over-notify, and the work of deciding whether any given alert matters lands on you, unpaid, at four-ten on a Tuesday.

That is also why the scams keep coming, and why a parent scammed once is more likely to be scammed again. It is not that she got dumber. It is that her information is on the list now, and the list is permanent. A stolen phone number does not expire. The people who buy those lists are not choosing your mother; they are dialing down a column, and her name is in the column, and it will be there in five years.

So the question is never how do I get her off the list. You can't. The question is how do I make the list useless. And the answer is what reframed the whole product for me: monitoring is a smoke detector, not a lock. It tells you after something may have happened. What you want is the door held shut in the first place, and that is a different tool with a different name.

The rest of that afternoon was about the locks.

How to keep elderly parents from getting scammed

This was not a rescue. It was an afternoon at a kitchen table with a laptop and a legal pad, working from the most valuable move to the least, and most of it was tedious. These measures reduce risk; they still need attention as accounts, services and circumstances change.

The freeze came first. Equifax, Experian, and TransUnion each keep a file on my mother, and each freeze is separate and free by law. A credit freeze restricts access to the credit report and helps stop new credit accounts. It remains until lifted. It does not touch the accounts she already has; her cards kept working. I did each one on the bureau's own website, typed in myself, never through a link in a search result, because the lookalike domains are their own industry. She needed her Social, her date of birth, and her address history, and then she had to answer knowledge questions about old mortgages and car loans, which is exactly where it failed, because she does not remember a 1998 auto lender and neither do I. One bureau went on paper: a written request, a copy of her ID, a utility bill. Slower. It cannot fail an identity quiz. Budget an hour for all three and expect at least one to go by mail.

Then the PINs, saved where we would both find them. A freeze you cannot lift is its own emergency the week she needs a hearing-aid loan. Whatever each bureau handed back, a login or a code, went into the password manager she can actually reach, and one other trusted person besides me knows where that is. Not a sticky note on the monitor. And not only in my phone, because then I would have quietly made myself the single point of failure.

Then the two bureaus nobody mentions. Innovis works like the big three and took five more minutes. NCTUE is the exchange that utility companies and cell carriers check before they open service. If someone tries to start electricity or a phone line in my mother's name, that is the file they pull, and the big-three freezes do not stop it. Frozen too.

Then the alerts, where the money actually is. Every bank and brokerage will notify her, by text or email, on transactions over an amount you choose, on a new payee, and on a change to the address or phone number on the account. I set the dollar threshold low enough to matter, a hundred dollars, not a thousand. And I cared most about the address-and-phone-change alerts, because changing those is the first move in a real account takeover. This is signal, unlike the dark-web notice that started the day.

Then a spoken password on the phone account. Most carriers will let you set a passcode that must be given before anyone can change the account over the phone. It is the cheapest defense against a SIM swap, the trick where a stranger convinces the carrier to move your mother's phone number onto their own phone, which then lets them catch the security codes that protect everything else. Ten minutes, on hold mostly.

Then the email, before trusting any of it. Her old address was the recovery address for the bank, the inbox a company emails when someone says they have forgotten the password, which meant the whole perimeter ran through a twenty-year-old account. It got a strong, unique password and a second step on the login, so a stolen password alone is not enough to get in. While I was in there I confirmed the recovery phone number on file was one she still owns. If it had been a carrier she left in 2011, she could not get back in, and someone else might.

Then the government logins, claimed before a stranger could. Anyone can create a my Social Security account using your mother's identity if she has not already. Claiming it first closes that door. The same logic applies to an IRS Identity Protection PIN, a number the IRS issues that has to be on any tax return filed in her name, which quietly kills the most common refund-fraud scheme.

Then one door left open, on purpose. She lives an hour away, and I did not want to drive over for every password reset, so we set up a way for me to see her screen from my house. It is the one place in the whole afternoon where you deliberately open a door instead of locking one, and it comes with a single rule that is not negotiable: nobody uses it but me, ever, no matter who calls or what they claim, because remote access is precisely the scammer's favorite move. The tools change names year to year, so I will not name one here; ask, and verify, before you install anything.

Then the surface, made smaller. We opted out of pre-screened credit offers, five minutes for five years; fewer live offers in the mailbox means fewer for a stranger to steal out of it. The landline went on the Do Not Call registry, knowing it stops the legitimate callers and not the criminals, which at least makes the calls that keep coming easier to recognize.

Then one page, written down. What is frozen, where the PINs live, which alerts are on and where they go. Otherwise I would do this whole afternoon over from scratch in two years, or my sister would, not knowing I already had.

That was the list. The freezes are free and remain until lifted. The alerts still come, and unfamiliar transactions or account changes still need checking.

How to stop an elderly parent from giving money away

This is the heading people type when the scam is not a stranger on a list but a voice on the phone that she trusts, and the money is going out the door with her consent. A grandchild in trouble. A man she met online. A government office that needs gift cards. I am not going to pretend the locks above solve that, because they do not. A freeze stops a stranger opening an account in her name. It does not stop her wiring her own savings to someone she believes.

What helps there is the same thing that helped at the kitchen table, and it is not a tool. It is that she calls you first.

Here is what I got wrong before I got it right. My first instinct, when she told me about the alert, was to explain: what a breach is, what a list is, why a phone number is nothing. Three sentences in I heard her go quiet on the line, and I understood that I was not reassuring her. I was telling her she had panicked over nothing, which is a different message, and the one she would remember.

So I stopped, and I said the true thing instead: you did exactly the right thing. You didn't press the button. You called me. And then I said we would shut the doors together so that the next time one of these came, she would not have to wonder.

That is the whole defense against the scam that arrives with her consent. Not a lecture about gift cards. A parent who has been told, every time, that the call to you was the right call, and who will therefore make it again, before the money goes and not after. The scammer's entire method is to get her alone with the decision. Your entire method is to make sure she is never alone with it. The shame is what isolates her, and the shame is the one thing you control.

What to say when it's her money and her phone

Nobody warns you about this part. My mother was not a bystander that afternoon. It was her Social we were typing, her accounts, her phone. And there is a way of doing it, efficient and fast, that turns her into the subject of the work instead of a person in the room.

I did it that way for the first half hour. Typing, muttering, asking for a date of birth without looking up. At some point she said, quietly, "Do you need me for this?" and I realized I had been treating her like a folder.

What worked, once I noticed, was narrating. "Mom, this one freezes your credit so nobody can open a card in your name. It doesn't touch your accounts. Your cards still work." Out loud, each step, before I did it. It cost a few minutes. It gave her the afternoon back. By the end she was reading the confirmation numbers off the screen and writing them on the pad in her own hand, which is where they belonged all along.

It is her money. The system just forgot. Everything you do at that table should remind it, and remind her.

What it cost

I want to be exact about the cost, because the cost is the argument.

The alert itself cost forty minutes of proving a negative, and it would have cost forty minutes again the next time, and the time after that, indefinitely, because the alerts do not stop. That is what the product does. It generates Tuesday afternoons.

The locks cost one afternoon. Roughly three hours at the table, plus one letter in the mail and a few days waiting for a bureau to answer it. No money. Nothing to renew. When the next alert came, three weeks later, a different string on a different list, the call lasted about a minute, because she knew the doors were shut and so did I.

Somewhere in those first forty minutes I had noticed what the call was supposed to be. It was a Tuesday. She had nothing scheduled. She might have told me again about the summer the family drove to the shore with a mattress tied to the roof of the car, the story I have heard forty times and will not, one day, get to hear again. Instead I was an operations manager: unpaid, unbriefed, on call. The alert did not create that job. It just filed another ticket.

The afternoon at the table reduces the risk. It does not end the need to check what happens next. That is the return. Not the money you keep. The Tuesdays you get back.

The landing

None of this makes the alerts stop coming, and none of it makes the phone stop ringing with strangers who know her name. The next one will still land on a Tuesday, and it will still be mostly noise. The difference is that now the doors are shut behind it, and you are the one who shut them, and she knows it.

That was the afternoon's work. It is why the next call can be the one you actually wanted: not triage, just her, telling you about the drive to the shore one more time.

If you are reading this because the money is already gone, the order still holds. Stop the next dollar. Shut the doors. Then sit with her and say the true thing: she was targeted by an industry, not fooled by her own foolishness, and the call she made to you was the right one. Say it until she believes it, because the next call depends on it. And when a bank, a brokerage and a government office each say no to you differently along the way, the post before this one is about why.

Sources and further help

• Federal Trade Commission: what to do if you were scammed
• Federal Trade Commission: credit freezes and fraud alerts
• Federal Trade Commission: existing accounts still need monitoring

Source links checked September 20, 2026. This article offers general information; the linked authorities explain the rules and guidance in more detail.

This is the idea at the center of one chapter of Managing Mom's Money With Love, the second Tempered Press book, out now on Amazon. The first, When the Keys Go, is at the typesetter. One email when a book ships. Nothing between.

← All posts