Monthly Online-Safety Checklist for Aging Parents

Online safety is easier to maintain than to rebuild after a crisis.

A family may carefully set up bank alerts, stronger passwords and a safe word, then assume the work is finished.

But accounts change. Phones are replaced. Applications are installed. A new investment contact appears. A suspicious message is ignored and forgotten. A trusted telephone number becomes outdated.

A monthly online-safety check helps families notice these small changes before a scammer turns them into a larger problem.

The message Margaret almost forgot to mention

Consider an illustrative example involving 75-year-old Margaret and her son, David.

They completed a seven-day scam-protection plan several months earlier. Margaret’s email had a strong password, her bank alerts were active, and the family had agreed never to move money during an incoming call.

During their monthly review, David asks a routine question:

“Did anyone contact you unexpectedly about money, deliveries, your computer, or an account?”

Margaret remembers a friendly man she met in a gardening group. He had begun sending private messages and recently mentioned an investment that had helped his sister retire early.

Nothing had been paid. No password had been shared. There was no emergency.

But the conversation had quietly moved from gardening to money.

Together, Margaret and David verify the investment company and discover warnings from a financial regulator. Margaret blocks the account before the relationship develops further.

The monthly review did not uncover a dramatic theft. It interrupted a scam while the warning signs were still small.

How to use the monthly checklist

Choose the same week each month, such as the first Saturday or the day after a pension or salary payment. Consistency makes the review easier to remember.

Keep it between 20 and 30 minutes unless something unusual needs attention. The meeting should feel like ordinary household maintenance, not an investigation.

The older adult should remain in control of personal information and decisions. Adult children and caregivers should not demand passwords, search private conversations without permission, or assume that age removes the right to privacy.

Begin with three promises:

• No one will be blamed for reporting a suspicious interaction.
• Small concerns are worth discussing before they become emergencies.
• The same safety rules apply to every generation in the family.

The FTC’s Pass It On approach encourages families to respect older adults’ experience and use practical conversations rather than fear or shame. A monthly review works best when it feels collaborative.

When not to wait for the monthly review

The checklist is routine maintenance, not a reason to delay urgent action.

Contact the bank, payment provider, account service or trusted technician immediately when:

• money was sent to a suspected scammer
• a card number, password, PIN or verification code was shared
• an unexpected person obtained remote access to a device
• a new telephone number or email address appeared on an account
• the mobile telephone suddenly lost service without explanation
• an unfamiliar transfer, withdrawal or credit application appears
• a caller is currently arranging cash, gold or courier collection

A monthly meeting should also happen early after any important change. Examples include replacing a phone, opening a bank account, beginning online dating, hiring a caregiver, moving home, losing a spouse, receiving an inheritance, selling property or experiencing a health change that affects memory or decision-making.

1. Review bank, card and investment activity

Open financial accounts through official applications or bookmarked websites. Do not use links from recent emails or text messages.

Review:

• bank and credit-card transactions
• cash withdrawals
• new transfer recipients or payees
• payment-app activity
• recurring subscriptions
• investment deposits and withdrawals
• changes to contact information or security settings

Ask about payments that appear small or unfamiliar. Criminals sometimes test a card with a low-value transaction before attempting a larger charge.

Confirm that transaction alerts still arrive. A changed telephone number, blocked notification, new device or modified account setting can silently stop them.

The Consumer Financial Protection Bureau advises older adults to make long-term fraud-protection plans with trusted contacts and financial institutions. Ask the bank whether it offers trusted contacts, additional verification, account alerts or other protections against exploitation.

Review the family payment rules:

No unexpected caller or message receives gift cards, cryptocurrency, wire transfers, cash, gold, verification codes or money moved to a “safe account.” New investments and unusual transfers wait 48 hours.

Use the guide on how investment scams target retirees when a new opportunity has appeared.

Look beyond the bank statement

Identity theft may appear outside the main account. Ask whether any unfamiliar bill, debt notice, insurance statement, tax message, benefit letter or credit application arrived. Missing expected mail can also matter if someone changed an address or redirected correspondence.

In the United States, the FTC advises people to review financial statements and credit information for accounts they do not recognise. Families should use the official credit-report and identity-recovery routes for their country rather than services promoted through unsolicited calls or advertisements.

Store sensitive paper records securely and shred documents containing personal or financial details before disposal. Do not carry identity documents, account numbers or passwords unnecessarily.

2. Check email and important accounts

Email is a priority because criminals can use it to reset passwords on many other services.

Check:

• whether email uses a unique password
• whether two-step verification is active
• unknown signed-in devices or sessions
• unfamiliar recovery telephone numbers or email addresses
• unexpected forwarding rules
• security alerts that were not recognised
• passwords reused across important accounts

The FTC recommends strong passwords, software updates and two-factor authentication. The UK National Cyber Security Centre similarly recommends a strong separate email password, current software, two-step verification and backups.

A password manager can make unique passwords easier to maintain. When that is not practical, choose a secure method the older adult understands and can use confidently.

Do not read a one-time code to someone who contacted you unexpectedly. Even a genuine-looking security message may be part of an account takeover.

3. Review phones, computers and applications

Check every phone, tablet and computer used for banking, shopping, email or family communication.

• Install operating-system and application updates.
• Confirm that automatic updates remain enabled.
• Review newly installed applications and browser extensions.
• Remove unused remote-access or screen-sharing tools.
• Check application permissions for the camera, microphone, contacts and accessibility controls.
• Confirm that the device uses a secure PIN, fingerprint or face recognition.
• Make sure important photographs, contacts and documents are backed up.
• Review spam-call, junk-message and email-filtering settings.

Software updates contain security fixes, and backups help recover important information after a damaged, lost, infected or locked device.

Ask whether anyone recently claimed the computer had a virus or requested remote access. Review how to recognise fake technical support calls when new software or an unusual support contact appears.

4. Discuss suspicious calls, texts and emails

Do not ask only whether money was lost. Ask about contact that felt unusual, confusing, frightening or unusually helpful.

Useful questions include:

• Did anyone claim to be a relative in trouble?
• Did a bank, police officer or government employee demand urgent action?
• Did anyone ask for a password, PIN or verification code?
• Did a caller prevent you from speaking with family?
• Did a message offer a prize, refund, grant or compensation?
• Did anyone ask you to keep a payment secret?

Review the call-back rule: end unexpected contact and reconnect through a number already trusted or independently verified.

A caller ID, familiar voice or accurate personal detail is not proof. Read how caller ID spoofing makes fake bank calls look real and the warning signs of an AI emergency call.

5. Check deliveries, subscriptions and online purchases

Review recent purchases and recurring charges.

• Does every delivery message match a real order?
• Were any tiny redelivery fees paid?
• Did an unexpected QR code arrive in a text, email or parcel?
• Was an unfamiliar application installed for tracking?
• Did a renewal email claim that antivirus or technical support had been charged?
• Are there subscriptions that should be cancelled?

Open the genuine retailer or courier account separately. Do not use a link from an unexpected delivery message.

Read the guide to QR code and delivery-text scams targeting older adults when an unfamiliar parcel notice appears.

6. Discuss new online relationships and opportunities

Scams do not always begin with an obvious demand. A criminal may spend weeks building trust through friendship, romance, religion, investing, hobbies, caregiving or professional networking.

Ask gently:

• Have you met anyone new online this month?
• Has a private conversation moved toward money or investment?
• Has anyone asked to borrow money or receive a parcel?
• Has someone requested secrecy from family or friends?
• Has an online contact discouraged video calls or in-person meetings?
• Has anyone offered help recovering money previously lost?

Do not ridicule the relationship. Emotional pressure can make a person defend the contact and stop sharing information.

Separate the relationship from the financial claim. A friendship may feel genuine, but any investment, loan, emergency or request for money still requires independent verification.

7. Confirm trusted contacts and family rules

Check that the main and backup trusted contacts are still available and that their complete telephone numbers are correct.

Review:

• the family safe word
• trusted call-back numbers
• the 48-hour payment rule
• the bank and card fraud numbers
• the trusted technical-support contact
• the nearby contact for an older adult living alone

Change the safe word if it was shared in the wrong place, written where visitors can see it, or mentioned publicly.

Read the complete family safe-word guide and the seven-day family scam-protection plan when the household needs to rebuild its safeguards.

8. Update the emergency-response page

The family’s printed emergency page should begin with:

PAUSE. END CONTACT. VERIFY INDEPENDENTLY. PROTECT. REPORT.

Confirm that it contains:

• trusted family contacts
• bank and card fraud numbers
• the internet and mobile provider
• the trusted technician
• national fraud-reporting routes
• identity-theft recovery information
• a space for recording incidents

When money or account access may be at risk, contact the financial institution first. The FTC advises people who shared passwords, personal information or device access to act quickly, change compromised credentials and report the incident.

United States

Use ReportFraud.ftc.gov for fraud reports and IC3 for internet-enabled crime. Identity theft recovery is available through IdentityTheft.gov. The Eldercare Locator can connect families to Adult Protective Services at 800-677-1116.

United Kingdom

Contact the bank first, then report fraud through Report Fraud. Follow Police Scotland guidance where applicable. Suspicious texts can generally be forwarded to 7726.

Europe

Contact the bank or payment provider, national police or cybercrime reporting service, and the relevant national financial regulator. Use official national or EU sources rather than details supplied by the suspected scammer.

9. Practise one scam scenario

Finish the monthly review with a two-minute exercise.

Choose one:

• A grandchild calls after an accident and needs bail money.
• The bank says savings must be moved to a safe account.
• A courier requests a small redelivery fee.
• A computer warning displays a telephone number.
• An adviser offers guaranteed investment returns.

The older adult should practise saying:

“I do not make decisions during unexpected contact. I will end this conversation and verify it myself.”

Then identify the trusted person or official number that would be contacted next.

Practice matters because a familiar sentence is easier to use when fear, urgency or politeness makes it difficult to end a real call.

Printable monthly online-safety checklist

• All bank and card transactions are recognised.
• No unfamiliar withdrawals, payees or recurring charges appeared.
• Financial alerts still reach the correct telephone or email.
• No unexpected investment, loan or recovery fee was paid.
• Email uses a unique password and two-step verification.
• Unknown devices, sessions and forwarding rules were removed.
• Important account-recovery details are current.
• Phones, tablets, computers and applications are updated.
• No unfamiliar remote-access software or browser extension is installed.
• Important photographs, contacts and documents are backed up.
• Suspicious calls, texts, emails and social-media messages were discussed.
• Recent delivery notices match genuine orders.
• No unexpected QR code or small redelivery fee was used.
• New online friendships and money-related conversations were discussed safely.
• The family safe word remains private.
• Trusted contacts and official telephone numbers are current.
• The emergency-response page is easy to find.
• One scam scenario was practised.
• No one was blamed or shamed for reporting a concern.
• The next monthly review date is scheduled.

Frequently asked questions

How often should families review online safety?

A brief monthly check works well for many families, with a fuller review every six months or after a major change such as a new phone, bank account, caregiver, move or health concern.

Should adult children inspect every message their parents receive?

No. Routine surveillance can damage trust and privacy. Use agreed questions, account alerts and shared safety rules. More direct support may be appropriate when the older adult requests it or when lawful arrangements are necessary because of reduced capacity.

What is the most important item on the checklist?

The most important habit is reporting unusual contact without fear of blame. Early disclosure gives the family, bank and authorities more time to limit harm.

Should passwords be changed every month?

Not merely because another month has passed. Change passwords when they are weak, reused, exposed in a breach, shared with the wrong person, or connected to suspicious account activity. Use unique passwords and two-step verification.

What should be checked on a parent’s bank account?

Review transactions, withdrawals, transfers, new payees, recurring charges, contact-information changes and whether alerts still work. Contact the bank through an official route when anything is unfamiliar.

What if an aging parent finds the checklist intrusive?

Make it a family checklist that everyone completes. Ask which areas they want help with and which they prefer to manage privately. Focus on preserving independence rather than taking control.

What should happen after a suspicious link was clicked?

Close the page and do not enter information or download software. If a password, card number or personal information was entered, change compromised credentials from a trusted device and contact the relevant bank or service immediately.

Does the checklist replace professional help?

No. Banks, regulated financial advisers, trusted technicians, legal professionals, health professionals, safeguarding services and law enforcement may be needed depending on the situation.

Thirty calm minutes can interrupt a developing scam

A monthly review will not predict every new tactic.

It does something more practical.

It creates a regular moment when unfamiliar payments are noticed, strange messages are discussed, outdated safeguards are repaired, and new relationships can be considered without pressure.

Most importantly, it reminds every family member that speaking early is an act of protection, not an admission of failure.

Check the money.

Check the accounts.

Check the devices.

Discuss the messages.

Confirm the trusted people.

Practise the response.

Then schedule the next review before ordinary life becomes busy again.

Build the Complete Family Protection Plan

My full-color guide, Protect Aging Parents from AI Voice Clones, Fake Bank Calls and Online Scams, includes realistic scenarios, ready-to-use scripts, printable checklists, emergency-response pages, and a practical 7-Day Family Protection Plan.

View the Family Guide

About the author

Michael Onoja is a Microsoft MVP, technology leader, software engineer, researcher, and published author. He writes about AI safety, digital trust, cybersecurity, and practical ways families can protect one another from emerging online threats.

Start with the seven-day family scam-protection plan or read the complete guide to protecting aging parents from AI voice scams.

This article provides general educational information and is not legal, financial, medical, technical, safeguarding or law-enforcement advice. Account features, reporting routes and technology settings can change. Verify important information through official organisations and qualified professionals.

Tags:Aging ParentsElder FraudFamily CybersecurityOnline Safety ChecklistScam Prevention