Guide·Scam protection·For adult children
How to protect your parent from email scams (without standing over their shoulder)
A practical guide for adult children. What the scams look like now, what's actually working to stop them, and what to do if the person you look after has already fallen for one.
§Section 1 · Why this is harder than it used to be
If you're reading this, something has probably happened.
Mum got a "Google Security Alert" email and called you in a panic. Dad clicked a link in what he thought was an Australia Post tracking notice. Your aunt almost gave her bank details to someone claiming to be from the ATO. There's an incident, and it's left you shaken, and you're trying to work out what to do.
You're not alone. The numbers are sobering — the FBI's 2024 Elder Fraud Report logged $4.9 billion in losses from Americans over 60. Australia's ACCC reports that scam losses among people over 65 grew significantly through 2024 and 2025. The UK's National Cyber Security Centre is running ongoing campaigns about the same problem. This isn't a small thing happening to a few unlucky families. It's a systemic shift in how the internet treats older adults.
The reason it's harder than it used to be has three parts.
The scams are better. AI-generated phishing emails now have correct grammar, the right tone, and the right details — they look like real messages from real companies. The 2024 voice-cloning scams ("Mum, it's me, I've been in an accident, I need money") have moved from text to convincing audio. Bunnings, MyGov, Australia Post, Telstra, the ATO — all routinely impersonated, with logos and language that match perfectly.
The defences are worse. Spam filters were designed to catch bulk marketing — they're not built to catch the new kind of one-off, hyper-targeted scam. Gmail and Apple Mail's filters catch the obvious stuff, but the dangerous emails are the ones that look real, and those slip through.
The targets are easier. Mild cognitive decline — the kind that doesn't show up on a formal diagnosis but makes someone say "I forget where I put my keys more than I used to" — affects roughly 15-20% of people over 65. The cognitive load of distinguishing a real "your Apple ID has been suspended" email from a fake one is exactly the thing that gets harder. And scammers know it.
¶Section 2 · The shape of it, today
What scams actually look like in 2026.
A short tour of what's actually in the inbox of an older person, today. You'll recognise most of these.
The impersonation alert.
"Your Apple account has been suspended." "Suspicious activity on your Microsoft 365." "Your Netflix subscription has been cancelled." Designed to create panic and get a click. The link goes to a fake login page that captures the password.
The delivery scam.
"Your Australia Post parcel could not be delivered." "Reschedule your delivery." "Customs fee required." Often dressed in real Australia Post or Royal Mail branding, with a link to a fake payment page.
The government impersonation.
"MyGov: your activity statement needs attention." "The ATO has identified an issue with your account." Particularly effective because the consequences of not responding to a real government email feel real.
The bank alert.
"Suspicious transaction on your account." "Click here to verify your identity." The link goes to a fake banking login. Sometimes the scammer follows up with a phone call pretending to be the bank's fraud team.
The "Hi Mum" message.
Not an email, technically — usually a text or WhatsApp message — but it travels in the same ecosystem. "Hi Mum, this is my new number, my phone is broken, can you transfer me $400?" Caught more than 1,150 Australians in the first half of 2022 alone, with losses of $2.6 million in that period.
The romance / loneliness scam.
Less common in email; more common in Facebook messages and dating apps. Slow-building, often months. Usually ends in a request for money to cover a "medical emergency" or "travel cost."
The investment / cryptocurrency scam.
"You qualify for a special offer." "Returns of 12% guaranteed." Targeted especially at older men. Often introduced via a fake "trusted advisor" email.
The common thread: urgency, plausibility, and the appearance of authority. Every one of these is designed to get a click before the recipient has time to think.
✶Section 3 · What's actually working
The standard advice has been steadily failing for fifteen years.
"Teach Mum or Dad to spot scams, mark them as junk, set up better spam filters." That's been the recommendation since about 2010. It's also the recommendation that's losing ground every year, because it asks the recipient to be vigilant exactly when their attention is going elsewhere. Here's what's actually moving the needle, in our reading of what families have found useful.
Reduce the surface. The fewer messages reach the person you look after at all, the fewer dangerous ones can get through. Unsubscribing from marketing lists, removing them from junk mail mailing lists (DMA Choice in the US, similar programs in AU/UK), and putting their phone on the Do Not Call register all help. So does, increasingly, switching to an email setup where unknown senders simply don't arrive.
Stop relying on detection. Trying to teach an older adult — especially one with any cognitive decline — to reliably spot a sophisticated scam email is a losing fight. The scams are designed by people whose job is to evade detection. Vigilance-based protection is structurally unstable when the recipient's attention is going in other directions.
Move the gatekeeping out of their hands. The protective decisions — "is this email from a real person?" — work better when made by a family member who can take a moment to check, rather than by your parent at the moment they're opening an email. This is the principle behind allowlist-based email tools, where unknown senders go to a family admin queue, not the parent's inbox.
Set up financial backstops. Even if a scam gets through, you can limit the damage. Talk to the bank about caregiver alerts on transactions over a certain amount. Set a daily transfer limit. Consider a prepaid debit card with spending limits for daily use. In Australia, talk to the bank about CDR-style monitoring; in the US, services like True Link offer purpose-built cards for this.
Talk about it openly. The deepest research finding from elder fraud experts is that people who are aware a particular scam exists are roughly 80% less likely to engage with it. Forward articles. Share what you read. Talk about the "Apple Security Alert" they got at dinner. Make it normal to ask "does this look right to you?" without anyone feeling stupid.
Shame creates secrecy. Secrecy makes the next scam worse.
The single most important thing in this article
Don't blame. This is the most important and most often skipped piece. If your parent gets scammed, don't make them feel embarrassed. Embarrassment is the reason it stays hidden the second time. Help them report it (ACCC Scamwatch in AU, FTC in the US, Action Fraud in the UK), help them recover what can be recovered, and make it clear they can always tell you when something looks suspicious.
⌗Section 4 · If it's already happened
A short triage list, in the order it usually matters.
- Stop the immediate transaction if possible.
Call the bank. If money has been transferred in the last few hours, the bank can sometimes reverse it. Time matters — within 24 hours is much better than 48.
- Change passwords on anything compromised.
Especially email — if the scammer has the email password, they can reset everything else. Use a different device than the one the scam happened on, in case there's malware.
- Watch for follow-up scams.
People who've been scammed once are targeted again, by the same group and by others who buy the lists. "Hi, I'm from the fraud recovery service, we can get your money back if you pay a fee" is a common second-round scam.
- Report it.
Australia: ACCC Scamwatch (scamwatch.gov.au) and ReportCyber for cybercrime. US: FTC ReportFraud.ftc.gov and the FBI's IC3. UK: Action Fraud. Reporting helps law enforcement track patterns and occasionally recovers funds.
- Talk gently.
Don't make them feel stupid. They are, statistically, the latest victim of an industry. Make sure they know they can tell you when the next one happens.
⁂Section 5 · A structural option
Vigilance scales badly. Structure does better.
Most of the protection in the previous sections is built on vigilance — yours, your parent's, the bank's. Vigilance scales badly. The structural alternative is to put a protective layer between the person you look after and the email inbox itself.
That's what Mailicity does. It's an email app for the iPad they already have, that wraps their existing email account (Gmail, iCloud, Outlook, whatever they use) and only shows them messages from people you — the adult son or daughter — have approved. Anything from a stranger, including all of the scam emails described above, lands in your review queue instead of theirs.
It doesn't replace the conversations or the bank-level protections. It does shrink the surface area dramatically. The Apple Security Alert never reaches them. The Australia Post parcel scam doesn't either. The fake grandchild doesn't get a foothold.
It's free during our early access period. No card needed. Set up in five minutes by you, calm from then on for them.