Hacker News Reader

Comment by wil421 | Hacker News Reader

How do you guys protect elderly parents? My parents and in-laws aren’t there yet but they all in the retired age group.

A friend of the family recently had his email hacked. They sent targeted emails to all his contacts and setup a filter to hide the communication. His brother in law is a stoke victim with impaired cognition and only has access to $12k or so at a time. They were able to scam all of it from him over multiple transfers and he never picked up the phone to call the family friend. The family fiend is also his caretaker and limits his funds access for this exact reason.

The family friend is a retired old GE executive who will probably never run out of money no matter how many cars he buys due to pension funds. I wonder if he was targeted.

View on HN

Unfortunately I had to just give my parents (68 and 67 years old) ground rules for all forms of communication. This happened after my dad got a fake $3000 invoice from paypal and he paid it.

1. If a service provider you use reaches out via email asking for money, its fake. Login to their online portal (it took a lot of coaxing to get them comfortable with this...)

2. If a service provider reaches out to you via SMS or Phone call, even if they know your account number or other sensitive data: Tell them you will call them back on the phone number listed on their website. If they insist, its fake.

3. If you aren't sure its fake, just ask me to look at it.

#3 might be something to try and like really hammer home. Be like "I would rather you ask me about 100 different scam attempts and save $1000s then just pay"

These are good ground rules. Fortunately or unfortunately, my parents were scammed once pretty early on, I believe for a small amount, so they are well aware of what to look for. But after 10 more years of cognitive decline? 20 more? Who knows if they'll still be on guard.

The simple rule of thumb that will keep people reasonably safe is: Do not trust anyone who E-mails or calls over the phone to be who they say they are. If they say they are from business XYZ, hang up the phone and call XYZ's main number and ask for them. While there are exceptions and scammers are getting craftier, incoming calls and E-mail is by far the major attack vector.

These are all very good. Here's one that saved me a fuckton of tech support time: set up dns adblocking/malware domain blocking right on their network/router settings. Save it to the factory defaults too if supported or put some tape over the reset pinhole button.

My stepfather always tries the factory reset button as if it's just a more hardcore reboot to "fix" the internet when the service is simply out.

My parents are the same age and have already been scammed a few times. I set up similar rules but I am afraid they might get sucked in again. I don’t understand why law enforcement isn’t doing anything about this. Surely the surveillance dragnet they’ve set up over the last few decades can tell them who is making 750,000 calls a day to elderly people in the US?

Yeah it's people in Nigeria etc.

U.S. political will to make positive and reasonable changes, like legislating that telecoms crack down on scam call sources or prevent spoofing, seems to have fallen apart. So many people are caught up in culture wars, there's only one thing they care to get behind, and it's taking our country back from those terrible, immoral, brain dead people on "the other side". Voters don't deviate from their tribe, so there's little incentive as a candidate to deviate from standard tribe policy, and so votes are inutile with respect to policy.

If there's a private sector solution to the scam calls that can be charged heavily for, that's what we're most likely to get. The competent parts of government aren't concerned with this stuff. Congress has to make it a concern, but they mostly toil on behalf of corporate lobbyists. Lobbyists aren't hired to help society at the expense of who they represent.

Intelligent, informed voters and honest politicians would have solved this and many other problems already, but we're extremely far from that ideal, and I think still trending away.

I've wondered before if posting in HN threads like this one is a better way to influence policy than going to the polls, since someone with influence could be reading. Maybe what I should actually be doing is writing to my representatives, as that's probably more impactful than either.

You can do it all; going to the polls takes the least amount of effort out of anything else.

I have power of attorney and manage their finances for them (mid 90s relative). They spend on a credit card which I make payments against, and review transactions monthly for anomalies (anything besides Walmart, grocery store, pharmacy, Amazon, and recurring monthly services or utilities throws red flags). Make sure your estate planning is properly performed before they decline (physically or mentally).

Behavioral improvements and education are nice to haves, but constant vigilance has a high cost for folks at this age and it only takes one successful adversarial attempt to succed. In this case, strong controls and guardrails are a superior solution imho.

($dayjob is infosec/risk mgmt)

You might run into headwinds because in their era using a credit card was generally seen as a bad thing (borrowing, takes longer in line, etc). You might have luck finding a card with cash back rewards and/or a referral fee and selling them on those aspects.

If they want someone to take care of them, then they need to give up some agency. Spending everything via credit card is the easiest and most effective way to solve this problem.

I mean, children also generally don't want someone to take care of them, and yet they don't have much say in the matter.

It’s easier to assume agency over your children than an adult. Sometimes, you even have to go to court (depending on circumstances).

With elderly loved ones, as with everything in life, a negotiation takes place.

Yeah, my grandfather was absolutely opposed to giving up any agency. Especially to his daughters, so I was the front man. When we had to take away his car keys, he came after me with his cane. Hilarious in retrospect, as it was almost a cartoon. But at the time, it was quite dramatic.

I agree, but that negotiation isn't necessarily in explicit terms. In my experience elderly people will spend all day insisting that they will do something themselves (protecting their own ego), yet most of the time if you go ahead and just do it for them they just accept it and move on.

Interesting! Would a specialized credit card be useful to you here? My Amex has pretty nice instant notifications, which are enough for my own fraud monitoring. But for an elderly relative, would you want something more sophisticated?

In my grandmother's case, it's a run of the mill Bank of America rewards credit card (I had to burn goodwill just to get this far, so we agreed to stay with her preferred bank). Before my mother's death, when I was supporting her financially and her having had a long history of and struggle with addiction, I used TrueLink (which I cannot recommend enough, and had found them here on HN) as it allows you control which category of merchants the payment method can be used with and has strong reporting capabilities on spend.

https://www.truelinkfinancial.com/

https://www.ycombinator.com/companies/true-link (YC S13)

If you come across this comment and need advice in logistics for caring for loved ones, contact info in my profile.

> They spend on a credit card

That's a great idea. And it's easier than ever, now -- at least in my experience. For a while I still had to use bill pay or debit for some of my utilities, but now even those all take credit card. I do it for convenience and the rewards (and because the last time my wife used her debit card it got skimmed), but the result is the same -- 100% of my own spending is on my credit card now. This would work great for my own mother if she gets to a point where I doubt her ability to resist con artists.

Allow list their phone number to only allow numbers they know to call/communicate with them.

Restrict websites to a few domains on the devices they use. Youtube, wsj, etc...

If they want a new one just tell them to ask you.

It sucks and has problems, but its the only real straightforward and viable option I've seen work.

Source: have grandparents who were regularly getting scammed or close to being scammed on a weekly basis.

I think you can get away with these restrictions since most of our grandparent’s lives, they didn’t have much access to these services.

But what do we do when we get old? Will we be rational enough to disconnect ourselves? What if we don’t have any children that can help us make this decision?

The best option I found was to explain - multiple times - to my grandparents that these scams exist and how each of them work. Hopefully if they are ever approached by a scammer, they'll remember my warning and that hesitation will break them out of the fear used in the scams.

I upgraded my mom from an iPad to a Chromebook (her first computer) recently. I installed uBlock Origin and set a secure password for the Google account which I store in my password manager, and then instructed her to use the Chrome password manager when she needs it.

While I'm confident in the security of Chromebook in general, I'm worried by how readily she pulls out her credit card and types the number into obscure sites for purchasing wedding gifts, etsy items, etc. A few years ago she would click on Facebook ads and buy shit quality products for little reason, but I think she eventually learned not to do that.

At least it's a credit card and not a debit card. My dad manages the banking, and is a bit more sophisticated, but even he does things like install programs meant to protect him that actually expose him to more vulnerabilities. For example, there is some Symantec monstrosity installed on his computer that injects a green checkmark into Google search results next to each site it thinks is "trustworthy."

It's definitely frightening and mostly a numbers game whether they'll be the next victims of a scam.

I went the other way. I pulled PCs and anything they COULD install bad software out of the equation.

Beyond the obvious stuff like installing an ad blocker, I don't know. The best idea I've seen is what you already said, just limit access to funds. When my dad went through Alzheimers, we canceled his cards through the bank or let them expire and just never told him. But he was far enough gone that he would never have had reason to buy anything anyway so he never noticed. For someone still functional but easily tricked and unreceptive to the idea of limits, I don't know.

I frequently remind my parents that nearly every email and phone call they get is a scammer. Might be good to "pen test" your parents, through a friend or something.

I pretty much just tell them to assume that anyone contacting them by whatever means asking them to do anything is a scammer.

In my experience, trying to list and explain all of the ways that scams happen actually has the complete opposite effect — either it ends up as information overload and they don't remember it, or they become so fearful of doing wrong in specific situations that they almost certainly become more vulnerable to fear-based attacks as a result.

I did the same. It worked quite well even though my mother is a deeply trusting person who sees the good in everyone.

I tell her that if she ever has any doubt whatsoever that she’s to call me any time any where and I’ll help.

I also promised to cover any financial loss due to eg making a late payment because of my advice.

I've conditioned my parents to doubt every form of communication that comes to them, whether its a phone call, mailed invoice, or emailed. They'll take a picture and ask me before doing anything about it. Hopefully this practice continues as they age. Sure its a little more of a nuisance for me, but it also gives peace of mind that I'm helping in some small way.

I really think there should be a startup that integrates with Plaid pulling all bank transactions to build AI models for this.

I think real time alerts or daily summaries sent to trusted caretakers. Another layer is having the caretaker approve of the transactions. Can think of this as 2 factor authentication where they'd have to hack multiple phones or accounts for a successful scam.

For example, seeing multiple gift cards would be suspicious. Or if you know your parents never take out more than 100$ from the ATM.

Sometimes though they willingly scam themselves. My dad gave this real life scammer 30k in advance payment in return for future caregiving services. We told him she was scamming us and he didn't care. When she asked him for more money to buy a new car he finally realized she was truly scamming him.

This seems a great app to get access to via using a scam!

Is there any way with US banks to only allow transfers via in-person, at-the-bank requests? Some accounts just don't need the convenience of online access, and tired of the "identity theft" spiel from banks to absolve themselves of responsibility.

> How do you guys protect elderly parents?

I told my mother (who is 81) that the answer is always no. There is never an emergency, the answer is always no, she should hang up and then talk to me. Personally, if possible (we live 10 minutes apart) or at least on the phone. Any legitimate need for money can wait that long.

Fortunately, my mother has a somewhat technical background and her mind is 100% still there, so it hasn't ever been a real concern yet. She's skeptical by nature of what she sees online.

We have this sort of issue with my mother-in-law (90s). The best thing I did was setup a Chromebook (ChromeOS Flex) with just the basics (mail, photos, etc). From there, we routinely login to the GMail account and remove crap from her emails. It is tough - especially since the world is so on-line (photos of grandchildren, etc). Given the huge disparity between her age and technology, it is extremely important we act as her proxy for her online communications. Privacy be dammed.

Talk to your bank to see what additional layers of security they can offer for moving money around.

It could be as common as sending a pin to YOUR phone or that they actually call the bank to authorize it.

Some join accounts also require approval from both parties to transfer large amounts of money.

Additionally you can open a secondary account for your elderly relatives for daily expenses, they fund this account from their main account.

Anything you do, do it at the banking level, do not rely on your elderly relatives to doge pretty sophisticated scams.

We need a mechanism like a credit lock. The ability to block all transactions over $XX.00 until verified out of band. For a lot of these people, that would be only a few times per year and not a big headache. We need to give the CFPB more power.

How do you guys protect elderly parents? My parents and in-laws aren’t there yet but they all in the retired age group.

How do you protect your car from your teens crashing it? Don't give them the keys

Something I haven't seen mentioned is a DNS firewall to block phishing domains and newly registered domains. I use NextDNS for that and I'm sure there are others.

Call your governments, and apply pressure to force them to force the business community (telcos, banks, etc) to stop tolerating this and get serious about it.

My mom knows that if someone asks her for money outside of her normal bills, she texts me. This has worked well for us.

> How do you guys protect elderly parents? My parents and in-laws aren’t there yet but they all in the retired age group.

The ability to reason about money deteriorates with cognitive decline, in large part, I think, because it so abstract.

The solution is for them to not have direct access to control all their finances, but rather get monthly amounts via a trust. That way, downside is limited.

>rather get monthly amounts via a trust. That way, downside is limited.

Unless the trustee is a scammer, or worse, one of several adult children who don't agree on how finances should be managed.

Rigorous trust design is important. Firstly, you have to trust the trustees (so you "scammer" risk is irrelevant).

Secondly, it is typical to mitigate against a single trustee not acting in good faith by have an odd number of trustees.

>you have to trust the trustees (so you "scammer" risk is irrelevant).

So you are saying that if you trust the trustee, they can't be a scammer? I don't agree.

I don’t know whether you’ve ever established a trust (I have), but the whole point in selecting trustees is that you trust them. They’re not some random person who duped you into a scam.

They might break your trust (as the person who originated the trust) but that’s not the same as a scammer. A scammer is someone who who commits or participates in a fraudulent scheme or operation.

Reply on news.ycombinator.com