How to Spot Phishing Emails: A Guide for Elderly Parents and Their Families

Your parent forwarded you an email from "Bank of America" asking them to verify their account. The logo looks right. The language is professional. But the sender address is [email protected], and the link points to a domain registered three days ago in Moldova. Your parent almost clicked it.

Phishing emails have evolved far beyond the grammatically broken "Nigerian prince" messages of a decade ago. Modern phishing uses AI-generated text, pixel-perfect brand replicas, and personalized details harvested from data breaches. For older adults who grew up trusting institutional correspondence, these emails are genuinely difficult to distinguish from legitimate messages.

The Five Visual Cues That Expose a Phishing Email

Teach your parent to check these five things before clicking anything in an unexpected email:

1. The sender address. Not the display name — the actual email address. Scammers set the display name to "Chase Bank" or "Medicare Services" while the underlying address is something like [email protected]. Show your parent how to tap or hover on the sender name to reveal the full address. If the domain after the @ doesn't match the company's actual website, treat the message as suspicious and verify it independently; some legitimate organizations use separate sending domains.

2. Urgency language. "Your account will be suspended in 24 hours." "Immediate action required." "Failure to verify will result in permanent closure." Legitimate institutions almost never use threat-based urgency in email. If the message demands immediate action, that pressure is manufactured.

3. Generic greetings. "Dear Customer" or "Dear Account Holder" instead of your parent's actual name. Banks and services that have a relationship with your parent may use their name, but a generic greeting can indicate a mass-blast phishing campaign.

4. Links that don't match. Before clicking any link, hover over it (on a computer) or long-press it (on a phone) to preview the URL. If the link text says "www.irs.gov" but the preview shows "irs-gov-verify.com/update," it's a phishing redirect. Teach your parent the rule: never click links in emails. Instead, open a new browser tab and navigate to the website directly.

5. Attachments from unknown senders. Invoices, shipping confirmations, and "important documents" attached to unsolicited emails are malware delivery mechanisms. If your parent didn't buy something, they shouldn't open a shipping confirmation. If they didn't request a document, they shouldn't download one.

Setting Up Device Safety for iOS and Android

Beyond email awareness, configuring your parent's phone and tablet reduces the attack surface.

iPhone (iOS) settings:

• Settings → Apps → Phone → Screen Unknown Callers → Silence: Routes calls from numbers not in contacts to voicemail. Legitimate callers can leave messages; scammers rarely do.
• Messages app → Filter → Manage Filtering → Screen Unknown Senders: Separates texts from unknown senders, reducing exposure to smishing (SMS phishing).
• Settings → Apps → Safari → Fraudulent Website Warning: Ensure this is toggled on — it flags known phishing sites before they load.
• Passwords app → Security: Shows if any saved passwords have appeared in data breaches.

Android settings:

• Phone app → Settings → Caller ID and spam → Filter spam calls: Blocks identified spam numbers.
• Google Messages → profile picture → Messages settings → Protection & Safety → Spam protection: Flags suspicious texts.
• Chrome → Settings → Privacy and security → Safe Browsing → Enhanced protection: The strongest phishing and malware filter.
• Google Play Store → profile picture → Play Protect: Scans installed apps for malicious behavior.

The Email Rules to Post on the Fridge

Some parents respond better to written rules than verbal coaching. Print and post these:

1. Never click a link in an email that asks you to log in. Go to the website yourself by typing the address in your browser.
2. Never call a phone number from an email. Look up the company's number independently.
3. If it says "urgent," it's probably not. Real emergencies don't arrive by email.
4. Never email your Social Security number, Medicare number, or bank details in response to an unexpected message. Treat any such request as suspicious and verify it through a trusted channel.
5. When in doubt, call [your name]. It's always better to check than to click.

Password Managers and Two-Factor Authentication

If your parent reuses the same password across multiple sites — and most people do — a single phishing attack that captures one password compromises everything. A password manager solves this by generating and storing unique passwords for every site.

The additional layer: two-factor authentication (2FA). Even if a phishing email captures your parent's password, 2FA requires a second verification — usually a code texted to their phone — before granting access. Enable 2FA on your parent's email, banking, and Medicare accounts at minimum.

The Ongoing Protection Framework

Phishing is a continuous threat, not a one-time problem to solve. Scammers adapt their tactics monthly. The Scam and Fraud Shield for Aging Parents includes device lockdown checklists for both iOS and Android, a monthly review worksheet that checks for compromised accounts, and conversation scripts for introducing these protections without making your parent feel surveilled. Because the goal isn't to take over their digital life — it's to make their digital life harder for scammers to exploit.