Ask HN: How do you protect your parents from tech scammers?

[nilsb]

My dad recently received a call from “Windows support”. He figured out it was a scam call and so luckily no further harm came from it. However, how do you protect your parents from similar tech scams - short of locking down their computers with parental controls?

[thrownaway954]

simple... they call me first.

if there is one thing i have _never_ done to my parents, or _anyone_ for that matter, is make fun of them if they call me and ask me for my professional opinion in tech matters. this has extended to situations when they think the situation is shoddy like they are being taken in a scam. i think _this_ is the single reason why my parents have never fell victim to scams. i feel that _most_ parents, or elderly people for that matter, fall victim cause they feel pressure from both ends... the first being the scammers themselves, the second being scared to ask _anyone_ if the situation is legit for fear of being made fun of.

_noone_ should feel scared of being ridicule when asking any question regarding their safety or well-being.

[dpcan]

It's all good until they don't realize the thing that is happening is something they should call about.

You'll sit down to talk to your parents someday and the damage will already be done.

The scammers are fast. They are good. They are like vultures hovering over the elderly. Our parents don't see this stuff coming, and they comply too quickly.

My wife administers a nursing home and this is a daily problem. Their residents get calls from scammers constantly and they have to stop little old men and women from walking out of the building to catch a bus to go to the bank to send money to one scammer after another.

They are always telling them, no, the medicare office does not want you to put all your money in a government bank account for them to make deposits to - those are scammer accounts. No, a nephew you never heard about does NOT need to be bailed out of jail. No, you do not have to buy a pre-paid visa card over the phone in order to pay for medications. No, you never have to purchase a coupon for $50 that will save you $100 at the store, those don't exist. It goes on and on and on and on.

[jobigoud]

> simple... they call me first.

This… seems a bit naive to think your parents will call you first every single time they want to do something special with their computer. It makes me think of parents that assume their teenagers aren't doing anything stupid because they are confident the kids are sharing everything with them.

Anectode: My in-laws are renting their property through Internet. They occasionally receive calls by interested renters and they successfully manage it by themselves. They are almost in their 70's. One day someone had a payment issue and asked to pay them differently, asking for account information so they could send the money directly. They managed to trick them into putting their card number on a fake website displaying the agreed-upon amount. They lost about 100€, the bank couldn't revert the transaction for some reason.

Parents only call you when they are unsure of something. The problem is when the scammer manage to convince them everything is normal, which is exactly what they are good at.

[Finnucane]

Same here. My 79-yr-old mother is far from sophisticated about tech stuff but understands the basic idea of scams, and is naturally inclined to assume people are out to get something from her. So when she gets suspicious calls or letters (she doesn’t follow her email that closely), she calls me. Sometimes she will try to engage with the scammers, which I’ve tried to tell here is counter-productive.

[stcredzero]

_noone_ should feel scared of being ridicule when asking any question regarding their safety or well-being.

In 2020, does this mean anything online anymore? Or does it mean more than ever? I've gotten to the point where a -50 karma is just a momentary annoyance, and I just think of it as "imaginary Internet points."

I could see how a kid who was conditioned to see their self-value in karma or views might take it hard. I've certainly been in that boat. Has there been a peak, then decline in online social media cynicism, like there was with child computer literacy? (Went up, peaked, then went down.) (Thankfully, my parents have always been extreme social media cynics.)

[cmg]

This is how I approach it at work (a non-profit where we deal with sensitive data). Every new employee and volunteer goes through a 30-minute training webinar on security when they start: spotting phishing emails, choosing good passwords, 2FA etc.

At the end, I tell them that if something just feels off, even if they can't figure out why, I'd rather they call or message me on Slack than ignore it. It absolutely never bothers me when they do it - in fact, it makes me feel better. Maybe 1% of reports are actual issues, but I'd rather deal with 99% false positives than miss even one thing.

[sheepstrat]

I think this is the key. As a kid, I remember family member of mine would routinely take their computer into friends at their company's IT department (their personal computer, mind you) because they felt less embarrassed asking a coworker for help than their kids. I try to make sure my parents don't feel awkward or embarrassed for asking me with tech help.

[Ntrails]

> i feel that _most_ parents, or elderly people for that matter, fall victim cause they feel pressure from both ends... the first being the scammers themselves, the second being scared to ask _anyone_ if the situation is legit for fear of being made fun of.

A friends parent got done by a phone scam. "Your router has been compromised, please let us check your PC, oh no they've got the computer, install this. Oh no - they've hacked your bank account and used it to Launder money, the fraud office will contact you. etc etc. The bank saved them when they tried to move a second load of money.

I don't believe for a moment they didn't contact anyone because of a fear of being laughed at - they believed the narrative that this was a secret operation. Ironically it had all the hallmarks of a classic eve online scam.

Do not assume all scammers are mediocre and transparent. Do not assume a close personal relationship is enough.

[pugworthy]

This is not the best advice when your 90 year old father loves using his Mac and iPhone, and is constantly "fixing" things when something "didn't work"

[takeda]

Scammers have ways around that as well. My father called me once asking about malware, he also mentioned that they actually placed a timer, applying pressure that he supposed to respond within 2 minutes. There are a lot of tricks those scammers are using.

[philliphaydon]

^ This.

My parents ring me if they get an odd popup on a webpage to double check if they should ignore it or not. If someone calls them telling them there's something wrong they politely tell the person they will ask me to look at it and politely end the call. And if they purchase stuff off a new website they check with me before they make any purchase so they don't pass their credit card to a dodgy site.

It's better they call and ask me than take a risk, last thing I want to happen is my parents to fall victim to a scam.

[datashow]

Good point.

What if the scammer plot "do not call your kids" into their scheme?

[mattferderer]

1. Give them a very locked down by default device like an iPad if possible.

2. Set their phone to send everything to voicemail that isn't a contact. Many scams don't leave one & if they do it can be discussed with appropriate people first.

3. Install a browser like Brave or extensions that block most garbage on the internet.

4. Setup their important files & pictures to be backed up automatically to one or more cloud services.

5. Not related to tech scammers, but more the ransom scammers or your grandchild needs money scammers - Always have some type of secret agreed upon phrases or questions that no one would ever know or be able to find out. Even better, make it a question someone could easily search for but have a ridiculous answer that is an inside joke between the two of you.

6. (Geek Bonus) - Enjoy watching social engineering videos together! They're entertaining, informative & I personally think more enjoyable than most of the stuff that passes for movies, sports & TV shows. Ok, this last one is probably not for everyone.

[beefield]

> Enjoy watching social engineering videos together! They're entertaining, informative & I personally think more enjoyable than most of the stuff that passes for movies, sports & TV shows.

Do you have any recommended playlists? Did not know that is a thing, might be fun to check.

[zelienople]

Not really by design, but I have a brilliant method! My mom still has only a land line, and the cord is too short to reach the computer.

She got a fake virus alert on some skeezy website, and she immediately called the number, without checking with me.

They tried to talk her through enabling remote access so they could get in and do whatever horrible thing they intended, but they had to get her to identify her IP address and type a few commands first.

She tried going back and forth from the telephone to the computer in another room, and the scammer finally got angry and screamed at her, "can't you borrow a cellphone from one of your neighbours?" When she told him she couldn't, the man just hurled obscenities and hung up.

These guys really depend upon you being able to talk to them while typing and clicking.

[joegahona]

Sadly, this happened to my father last year, and they were successful charging his debit card $300. He did not give them his PIN, which they requested (he couldn't remember it). I called Wells Fargo and they were great about just nuking the charge. Had to get a new card, of course, and I immediately made him stop using a PC. I got him a iPad mini, which hopefully helps with those fake "you have a virus" alerts.

[Scoundreller]

I need a VoIP service that changes my voice to a grandma/pa.

They always catch on too fast with me when I pull these stunts :(

[kstenerud]

Teach them this simple heuristic:

No tech company these days will ever call a customer, especially not Microsoft.

If you do receive a call from a more traditional institution like a bank, don't divulge any information. All banks have strong identity theft protections in place, but you haven't authenticated the caller. Ask for a reference id so that you can call the company back using a phone number that you yourself looked up on their company web page.

If the caller has any reason not to comply (and they will have plenty of reasons why they can't), or they insist you use a number that they provide, hang up and forget about it.

[dazc]

'If you do receive a call from a more traditional institution like a bank, don't divulge any information.'

The problem with this, in the UK at least, is that banks do call and ask for personal info such as date of birth, etc. The irony always seems lost on them when you refuse to give it.

[oefrha]

Actually some tech companies do call; at least Dell (well I guess you could argue it’s not a tech company) did cold call me to try to sell overpriced extended warranty on their shitty tower. Probably legit since apparently loads of people get this sort of calls, plus they don’t actually ask for service tag or personal info and you can pay on dell.com so rather pointless as a scam.

[wallflower]

My parents are both very intelligent. My mom (a PhD) actually fell for one of those pop-ups that warn your computer is infected. It took many phone calls to reverse the automated charges...

That being said, getting my parents from Windows to Mac was to biggest ROI. Before, with Windows and even Malware Bytes Anti-Malware, I had to literally drive home hours for emergency tech support.

However, I’ve educated them against popup clicking now so much that they pointedly ignore Mac update popup notifications. Oh well, it is what it is. And what it is is much better now in Mac land.

[epc]

Dealing with this with an elderly family member.

We've moved them to all Apple devices. Locked down everything (the account on the Mac is "standard" not Administrator level). Set up a G Suite account with restricted access (cannot install apps, cannot install extensions into Chrome). Use 1Password for passwords, 2FA for all accounts that allow it. Removed Flash early on, removed Java runtime. Turned off auto–update on the Mac and iPhone/iPad.

I initially tried parental controls on the Mac but found it was a nightmare for even their limited use of apps outside of Chrome.

Still after 10+ years of “training” this person to call me for any technical issues I get surprises like yesterday when they wanted to install an “ad blocker that keeps popping up in Chrome”, which was, of course, malware.

Probably will ditch the Mac and switch to a Chromebook later this year.

[mbreedlove]

> Turned off auto–update on the Mac and iPhone/iPad.

Why? I would have done the opposite.

[sairamkunala]

I would suggest using a pi hole on top of this setup.

[sjg007]

I would install logmein or some remote access program that helps. Also helps to buy them a router with a cloud stored configuration. I mean that opens up some issues but all in all saves a lot of time.

[MisterTea]

Education. Whenever I'm talking to my mother about tech I make it as simple and relatable as possible. I drill in a few things:

Passwords are as private as the most embarrassing thing you can imagine. Never give them out to anyone. Ever.

No financial institution will randomly call you unless its a fraud alert. Even then, ask to call back and then call the company using their direct number to verify. Anyone trying to keep you on the line is suspect. You have a right to hang up at any time.

Treat your email address like your home address. Would you randomly give your home address to strangers?

Phone numbers are so easy to fake you could do it on your cell phone. Do not trust caller ID.

If in doubt call your children.

And I do get a lot of calls about everything but I'm glad my mother calls to verify instead of taking a chance. So many older parents stay in parental mode when their children are well into adulthood and tend to trust their judgement before their children's. That or they don't want to bother them or even admit they know less. Hubris and ignorance are the problem.

[CaptainMarvel]

It’s not enough to call the bank directly after a scam call - first phone someone else to ensure the line is actually closed.

[goldcd]

I don't think there is a magic bullet - and yes I have completely considered adding parental controls.

I think there's probably two prongs of attack. Helping them manage their IT and Scam prevention. Scam prevention covers cold calls "from your bank", random letters in the post, people knocking on the door etc. IT competence is supplementary and confidence here helps prevent the former. e.g. If you've installed every toolbar offered to your browser, then a) You shouldn't be in charge of a browser and b) Are more likely to need the help of MS when they call.

Things I've done, in no particular order:

Offered to be their IT support. If in doubt over anything, please call me first. I don't mind, it's how I can be helpful and show gratitude. If I've called them, I've normally got free time, so good time to ask if there's anything they want me to look at whilst I'm here.

Added their machines to my Google One Backup (or whatever your backup solution of choice is with an online family plan). I've tried leaving them with USB drives to plug in and local backup scheduled, but never seems to work out.

Accept some people shouldn't own a PC. Chromebook/ipad provide most of what they need and are relatively sheltered.

Push them towards online services for say email. Yes, they might be used to Thunderbird that you initially set them up with - but de-corrupting local storage, missing emails from that time they accidentally used POP, hooking in AV, anti-spam etc etc. Gmail (or your provider of preference) handles that for you (and you can just use thunderbird with that if you insist - and it will grab mails from that ISP account you mysteriously are attached to).

Education. Quite surprisingly my PC-cautious relative (never messes up, but refuses to embrace) decided to take a "Computer Driving License" course. I was slightly disparaging to be honest, but she found it interesting - and started realizing what she could do. e.g. Address book previously a txt file (kept on a USB stick for security, naturally), made the switch to Excel and mail-merged the envelopes for the Christmas letter.

[lksaar]

I switched my grandparents PC to linux, Ubuntu in particular. It covers everything they want to do (light web browsing, some text processing, printing, transfering images from their phone/camera to the PC). Has been working great for 3yrs now.

I've also noticed that installing adblock helps, since there's less shady stuff to click.

[theandrewbailey]

I've had my parent's PC on Linux for almost 10 years (mostly Xubuntu, was on Mint for a bit). I initially expected to reinstall Windows after a few months, but it worked pretty well. I told them that it looks and works[0] like Windows, and they were off.

[0] As for as using the GUI is concerned. Normal people don't care about the internal workings of their technology.

[samueloph]

this proved to be very effective in my case as well, a gnu\linux distribution + ublock origin.

[tyri_kai_psomi]

Two things:

- I buy them Apple devices. n=4 here, but it really seems when my family (mom, father-in-law, mother-in-law, and older brother who is borderline tech illiterate) made the switch from Android to iOS devices or even PC to Mac, they just had less of an issue with this. It's anecdotal, I am not a diehard Apple fanboy, but take it for what it is.

- I tell them to always close any and all popups. Point blank, carte blanche, doesn't matter how sincere it seems, or if it even is legitimate, just close it. If there's something she ends up not being able to do eventually she just calls me.

[obarthelemy]

First thing I did when I set them up w/ a PC years ago is send them an email from our President with obfuscated links to something absurd. These brought home the dual points if never trusting the sender's identity and never clicking links. There's be more to it but that's 80% right there.

[admay]

My dad is good with computers and has a great online-bullshit radar. My mom and aunt are god awful though. My aunt fell for a 'virus scan' scam recently and the fallout was kind of rough to deal with. Full backup of photos & docs, new passwords, and a full factory reset of the computer. Not a fun weekend for her.

My rules for them: 1. If someone calls you from the bank, hang up and call them back from their phone number listed on their website. 2. If a pop-up comes up warning for viruses, call me immediately. 3. If a pop-up comes up warning about governments coming for you, call me immediately. 4. No one on Earth is going to try to give you money for free online.

I've had to answer plenty of calls about online bullshit, but I prefer that than having to try to deal with the Bank after they get scammed.

[alex-wallish]

I recently came across a product that tries to solve exactly this. For $15 a month they give seniors a "personal secretary" who screens calls from unknown numbers.

Recently featured on ProductHunt: https://www.producthunt.com/posts/phonescreen

Their website: https://www.phonescreen.co

[ryanmercer]

Unfortunately my mother trained herself mostly (I do block a bunch of stuff at a DNS level though on her PC), she lives with me and umpteen times a week:

"Can you come here the computer/phone/ipad is saying something, have I been hacked"

- no, it's telling you that you have an email, no it's telling you that you are getting a call, no that's your other son asking you a question...

"How do I save something again"

- you've been working with computers longer than I've been alive... click the save button "where" the disk "where" or go to file save "where is file" points "I don't see it" my finger is touching it!!!

- Are you ^(!@#$@ kidding me

- Look at your paper, you've written this down three times

"How do I save something to my zip disk"

- You don't have a zip disk, you have a usb drive or a thumb drive, you've never had a zip disk, I've never had a zip disk, zip disks were stupid and still are and I don't understand why Amazon has them for sale for so much!

"can you print this for me at work"

- no, I've told you this 37 times, go to FedEx office with your usb drive, I'm not printing 173 pages of whatever that is and risk getting fired

I promise you, it's all a con. There's no way she doesn't know exactly what she's doing and just likes messing with me. I've showed her how to turn the volume up and down on her iPhone at least 100 times. You've got 3 buttons, figure it out mom! I swear I'm going to have a stroke or a heart attack one of these days while showing her how to do something for the 97th time.

My brother on the other hand... when he still lived close it felt like every other week I was reinstalling windows for him. He'd torrent everything, click any link, open ever attachment... eventually I just blocked obscene numbers of domains and ran him through a 'family safe' DNS filter. I don't know what he does now, I guess his teenage step son has to suffer through helping him.

[archie2]

It's pretty bad in Canada - you get really convincing scammers pretending to be our taxation agency pushing you to pay back taxes in iTunes Giftcards.

This is an obvious scam, but for people who aren't up on this and fearful of "the man" I expect these kinds of scams work for every 1 in 100k people at best and are still probably lucrative enough for them to keep going.

The answer for the OP problem and the Canadian problem are the same: the government never calls you, Microsoft never calls you, no tech company will ever call you.

[i_dont_know_]

Also want to ask if anyone has a 'parents' Linux setup that has worked well over the years... I tried once maybe 8 years ago and had to figure out how to walk my mom through a kernel panic through the phone... didn't work well :)

[snu]

My parents have been running Zorin OS lite for a couple years now, they have not had any problems with it. It's based on ubuntu and the lite version has xfce as the desktop. Runs great on their older computer, looks enough like windows that they jumped in without any issues, and it has a pretty basic interface.

[Pete_D]

My non-technical parents have been Mint for years with minimal problems. One thing that makes life easier is that they were okay with me enabling sshd for the cases when they want me to investigate something for them.

(An incidental benefit of a Linux household - the calls from "Microsoft" become a lot funnier and less scary.)

[8589934591]

I have setup xubuntu for my parents to look similar to windows. No sudo access, no password default login on boot. Firefox/Chrome with ublock origin. Virtualbox with win10 is installed for Office. If at all anything happens I do a remote login and check/fix things. Works well so far.

[nestorD]

I installed ubuntu for my grand father and, two years later, has not had any problem (whereas it took less than a week before he asked my do uninstall the adblocker I gave him...).

[wozniacki]

Have you - in later years - figured which distro if any, was the easiest and hassle-free, for older people in general (if not your parents specifically)?

[Unklejoe]

My mom has been using Ubuntu MATE for a few years and doesn't even know it. I just put a Firefox icon on the desktop and it was basically the same as any other computer for her.

[cookieswumchorr]

How would a BSOD be different in this scenario?

[Heyso]

I am surprised no one mentioned AdBlock yet. Often you contract an virus/adware/... through and ad, especially when the ad is confused with a feature of the website. I use noscripts also, but that is not for non tech peoples. Apart from that I don't know, maybe, do not give them admin rights on the computer?

[uka]

Since I gave my dad a Chromebook instead of a Windows machine - I have no problems at all. It is very hard for the tech support scammers to make him install anything on it.

[logfromblammo]

AARP Fraud Watch

https://www.aarp.org/money/scams-fraud/

877-908-3360

AARP puts serious resources into scam prevention. Print the hotline number and tape it up next to their screens and/or land-line phones.

[reedf1]

I've convinced many of my loved ones to get two-factor authentication on at least their primary e-mail addresses and to treat everything as something that can be compromised e.g. don't make any of your bank accounts front facing that have any more money in them then you are willing to lose.

Obviously this doesn't protect them against the complete set of problems but it is quick to implement and keeps me from being the personal security manager of those I care about.

At the end of the day if someone is running a sophisticated phishing scam some savvy people are going to fall for it - I think the name of the game is damage mitigation not prevention. As long as you can mitigate people from losing a life changing amount of money I think you've won here.