Online Safety for Seniors

Understanding Phishing: How Scammers Impersonate Banks and Trusted Companies

Phishing emails are messages designed to trick you into revealing sensitive information by pretending to come from a legitimate organization. The term "phishing" comes from the idea of casting a wide net hoping to catch victims, similar to fishing. Scammers create fake emails that look nearly identical to real messages from your bank, PayPal, Amazon, or other trusted companies you may use. These emails often contain logos, colors, and formatting that match the real organization so closely that spotting the difference requires careful attention.

Free Guide to Removing Lawn Mushrooms →

The goal of a phishing email is straightforward: convince you to click a malicious link or open an infected attachment, or provide information you normally would never share. Once a scammer has your password, they can access your account and steal money, personal information, or use your identity to commit fraud. According to the FBI's Internet Crime Complaint Center, phishing and related schemes resulted in losses exceeding $84 million in 2022, with seniors accounting for a significant portion of victims.

Common phishing scenarios include fake emails claiming your bank account has been compromised and asking you to "verify your information," messages stating that your payment method has expired, or notices claiming unusual activity on your account. The email typically includes urgent language suggesting you need to act right away. These messages often contain a button or link labeled "Confirm Your Details," "Update Payment Method," or "Review Account Activity." When you click the link, it takes you to a fake website that looks legitimate but is actually controlled by criminals.

One real-world example involved seniors receiving emails appearing to come from their credit card company. The email showed the company's actual logo and stated that three unauthorized transactions had been detected. It instructed recipients to click a link to "verify recent purchases." The link led to a fake website asking for the full credit card number, expiration date, security code, and even the cardholder's mother's maiden name. Dozens of seniors fell victim before the scam was discovered.

Another common variation involves emails pretending to be from the IRS or Social Security Administration. These messages claim there is a problem with your taxes or your benefits, and you must contact the agency or click a link immediately. Government agencies typically do not contact people via email about account problems. They communicate official matters through mail or ask you to contact them directly through their official phone numbers.

Practical takeaway: Before clicking any link in an email, pause and check the sender's email address carefully. Hover your mouse over links (without clicking) to see where they actually go. When in doubt, close the email and contact the company directly by phone using a number from your bank statement, credit card, or official website—not from the email itself.

Password Security: Creating Defenses Against Account Takeover

A strong password is one of your primary defenses against unauthorized access to your accounts. Many people use passwords that are easy to remember but also easy for criminals to guess, such as birthdates, names of family members, or simple sequences like "123456" or "password." According to data from password management company NordPass, "password" and "123456" remain among the most commonly used passwords worldwide, which means they are also the first combinations criminals try when attempting to break into accounts.

Free Guide to Preparing Fresh Green Beans →

A secure password should be at least 12 to 16 characters long and contain a combination of uppercase letters, lowercase letters, numbers, and special characters (such as !, @, #, $, or &). For example, "BlueMoon!2024Tree9" is stronger than "BlueMoon2024" because it combines different types of characters and is longer. The length of a password matters significantly because it makes it exponentially harder for criminals to use automated programs that guess millions of combinations per second. A 12-character password with mixed characters would take many years for such programs to crack, whereas a simple 6-character password could be broken in hours.

Creating unique passwords for each account is equally important. If you use the same password across multiple websites and one site is breached, criminals will try that same password on your email, bank, and other accounts. Breaches happen frequently—in 2023, thousands of data breaches affected millions of people's information. When criminals obtain login credentials from one breach, they conduct what is called "credential stuffing," automatically testing those usernames and passwords on other popular websites.

Password managers are tools that can store and organize your passwords securely. Programs like Bitwarden, 1Password, or LastPass encrypt your passwords so that only you can access them. You remember one strong master password, and the password manager remembers all the others. This approach allows you to use long, complex, unique passwords for each account without the burden of memorizing dozens of different combinations. Many password managers also include a feature to generate random strong passwords for new accounts.

Beyond passwords, consider enabling two-factor authentication (also called 2FA or multi-factor authentication) on important accounts whenever available. Two-factor authentication requires two separate methods to prove your identity. For example, after entering your password, you might receive a code via text message or email that you must enter before access is granted. Even if someone steals your password, they cannot access your account without this second factor. Major email providers, banks, and social media platforms offer this protection.

Watch for warning signs that someone may be accessing your accounts without permission. These include unfamiliar transactions on your bank or credit card statements, emails confirming logins from devices or locations you do not recognize, or notifications that your password was recently changed when you did not make that change. If you notice suspicious activity, contact your bank or the relevant company immediately to secure your account and dispute unauthorized charges.

Practical takeaway: Write down a master password for your password manager in a safe location (like a locked drawer), and use that manager to generate and store unique, complex passwords for each account. Enable two-factor authentication on email, banking, and social media accounts. Check your bank and credit card statements monthly for unfamiliar charges.

Recognizing Social Media Scams, Tech Support Fraud, and Romance Schemes

Social media platforms like Facebook, Instagram, and YouTube are popular targets for scammers because they provide opportunities to reach many people and build trust through seemingly personal interactions. One widespread social media scam involves fake investment or business opportunities. Scammers create profiles or pages claiming to offer ways to make money through minimal effort—such as "earn $500 per day from home" or "guaranteed returns on cryptocurrency investments." When someone expresses interest, the scammer explains a supposed "opportunity" and encourages them to send money as an initial investment or fee. Once money is sent, the victim never hears from the scammer again.

How to Build Projects Successfully Free Guide →

Another social media variation involves impersonating someone you know. A scammer may hack into a friend's Facebook account or create a new profile using stolen photos. They then contact you with a story about needing urgent financial help—a medical emergency, being stranded abroad, legal troubles, or a business crisis. The fake friend claims they cannot access their bank account and asks you to send money immediately. Because the message appears to come from someone you trust, many people send money without verifying with their friend through another method first.

Tech support scams have become increasingly sophisticated and particularly affect older adults. These typically begin with a pop-up window appearing on your computer while you are browsing the internet, or an unexpected call to your home phone. The pop-up might display an official-looking Microsoft logo and claim "Warning: Your computer is infected with viruses" or "Your device has been compromised." It provides a phone number to call for support. The incoming call might claim to be from Apple, Microsoft, or your internet provider, stating that suspicious activity has been detected on your device.

When you call the number or speak with the caller, a supposed "tech support specialist" walks you through steps to "diagnose" your computer. They may ask you to press certain keys or open programs that give the appearance of computer problems. They then convince you that your device is severely compromised and that you must pay for specialized software or remote access support to fix it. During this process, they often attempt to obtain payment information. In some cases, they request remote access to your computer, which gives them the ability to see your passwords, bank information, and personal files. According to the FTC, Americans reported losing nearly $1 billion to tech support scams in 2022.

Romance scams target people seeking companionship by creating fake profiles on dating websites and social media. A scammer develops a seemingly genuine relationship with you online, often escalating emotional connection quickly through flattering messages and attention. After weeks or months of building trust, the scammer introduces a financial need—they claim to be traveling and need money for