The most common threats to seniors online, and how to stop them
Scammers target seniors online more than any other age group because they know older adults often have savings, own homes, and may be less familiar with how fraud works on the internet. The threats are real — but they are also predictable, and you can defend against nearly all of them by learning to spot the same few patterns that repeat.
The biggest dangers are not viruses or hackers breaking into your computer. They are people pretending to be someone they are not — a grandchild in trouble, a bank employee, a tech support person, a dating match — to trick you into sending money or revealing passwords. The second-biggest danger is clicking a link or opening a file that installs malware, which then watches what you type or locks your files until you pay.
You do not need to become a technology informed to stay safe. You need to learn four things: how to spot a fake message, how to check whether a website is real, how to use a strong password, and when to say no and hang up.
Key Takeaways
- Scammers almost always ask you to act fast, keep it secret, or send money or passwords — real banks and family members do not.
- Check a website's address in the browser bar before you enter passwords or payment information; scam sites often use names that look almost like the real one.
- Use a different, strong password for each important account — your bank, email, and social media — so one breach does not unlock everything.
- If someone calls or messages claiming to be from your bank, tech support, or a grandchild in trouble, hang up and call the number on your bank statement or the person's known phone number instead.
- Turn on two-factor authentication for your email and bank accounts so that even if someone gets your password, they cannot log in without a code sent to your phone.
How to spot a scam message or email
Scammers use the same tricks over and over. They create urgency ("Your account will be closed today"), they ask you to keep it secret ("Do not tell anyone"), or they claim something is wrong that needs your when ready action ("Verify your password now"). Real banks, real family members, and real companies do not work this way.
A real bank will never ask you to confirm your password, account number, or Social Security number by email or text. A real grandchild will not ask you to wire money without explaining why, and will not ask you to keep it secret from their parents. A real tech support person will not call you out of the blue saying your computer has a virus — you called them, or they are responding to a support request you made.
If you receive a message that makes you uneasy, do this: stop, do not click anything, and call the person or company using a phone number you know is real. Look up the number on your bank statement, on the back of your credit card, or on the official website (see the next section). Tell them what the message said. They will tell you whether it is real. This one habit stops most scams.
How to check if a website is real
Scammers build fake websites that look almost identical to real ones. The trick is to look at the address bar at the very top of your browser — the place where you see the web address (called a URL). A real bank's address will be something like www.bankname.com, not www.bankname-find.com or www.bankname.net or www.banknamelogin.com. The fake versions are close enough to fool you if you are not looking carefully.
Before you enter a password, credit card number, or Social Security number into any website, stop and look at the address bar. Make sure it matches exactly what you expect. If you are not sure, do not enter anything. Instead, close the page, go to Google, search for the company name, and click the official link from the search results.
You should also see a small padlock icon next to the address, which means the connection is encrypted and safer. But the padlock alone does not mean the site is real — scammers use it too. The address bar is what matters most.
How to create and manage strong passwords
A strong password is long (at least 12 characters), uses a mix of uppercase letters, lowercase letters, numbers, and symbols (like ! or #), and is different for each account. A weak password is something you can remember easily, like your birthday or your pet's name.
The problem with trying to remember strong passwords is that you cannot. So do not try. Instead, use a password manager — a program that stores all your passwords in one locked vault that you open with a single strong password. The two most common ones are Bitwarden (free) and 1Password (paid, with a free trial). You create one very strong password to open the manager, and it remembers all the others for you.
If you do not want to use a password manager, write your passwords down on paper and keep the paper in a safe place at home — a locked drawer or a safe. This is safer than using the same password everywhere or writing it on a sticky note on your monitor. Never email your passwords to yourself or store them in a document on your computer.
The most important accounts to protect with strong, unique passwords are your email, your bank, and any account linked to a payment method. Your email is the most critical: if someone gets into your email, they can reset passwords on all your other accounts.
How to turn on two-factor authentication
Two-factor authentication (often called 2FA) means you need two things to log in: your password and a second proof that you are really you. Usually the second proof is a code sent to your phone by text message, or a code generated by an app on your phone.
Even if a scammer gets your password, they cannot log into your account without that second code. You should turn on two-factor authentication for your email account and your bank account first, because those are the most important. Most email providers and banks offer it, though the steps are different for each one.
For Gmail: go to myaccount.google.com, click "Security" on the left, scroll to "How you sign in to Google," and click "2-Step Verification." For a typical bank, log in to your account, look for "Security" or "Settings," and search for "two-factor" or "authentication." If you cannot find it, call your bank and ask them to turn it on for you.
How to protect your computer and phone from malware
Malware is software that installs on your device without your permission and then steals information, locks your files, or watches what you type. It usually gets in when you click a link in a suspicious email, read a file from an untrusted website, or visit a website that has been hacked.
The best defense is to keep your operating system and browser up to date. When your computer or phone tells you there is an update available, install it. These updates patch security holes that scammers use. Do not ignore them or put them off.
You should also use antivirus software. Windows computers come with Windows Defender built in, which is free and good enough for most people. Mac computers have built-in protection as well. If you want additional protection, Malwarebytes (free version available) is a good choice. On your phone, keep your apps updated, and only read apps from the official app store (Apple App Store for iPhone, Google Play for Android).
Never read software or files from links in emails, even if the email looks like it came from someone you know. If you are not sure whether something is safe, ask someone you trust or search the filename on Google to see what others say about it.
What to do if you think you have been scammed
If you have sent money to a scammer, contact your bank or payment service right away. If you used a wire transfer or gift card, the money may be gone, but your bank can still try to stop it. If you used a credit card or debit card, you have more protection — call the number on the back of your card and report the fraud.
If you gave a scammer your password, change it when ready. If it was your email password, change that first, then change your bank password and any other important accounts. If you think malware is on your computer, turn it off, take it to a local computer repair shop, or call a trusted family member for help.
You can also report the scam to the Federal Trade Commission at reportfraud.ftc.gov. This helps law enforcement track patterns and shut down scam operations. If someone is impersonating a bank or government agency, you can report that to the agency itself — for example, to your actual bank or to the Social Security Administration.
Frequently Asked Questions
Is it safe to use public WiFi at a coffee shop or library?
Public WiFi is not encrypted, so someone on the same network can see what you type. Do not log into your bank, email, or any account with a password on public WiFi. If you must, use a VPN (virtual private network) like Proton VPN or Mullvad, which encrypts your connection. For most tasks — reading news, watching videos — public WiFi is fine.
What should I do if I get a call from someone saying they are from Microsoft or Apple?
Hang up. Microsoft and Apple do not call people out of the blue to say there is a problem with their computer. If you are worried about your device, call the company yourself using the number on their official website. Do not use a number from the call or from a pop-up on your screen.
Is it okay to use the same password for accounts that are not important?
It is better not to, but if you must, never use that same password for your email, bank, or any account with payment information. One breach of a less important site could give a scammer a password to try on your bank. If you use a password manager, there is no reason to reuse passwords — it remembers them all for you.
How do I know if an email really came from my bank?
Check the sender's email address carefully — scammers often use addresses that look similar to the real one but are slightly different. If you are not sure, do not click any links in the email. Instead, close it, go to your bank's official website (type the address into your browser yourself), log in, and check your messages there. Your bank's real messages will also appear in your account.
What is the difference between a virus and malware?
A virus is a type of malware that spreads from file to file or computer to computer. Malware is the broader term for any malicious software — viruses, spyware, ransomware, and others. For practical purposes, the protection is the same: keep your software updated, use antivirus software, and do not read files from untrusted sources.