Learn · Family triage · Updated June 2026
My parent got a weird message. What do I do?
Read this first, panic later. If money already moved, jump straight to the Panic Guide.
The first 60 minutes (do these in order)
- 1. Tell them to stop — no more typing, no more clicking, no more talking to the caller. Don't hang up the line yet if they're on a call; mute and put it down.
- 2. Don't delete anything. Screenshots and the original message are evidence.
- 3. If money or card details were shared: call the bank's number on the back of the card and say "suspected fraud, please freeze and attempt recall."
- 4. If a code (SMS / authenticator) was shared: from a clean device, change the email password first, then the banking password.
- 5. If remote-access software was installed (AnyDesk, TeamViewer, "support agent"): power off the computer, then have it cleaned before turning it back on.
- 6. File a report with your country's cybercrime unit — see the country list below.
The 30-second test: is this message a scam?
A real bank, courier, tax office or family member will never demand all three of these at once. If a message hits two or more, it's a scam:
- • Urgency — "now", "today", "your account will be closed"
- • Secrecy — "don't tell your family", "the bank can't know"
- • An unusual payment method — gift cards, crypto, wire transfer to a new account, "send to this account to keep your funds safe"
- • A code or password — anyone asking for an SMS/auth code is committing fraud, no exceptions
- • Remote access — "let me install this so I can help you"
The one rule that prevents most losses
"If anyone tells you not to tell anyone, tell me first." Romance scams, grandparent scams, tech-support scams, pig butchering, investment recovery — every single one of them depends on secrecy. Break secrecy and the scam collapses.
Depth: why these messages work on smart people
Scam messages aren't sloppy — they're engineered. Modern phishing kits are sold as commercial products with A/B-tested subject lines, urgency thresholds, and even compliance copy. The "Microsoft support" call your parent received was probably read from a script that has converted at >3% on hundreds of thousands of similar households. Confident, tech-savvy users actually get caught more often than cautious ones, because they trust their own judgement instead of pausing to verify.
The defensive insight: the moment of greatest risk isn't naivety, it's momentum. The scammer's whole job is to keep the victim moving — one more click, one more code, one more transfer — before reflection kicks in. Every protective tactic above is designed to interrupt momentum: a phone call to a real number, a neutral tool, a second opinion. None of them require your parent to be more technical. They only require a pause.
Check it together (free tools)
Where to report (by country)
- 🇺🇸 US — IC3.gov, FTC at reportfraud.ftc.gov, elder-fraud hotline 1-833-FRAUD-11
- 🇬🇧 UK — Action Fraud · 0300 123 2040
- 🇨🇦 Canada — CAFC · 1-888-495-8501
- 🇦🇺 Australia — Scamwatch
- 🇪🇺 EU — local police + national CERT; see Europol
- 🇮🇳 India — cybercrime.gov.in · 1930
- 🇵🇭 Philippines — PNP-ACG
FAQ
My parent got a weird text or email — is it a scam?
Treat any unexpected message that creates urgency, secrecy, or asks for money, codes or remote access as a scam until proven otherwise. Don't click links, don't call back the number in the message, and don't let your parent reply. Open a separate browser tab and look up the sender (bank, agency, courier) on your own — 9 out of 10 'urgent' messages collapse the moment you try to verify them through an independent channel.
What should I do in the first hour if I think they fell for it?
First, stop the bleeding: have them disconnect from any caller, stop typing codes, and not delete anything (you'll need the evidence). Second, call the real bank using the number on the back of their card — say 'suspected fraud, please freeze and recall.' Third, change passwords from a clean device, starting with email. Then file a report — IC3 (US), Action Fraud (UK), CAFC (Canada), or your country's cybercrime unit. The faster you move in the first 24 hours, the higher the recovery odds.
Should I take away their phone or computer?
Almost never. Isolation is what the scammer wants — it stops the victim from getting a second opinion. Instead, install a call-screening app, enable bank transaction alerts on your phone too, and agree on a 'call me before you send money or share a code' rule. Independence with a safety net beats lockdown every time.
They're embarrassed and don't want to talk about it. What now?
Lead with 'this stuff is designed by professionals to fool smart people — the fact you're telling me is the win.' Shame is the scammer's last weapon: it keeps victims silent so the same person can be re-targeted by 'recovery experts' weeks later. Normalising the conversation is the single biggest protective factor.
How do I tell my parent it was a scam without them feeling stupid?
Don't lead with the word 'scam'. Lead with 'I'm worried this might not be who they said they were — can we check it together?' Show, don't tell: open the GACS scanner with them, paste the number or link, and let the tool deliver the verdict. The verdict from a neutral tool lands much better than a verdict from a family member.