Parent Fell for a Phishing Scam — What to Do Right Now

The First 60 Minutes Matter Most

If your parent just told you they clicked a suspicious link, gave their bank details to someone over the phone, or sent money to a person they met online — the clock is running. Every hour you wait, the scammer has more time to drain accounts, open credit lines, and cover their tracks. Here's the triage sequence, in order.

Step 1: Disconnect the compromised device from the internet. Turn off Wi-Fi and mobile data on whatever phone, tablet, or computer your parent used during the scam interaction. If they gave a scammer remote access to their device (via AnyDesk, TeamViewer, or a screen-sharing link), powering the device off entirely is even better. This stops any active remote session immediately.

Step 2: Call the bank. If your parent shared any financial information — account numbers, card numbers, online banking credentials, or authorized a transfer — call the bank's fraud line directly (the number on the back of the card, not a number the scammer provided). Report the compromise, freeze the affected accounts, and request new cards. Ask specifically whether any wire transfers or Zelle/Venmo payments were initiated, since those may be reversible within a short window.

Step 3: Change passwords on every account that shares the compromised credentials. If your parent used the same password for their email and their bank (common among seniors), both are compromised. Start with the email account — scammers who control email can intercept password reset links for everything else. Change the email password from a different, uncompromised device.

Step 4: Place fraud alerts and credit freezes. Call any one of the three credit bureaus (Equifax at 1-888-766-0008, Experian at 1-888-397-3742, or TransUnion at 1-800-680-7289) to place an initial fraud alert — that bureau is required to notify the other two. Then place full credit freezes at all three bureaus separately. This blocks the scammer from opening new accounts using your parent's stolen identity.

If Your Parent Sent Money

The recovery path depends entirely on how the money was sent.

Credit card: Call the card issuer and dispute the charge. The Truth in Lending Act (Regulation Z) limits your parent's liability for unauthorized credit-card charges to $50, and most issuers waive even that.

Debit card or bank transfer: Contact the bank immediately. Regulation E caps apply to unauthorized electronic transfers — when someone else used the card or account without permission. If reported within two business days of learning of the theft, liability is capped at $50; after that, it climbs to $500; and after 60 days from the statement that showed the transfer, liability can be unlimited. If your parent themselves sent the money (even under deception), those caps generally do not apply — still call the bank immediately and ask them to attempt a recall. Wire transfers have no automatic consumer protection, but banks can sometimes recall wires within the first 24 hours.

Gift cards, cryptocurrency, or wire services (Western Union, MoneyGram): These are the scammer's preferred payment methods because they're nearly impossible to reverse. File a report with the FTC at reportfraud.ftc.gov and contact the gift card company (some have dedicated fraud lines), but recovery is unlikely. Document everything for law enforcement.

Zelle, Venmo, CashApp: These platforms are slowly adding fraud protections, but authorized transactions (where your parent willingly sent money, even under deception) remain difficult to reverse. Contact the platform's fraud team and the linked bank.

Romance Scams Require a Different Conversation

Romance scams are uniquely devastating because the victim often doesn't believe they've been scammed. Your parent has built an emotional relationship over weeks or months with someone who made them feel valued and needed. Telling them "you've been conned" triggers shame, defensiveness, and denial — and often drives them to send more money to "prove" the relationship is real.

If you suspect a romance scam is ongoing, the priority is stopping the financial bleeding without destroying your relationship with your parent. Focus on the money, not the person: "I'm worried about these transfers — can we pause them while we verify a few things?" is more effective than "This person is a scammer." Contact your parent's bank to add transfer limits or require dual authorization for large transactions.

AARP's fraud helpline (1-877-908-3360) provides free, confidential support for scam victims and their families, including trained counselors who specialize in helping victims of romance scams accept what happened without shame.

Warning Signs It's Happening Again (or Still)

Scammers who successfully target a senior often come back — or sell your parent's contact information to other scammers. Watch for:

• Sudden secrecy about phone calls, especially from unknown numbers
• New "friends" your parent mentions who you've never met in person
• Unexplained withdrawals or requests to buy gift cards
• Pop-up warnings on their computer claiming a virus was detected and they need to call a number
• Mail from unfamiliar financial institutions or unexpected credit cards
• Your parent becoming defensive when you ask about their finances

If you're managing your parent's digital life long-distance, setting up transaction alerts on their bank accounts (email or text notification for withdrawals above a threshold) gives you early visibility without requiring your parent to report every interaction.

File Reports Even If Recovery Seems Unlikely

FTC: reportfraud.ftc.gov — federal database that drives enforcement actions against scam networks.

FBI IC3: ic3.gov — the FBI's Internet Crime Complaint Center, especially important for losses over $10,000 or cross-border schemes.

Local police: File a report for the paper trail. Some states require a police report to obtain extended fraud alerts (seven years) at the credit bureaus.

State attorney general: Most state AG offices have elder fraud divisions and may be able to assist with recovery.

Reporting might not get your parent's money back directly, but these reports are aggregated to identify scam operations — and in some cases, the FBI and FTC have recovered significant funds through enforcement actions.

Building Defenses Before It Happens Again

Once the immediate crisis is handled, the goal shifts to hardening your parent's digital environment. That means setting up a password manager so they're not reusing credentials, enabling two-factor authentication on email and financial accounts, configuring "Silence Unknown Callers" on their phone, and establishing a family protocol for verifying unexpected requests for money.

The Managing a Parent's Digital Life toolkit includes a device security hardening checklist and scam prevention workflow — practical steps you can implement in a weekend to dramatically reduce the odds of a repeat incident.