Keeping Vulnerable Loved Ones (and Yourself) Safe from Fraud

“Have your parents been scammed yet?” Jim Dahle asked me, in a brief one-on-one conversation at the recent White Coat Investor Conference.

The implication, of course, is that it’s a matter of when it happens rather than whether it happens.

At the conference, three other attendees happened to share stories with me of their parents being scammed. (And, to be clear, I was not walking around polling people on this topic.)

And we recently discussed the stats from the FBI showing explosive growth in the rate at which people age 60+ are becoming victims of cybercrime.

Frankly, we have a situation on our hands.

Technology keeps moving. If anything, it’s speeding up. But as humans, at some point, we slow down. That’s just the nature of things.

That’s a major part of the context for this whole discussion of cybersecurity. It’s not just about how we can keep ourselves safe, it’s also about how we can keep our elders and less tech-savvy loved ones safe. And the combination of tech advancements (which older people are less likely to have kept up with) plus the possibility of some degree of cognitive decline makes for a challenging situation.

And to be clear, when I mention cognitive decline here, I’m not referring to full-blown dementia (although that obviously does dramatically increase the likelihood of being victimized). I’m talking about the more mundane but common situation in which a person is still capable of functioning normally in day-to-day activities, yet their ability to promptly detect a fishy situation — their “bullshit radar,” if you will — has started to become somewhat less sensitive.

What follows are important steps you can take to make yourself safer. And after implementing these policies for yourself, you can help your vulnerable loved ones implement them as well.

An important thing to note here is that if there are multiple people in the household, everything is only as secure as the weakest link. Each person should be following these policies.

Communication Policies

If you receive any inbound communication (whether email, text, or phone call) that purports to be from a company or government agency with which you have any sort of account:

• Do not reply.
• Do not give them any information whatsoever.
• Do not click on any links.

Essentially, don’t interact with inbound communications. If you need to interact with any organization with which you have an important account, make sure it is you reaching out to them, via a trusted means. That could be:

• Calling the number on the back of your credit/debit card.
• Typing the company’s URL directly into your browser.
• Visiting their website via a previously-saved browser bookmark (or navigating there via your password manager).
• Using an app on your phone (e.g., using the Bank of America mobile app, to contact Bank of America).

And the same thing goes for situations in which you’re contacted by (ostensibly) a loved one asking for money. Don’t engage with the inbound communication. Instead, reach out to the person in question via the contact information that you already have saved.

Credential Management Policies

To be clear, by far the largest risk for most individuals is getting tricked, rather than actually being hacked in some way. A major portion of cybercrime incidents are cases in which the victim:

1. Accidentally gives a thief their multi-factor authentication code (e.g., over the phone or by text) because they thought the thief was somebody else, or
2. Accidentally enters their login credentials on a fake website.

If you can eliminate those two possibilities, you have dramatically reduced the risk. Policies that work toward reducing or eliminating those possibilities include:

• Use passkeys when a website allows you to do so.
• Use security keys (i.e., YubiKey or similar) as the multi-factor authentication option when allowed to do so.
• Use a password manager (so that when a website forces you to use password-based login rather than a passkey, your password manager will not populate the password if you end up on the wrong website).
• Remove less-secure sign-in methods and account-recovery methods, to the extent you’re allowed to do so.

Essentially, you can’t get tricked into sharing the password with a malicious party if signing in with a password isn’t even an option (i.e., because the only sign-in option is to use a passkey). And you can’t get tricked into sharing the multi-factor authentication code with a malicious party if there is no such code (i.e., because the only accepted MFA option is a physical security key).

Other important policies regarding login credentials include:

• Use strong passwords for your various accounts. (Your password manager should have a tool for generating such.)
• Do not reuse passwords across different accounts.
• Use strong passcodes for mobile devices and tablets.
• Use an authenticator app as the multi-factor option (rather than SMS or email), if security keys are not an option and the website doesn’t allow passkeys.
• Activate SIM-swap protection with your mobile carrier.
• Use fake answers to “security” questions whenever an account asks you to set up such things (e.g., your third grade teacher’s last name was “i6c@vNShpJy$$9oV”), and store those answers in your password manager.

Other General Policies

Some of the other highest-impact security policies you can implement would be to:

• Freeze credit at all the major credit bureaus, and implement a security freeze with ChexSystems.
• Create an IRS Identity Protection PIN (and enroll to get a new one each year).
• Take advantage of any security features your brokerage firms offer such as money transfer lock at Fidelity or ACATS lock at Vanguard.
• Keep your operating system and apps up to date on all devices. (It’s unfortunate, but in many cases this will mean replacing devices at a point at which they’re still functional, in order to keep them on a current operating system.)

It’s Time to Upgrade Our Practices

To be clear, the policies mentioned in this article are not meant to be an exhaustive list. There are 100+ additional practices you could adopt, which would further improve your security. But the policies mentioned above are some of the highest-impact things you can do to keep yourself and/or your vulnerable loved ones safe. And if you implement all of the above, you (or your vulnerable loved one) will be a much harder target than most people.

Admittedly, for many people, this will mean learning to use some new tools (passkeys, security keys, password manager, authenticator app). But now’s the time. It’s not going to be any easier to start learning these things a few years from now.

And an important thing to note (and an important thing to mention, if you’re helping a loved one implement these practices) is that passkeys, security keys, and password managers all provide significant convenience benefits, relative to the alternatives. That is, in addition to being more secure:

• Logging in via passkey is generally more convenient than logging in via password + MFA code.
• Using a security key as the MFA method is generally more convenient than SMS, email, or authenticator app as the MFA method.
• Using a password manager is more convenient than trying to remember your passwords, record them on paper, or record them manually in some other electronic format.

The thieves have better tools available to them than they did just a handful of years ago. We have better tools available to us as well. But we have to actually use them. If your (or your loved one’s) security practices are no stronger than they were 10+ years ago, it’s time to upgrade those practices.