8 practical steps you can take today to protect yourself and your family. No products to buy. No services to sign up for. Just smart, free precautions.
Adding an extra layer of security to your accounts can prevent scammers from getting in, even if they have your password.
Imagine your front door has one lock. A determined burglar might pick it. Now imagine it has two locks, and the second one changes every 30 seconds. That's essentially what two-factor authentication (2FA) does for your online accounts. After you enter your password, your bank or email provider sends a one-time code to your phone. You type in that code, and only then do you get access.
Why does this matter? Because passwords get stolen all the time — through data breaches, phishing emails, or even someone looking over your shoulder. But if a scammer has your password and doesn't have your phone, they still can't get in. That second code stops them cold.
Most banks, email providers, and social media sites offer 2FA. To turn it on, log into your account and look for "Security" or "Two-Factor Authentication" in the settings. The site will walk you through it — usually you just need to add your phone number. The whole process takes about 2 minutes per account.
Start with these three: Turn on 2FA for your email account first (this is the master key to everything else), then your bank, then your social media. Those three cover the most damage a scammer could do.
If you use the same password everywhere, one breach exposes everything.
Here's the problem: when a company gets hacked (and it happens constantly), the attackers get a list of email addresses and passwords. If you used that same password for your bank, your email, and your Amazon account, the attacker now has access to all three. This is the #1 way people get their accounts taken over — not through some sophisticated hack, but because they reused a password.
The solution is to use a different password for every account. But nobody can remember 50 different passwords, which is where a password manager comes in. Think of it as a secure digital notebook that remembers all your passwords for you. You only need to remember one master password — the password manager handles the rest. It can even generate strong, random passwords that are nearly impossible to crack.
If setting one up feels overwhelming, ask a tech-savvy family member, grandchild, or friend to help. It takes about 30 minutes to set up, and once it's running, it actually makes your life easier — no more "forgot password" headaches.
In the meantime: If you're not ready for a password manager yet, at the very least make sure your email password and your bank password are different from each other and different from everything else. Those two accounts are the most critical.
A credit freeze is one of the most powerful protections against identity theft, and it costs nothing.
A credit freeze prevents anyone — including scammers — from opening new credit cards, loans, or accounts in your name. When your credit is frozen, lenders can't pull your credit report, which means a scammer who has your Social Security number still can't open a credit card as you. It's like putting a padlock on your financial identity.
Important facts: freezing your credit is completely free (it's the law), it does not affect your credit score, and you can still use your existing credit cards and bank accounts normally. The only time you need to temporarily "thaw" it is when you're applying for new credit yourself — and that takes about 10 minutes.
You need to freeze your credit at all three major bureaus. Each one takes about 5 minutes online:
Do this for your parents too. If your parent is over 60 and not actively applying for new credit, there is almost no reason not to freeze their credit at all three bureaus. It takes 15 minutes total and could save them from catastrophic identity theft.
If a scammer uses your card, you want to know in seconds — not when you check your statement next month.
Most banks and credit card companies let you set up instant notifications that ping your phone every time your card is used. This means if someone charges $500 to your card at 2 AM, you know about it at 2 AM — not 30 days later when your statement arrives. Early detection is the difference between a quick phone call to your bank and months of fraud recovery.
Open your bank's app or website and look for "Notifications," "Alerts," or "Security Settings." Turn on alerts for all transactions, or at minimum for transactions above a certain amount (like $25 or $50). Most banks also let you set alerts for international transactions, online purchases, or when your balance drops below a certain level.
Help your parent set this up. Next time you're visiting, sit down with them for 5 minutes and turn on transaction alerts on their phone. Show them what the notification looks like so they know what to do if they see one they don't recognize — call the number on the back of the card (never the number in the alert).
This single trick defeats grandparent scams, AI voice cloning, and virtual kidnapping — all at once.
Pick a secret code word that only your immediate family knows. It should be something easy to remember but impossible to guess from social media — not your dog's name, not your street, not your anniversary. Something random, like "purple telescope" or "mango spaceship."
Here's how it works: if someone calls claiming to be a family member and says they're in an emergency — "I'm in jail, I need bail money" or "I've been in an accident, send money now" — the person who received the call asks: "What's our family code word?" A real family member will know it immediately. A scammer won't, no matter how convincing they sound.
This is especially important now that AI can clone a person's voice from just a few seconds of audio taken from social media. A scammer can literally sound like your grandson. But they can't know a code word that was never posted online.
Set this up today. Call your parents, siblings, and adult children. Pick a code word together. Make sure everyone remembers it. Tell them: "If anyone ever calls you in a panic asking for money, ask for the code word first. No code word, no money. No exceptions."
Most scams start with a phone call. Making a few changes to how you handle calls can block the majority of them.
The simplest rule: if you don't recognize the number, don't answer. Legitimate callers leave voicemails. Scammers almost never do — and if they do, you can listen to the voicemail and decide whether to call back using a number you look up yourself (never the number they left).
Both iPhones and Android phones have built-in features that automatically silence calls from unknown numbers. On iPhone, go to Settings, then Phone, then turn on "Silence Unknown Callers." On most Android phones, go to Settings, then Sound, then Caller ID and spam. Unknown callers will go straight to voicemail without your phone ever ringing.
You can also register your phone number at the National Do Not Call Registry at donotcall.gov. This won't stop scammers (they don't follow the law), but it will reduce legitimate telemarketing calls, which makes it easier to identify the scam calls that remain.
If you accidentally answer: Hang up immediately. Don't press any buttons — pressing "1 to be removed from our list" just confirms your number is active and leads to more scam calls. Don't engage, don't argue, don't say "yes" to anything. Just hang up.
One click on a fake link can compromise your entire digital life. Here's how to spot them.
The golden rule of email and text safety: never click a link in an unexpected message. If your "bank" texts you saying there's a problem with your account, don't click the link in the text. Instead, open your browser and type your bank's website address yourself, or call the number on the back of your card. This one habit will protect you from the vast majority of phishing attacks.
If you want to check whether a link is legitimate before clicking, you can preview it. On a computer, hover your mouse over the link without clicking — the real URL will appear at the bottom of your browser. On a phone, press and hold the link to see where it actually goes. If the URL looks strange, misspelled, or doesn't match the company that supposedly sent it, don't click.
Common red flags in phishing emails and texts: the message creates a false sense of urgency ("your account will be locked in 24 hours"), it uses threatening language ("legal action will be taken"), it contains misspellings or odd grammar, the sender's email address looks slightly off (like support@amaz0n-security.com instead of amazon.com), or it asks you to "verify" personal information.
Teach your parent this phrase: "When in doubt, don't click. Type it yourself." If they get a suspicious email from their bank, doctor, or the government, they should close the email and go directly to the website by typing the address into their browser. This simple habit blocks nearly every phishing scam.
The hardest part isn't the technology. It's having the conversation without making them feel patronized.
Nobody wants to feel like their children think they're losing it. When you bring up scam protection with your parents, the framing matters more than the information. Don't say "you need to be more careful" — say "these scammers are getting incredibly sophisticated, and I want to make sure we're both protected." Make it a "we" thing, not a "you" thing.
Some conversation starters that work: "Hey, I just set up a credit freeze for myself and I realized I should help you do it too." Or: "I heard about this new scam where they clone people's voices with AI — have you heard about that? Let's pick a family code word just in case." Or simply: "I read this article about scams targeting families, and I wanted to share it with you."
If your parent has already been scammed or come close, be especially gentle. Falling for a scam is not a sign of cognitive decline — it's a sign that a professional criminal did their job well. These people manipulate thousands of victims. Your parent is not stupid. They were targeted by someone whose full-time job is deception.
The most important thing you can say: "If you ever get a call or message that feels off, call me before you do anything. I will never judge you for asking. I would rather get 100 false alarm calls from you than miss the one that matters. You're not being paranoid. You're being smart."
Every week we break down the latest scam targeting your family and tell you exactly what to do about it.