Archives for May 2026

A Planet Money podcast episode last week directed me to a paper released earlier this year: Dementia and Long-run Trajectories in Household Finances. The authors explain their findings in pretty plain English, so I’m just going to quote their work:

“Our results point to impaired financial decision-making beginning about six years prior to clinically recognizable dementia.”

“A growing body of work links cognitive ability to financial outcomes such as portfolio allocation, credit use, and susceptibility to fraud. […] Most recently, Mazzonna and Peracchi (2024) show that older adults are often unaware of their own cognitive decline, and that such misperception can lead to persistent financial mistakes. We extend this literature by showing that the economic consequences of cognitive decline appear well before the onset of dementia symptoms (or clinical diagnosis) and manifest in sustained losses in household wealth.”

“Our findings underscore that dementia-related financial risk should be viewed as a universal and forward-looking household risk, not just a concern for those who are already symptomatic or diagnosed. Because financial mistakes often appear before individuals or families become aware of any cognitive decline, relying solely on diagnosis or subjective awareness is unlikely to be sufficient. Safeguards that can be implemented well in advance—such as designating trusted financial contacts, simplifying financial arrangements, or allocating part of retirement wealth to products with guaranteed payouts—may help reduce exposure to losses from impaired financial decision-making.”

Their findings are exactly in line with the stories I keep hearing stories from readers: situations in which, conversationally, Mom/Dad/Uncle Steve still seems fine. No obvious red flags. And yet, they’re making financial decisions that make no sense or falling victim to scams that they would not have fallen for just a few years ago.

Of course, dementia (or other significant cognitive decline) does not happen to everybody. But we don’t know in advance to whom it will happen. And waiting until there are obvious personality-related symptoms before putting protective financial policies in place doesn’t work very well, because the financial problems often come first.

I think the authors suggestions are excellent: simplified portfolios (and simplified finances in general), designated trusted financial contacts (to allow the financial institutions to share information with that contact), options for guaranteed income (most notably: delaying Social Security). And I’ll add: adopting security practices that are resistant to scams/phishing (i.e., passkeys and security keys).

A key point here is that all of the above suggestions are generally good ideas regardless of the possibility of cognitive decline.

• Dementia and Long-run Trajectories in Household Finances from Jing Li, Kathleen M. McGarry, Lauren Hersch Nicholas, and Jonathan S. Skinner
• How Your Bank Account Might Predict Dementia (The Indicator from Planet Money podcast episode)

Other Recommended Reading

• Why an Ohio Retiree Capped Her Net Worth and Spent Down the Excess from Sarah Leeson (very brief Marketplace podcast segment)
• Buying at Tops or Bottoms from Ben Carlson
• An All-Time Bull Market from Ben Carlson
• Trusted Help from a Daily Money Manager from Rick Kahler
• If America’s So Rich, How’d It Get So Sad? from Derek Thompson
• You Just Retired (or Are About to). Now What? from Christine Benz
• 10 Tricks of Financial Predators from Allan Roth

Thanks for reading!

“Have your parents been scammed yet?” Jim Dahle asked me, in a brief one-on-one conversation at the recent White Coat Investor Conference.

The implication, of course, is that it’s a matter of when it happens rather than whether it happens.

At the conference, three other attendees happened to share stories with me of their parents being scammed. (And, to be clear, I was not walking around polling people on this topic.)

And we recently discussed the stats from the FBI showing explosive growth in the rate at which people age 60+ are becoming victims of cybercrime.

Frankly, we have a situation on our hands.

Technology keeps moving. If anything, it’s speeding up. But as humans, at some point, we slow down. That’s just the nature of things.

That’s a major part of the context for this whole discussion of cybersecurity. It’s not just about how we can keep ourselves safe, it’s also about how we can keep our elders and less tech-savvy loved ones safe. And the combination of tech advancements (which older people are less likely to have kept up with) plus the possibility of some degree of cognitive decline makes for a challenging situation.

And to be clear, when I mention cognitive decline here, I’m not referring to full-blown dementia (although that obviously does dramatically increase the likelihood of being victimized). I’m talking about the more mundane but common situation in which a person is still capable of functioning normally in day-to-day activities, yet their ability to promptly detect a fishy situation — their “bullshit radar,” if you will — has started to become somewhat less sensitive.

What follows are important steps you can take to make yourself safer. And after implementing these policies for yourself, you can help your vulnerable loved ones implement them as well.

An important thing to note here is that if there are multiple people in the household, everything is only as secure as the weakest link. Each person should be following these policies.

Communication Policies

If you receive any inbound communication (whether email, text, or phone call) that purports to be from a company or government agency with which you have any sort of account:

• Do not reply.
• Do not give them any information whatsoever.
• Do not click on any links.

Essentially, don’t interact with inbound communications. If you need to interact with any organization with which you have an important account, make sure it is you reaching out to them, via a trusted means. That could be:

• Calling the number on the back of your credit/debit card.
• Typing the company’s URL directly into your browser.
• Visiting their website via a previously-saved browser bookmark (or navigating there via your password manager).
• Using an app on your phone (e.g., using the Bank of America mobile app, to contact Bank of America).

And the same thing goes for situations in which you’re contacted by (ostensibly) a loved one asking for money. Don’t engage with the inbound communication. Instead, reach out to the person in question via the contact information that you already have saved.

Credential Management Policies

To be clear, by far the largest risk for most individuals is getting tricked, rather than actually being hacked in some way. A major portion of cybercrime incidents are cases in which the victim:

1. Accidentally gives a thief their multi-factor authentication code (e.g., over the phone or by text) because they thought the thief was somebody else, or
2. Accidentally enters their login credentials on a fake website.

If you can eliminate those two possibilities, you have dramatically reduced the risk. Policies that work toward reducing or eliminating those possibilities include:

• Use passkeys when a website allows you to do so.
• Use security keys (i.e., YubiKey or similar) as the multi-factor authentication option when allowed to do so.
• Use a password manager (so that when a website forces you to use password-based login rather than a passkey, your password manager will not populate the password if you end up on the wrong website).
• Remove less-secure sign-in methods and account-recovery methods, to the extent you’re allowed to do so.

Essentially, you can’t get tricked into sharing the password with a malicious party if signing in with a password isn’t even an option (i.e., because the only sign-in option is to use a passkey). And you can’t get tricked into sharing the multi-factor authentication code with a malicious party if there is no such code (i.e., because the only accepted MFA option is a physical security key).

Other important policies regarding login credentials include:

• Use strong passwords for your various accounts. (Your password manager should have a tool for generating such.)
• Do not reuse passwords across different accounts.
• Use strong passcodes for mobile devices and tablets.
• Use an authenticator app as the multi-factor option (rather than SMS or email), if security keys are not an option and the website doesn’t allow passkeys.
• Activate SIM-swap protection with your mobile carrier.
• Use fake answers to “security” questions whenever an account asks you to set up such things (e.g., your third grade teacher’s last name was “i6c@vNShpJy$$9oV”), and store those answers in your password manager.

Other General Policies

Some of the other highest-impact security policies you can implement would be to:

• Freeze credit at all the major credit bureaus, and implement a security freeze with ChexSystems.
• Create an IRS Identity Protection PIN (and enroll to get a new one each year).
• Take advantage of any security features your brokerage firms offer such as money transfer lock at Fidelity or ACATS lock at Vanguard.
• Keep your operating system and apps up to date on all devices. (It’s unfortunate, but in many cases this will mean replacing devices at a point at which they’re still functional, in order to keep them on a current operating system.)

It’s Time to Upgrade Our Practices

To be clear, the policies mentioned in this article are not meant to be an exhaustive list. There are 100+ additional practices you could adopt, which would further improve your security. But the policies mentioned above are some of the highest-impact things you can do to keep yourself and/or your vulnerable loved ones safe. And if you implement all of the above, you (or your vulnerable loved one) will be a much harder target than most people.

Admittedly, for many people, this will mean learning to use some new tools (passkeys, security keys, password manager, authenticator app). But now’s the time. It’s not going to be any easier to start learning these things a few years from now.

And an important thing to note (and an important thing to mention, if you’re helping a loved one implement these practices) is that passkeys, security keys, and password managers all provide significant convenience benefits, relative to the alternatives. That is, in addition to being more secure:

• Logging in via passkey is generally more convenient than logging in via password + MFA code.
• Using a security key as the MFA method is generally more convenient than SMS, email, or authenticator app as the MFA method.
• Using a password manager is more convenient than trying to remember your passwords, record them on paper, or record them manually in some other electronic format.

The thieves have better tools available to them than they did just a handful of years ago. We have better tools available to us as well. But we have to actually use them. If your (or your loved one’s) security practices are no stronger than they were 10+ years ago, it’s time to upgrade those practices.