Key Takeaways
- Scammers use urgency and impersonation to pressure people into acting before they can think.
- A strong, unique password for each account is the single most effective protection you can set up today.
- Legitimate organizations will never demand immediate payment by gift card, wire transfer, or cryptocurrency.
- If you receive an unexpected message asking for personal or financial information, verify the sender through an official channel before responding.
- Reporting scam attempts helps protect others, and free resources exist to walk you through every step.
Start here
Why older adults are targeted online
Next
The most common scam types to recognize
Build on it
Password basics that actually hold up
Go deeper
Protecting personal and financial information
If needed
What to do if something goes wrong
Why older adults are targeted online
Scammers target older adults for straightforward reasons. Many people in this group have accumulated savings, own property, and tend to answer phone calls from unknown numbers. Years of habitual trust in institutions such as the IRS or Medicare make impersonation scams harder to spot quickly. None of this reflects a lack of intelligence; it reflects that scammers study human behavior and design traps accordingly.
According to the FBI's Internet Crime Complaint Center, adults over 60 reported losing more than $3.4 billion to online fraud in 2023, the highest loss total of any age group. The gap between older and younger adults is not about capability online but about the tactics scammers have refined for this audience.
Understanding who the attacker is and why they focus on you is the first step in not becoming a statistic. The rest of this guide covers practical, concrete steps you can take without needing a technical background.
The most common scam types to recognize
Most online scams targeting older adults fall into a small number of patterns.
- Impersonation scams: A message or call appears to come from the Social Security Administration, Medicare, the IRS, or a well-known company. The caller claims there is an urgent problem with your account or benefits.
- Tech support scams: A pop-up or call claims your computer has a virus and instructs you to call a number or allow remote access. Legitimate companies do not contact you unsolicited about device problems.
- Romance scams: Someone builds a relationship over weeks or months online, then eventually asks for money citing an emergency.
- Lottery and prize scams: A message says you have won something but must pay a fee or provide banking details to claim it.
- Grandparent scams: A caller pretends to be a grandchild or a lawyer representing one, claiming they are in trouble and need money immediately.
All of these share one feature: urgency. Scammers want you to act before you can verify. Understanding how urgency is used as a pressure tactic can help you catch yourself before clicking or paying.
Pause before you click or call back
Scammers count on you acting fast. If a message creates a sense of alarm, set it aside for 10 minutes before doing anything. Call the organization directly using a number from their official website, not any number included in the suspicious message. This one pause prevents most scam attempts from succeeding.
Password basics that actually hold up
A weak or reused password is the most common way accounts get compromised. If one site you use has a data breach and you used the same password elsewhere, every account with that password is now at risk.
A strong password is long (at least 12 characters), uses a mix of letters, numbers, and symbols, and has nothing to do with your name, birthdate, or address. A passphrase, four or five random unrelated words strung together, is easier to remember and harder to crack than a short complex password.
A password manager removes most of the memory burden. You create one strong main password for the manager itself, and it handles unique passwords for every site. You can start your account security review using our account security audit checklist.
Turn on two-factor authentication (2FA) wherever a site offers it. Most major email providers, banks, and social media platforms support it. Even if someone gets your password, they still cannot log in without the second step.
Phishing
A scam where someone pretends to be a trusted organization (such as a bank or government agency) through email, text, or phone to trick you into giving up personal information.
Two-factor authentication
A login method that requires two steps to verify your identity, such as your password plus a code sent to your phone. It makes it much harder for someone else to access your account.
Malware
Harmful software that can be secretly installed on your device to steal information, display unwanted ads, or lock your files. It often arrives through suspicious links or email attachments.
Password manager
An app that securely stores all your passwords in one place so you only have to remember one main password. It can also generate strong, unique passwords for each site.
HTTPS
A web address prefix that means the connection between your browser and the website is encrypted, making it harder for others to intercept what you type.
Protecting personal and financial information
Personal information has value to criminals because it can be used to open accounts, file fraudulent tax returns, or impersonate you with your bank. Guard your Social Security number carefully; you rarely need to give it out, and no website should ask for it without a clear, verifiable reason.
Before entering any information on a website, check that the address starts with https and that there is a padlock icon in the browser bar. Those signals mean the connection is encrypted. Learn which signals you can trust and which ones scammers can mimic in our guide to website safety signals.
Keep your device's operating system and apps updated. Updates frequently include security patches for known weaknesses. Set updates to install automatically if possible.
On the financial side, review your bank and credit card statements regularly for charges you do not recognize. Consider placing a free credit freeze with each of the three major credit bureaus (Equifax, Experian, and TransUnion). A freeze prevents new lines of credit from being opened in your name without your explicit approval.
Gift cards are never a legitimate payment method
No government agency, utility company, or legitimate business will ask you to pay a debt or penalty using gift cards and then read the numbers over the phone. If anyone asks for payment this way, it is a scam. Hang up or ignore the message, and report it to the FTC at ReportFraud.ftc.gov.
What to do if something goes wrong
If you suspect you have fallen for a scam or that your information has been exposed, act quickly but without panic.
- Contact your bank or credit card issuer immediately if any financial information was shared. Ask them to freeze the account or issue a new card.
- Change the password for any account that may be compromised, starting with your email, since it is used to reset everything else.
- Place a fraud alert with one of the major credit bureaus; that bureau is required to notify the others.
- File a report at ReportFraud.ftc.gov. The FTC can issue a personal recovery plan and track the scheme.
You can build on these steps with consistent habits over time. Our guide to digital security habits covers what a sustainable routine looks like. For a broader overview of the whole topic, our complete online safety guide covers each area in more depth.
Reporting helps more than you
Many older adults feel embarrassed after a scam attempt and do not report it. Reporting to the FTC or your state attorney general's office does not require you to have lost money. Each report helps track patterns and can prevent others from being targeted by the same scheme.