You check your phone and there's a message from your mum: "I think I've done something silly." Your stomach drops. She clicked a link in a text from "Australia Post," entered her card details, and now there are charges she doesn't recognise. She's embarrassed. She waited two days to tell you because she felt ashamed.

If this sounds familiar, you're not alone. Every week, families across Australia have this exact conversation. And the hardest part isn't fixing the damage — it's the guilt of wishing you'd helped set things up sooner.

This guide is for you. The son, the daughter, the grandchild, the niece. The person who knows their parent or grandparent is vulnerable online but doesn't know where to start — or how to bring it up without making them feel incapable.

$120M+
Lost by Australians aged 65+ to scams in a single year
ACCC Scamwatch — and the real figure is far higher because most go unreported

Why Older Australians Are Targeted

Scammers are not random. They deliberately target older people because the economics work in their favour. Understanding why helps you understand what to protect against.

  • Trust as a default setting. Many older Australians grew up in an era where a phone call from an organisation meant it was real. They answer unknown numbers. They believe the person on the other end is who they say they are. This isn't naivety — it's a generational norm that scammers ruthlessly exploit.
  • Less familiarity with evolving digital threats. Your parents might use email, online banking, and Facebook every day — but they may not recognise a spoofed URL, a phishing SMS, or a fake login page. The technology changes faster than anyone can keep up with, and scammers are always one step ahead.
  • More savings and assets. Older Australians are more likely to have superannuation payouts, property equity, and accessible savings. Scammers know the payoff is higher.
  • Shame prevents reporting. This is the one that breaks your heart. Many older people who get scammed never tell anyone — not the police, not Scamwatch, not their own family. They feel stupid. They feel like a burden. So they absorb the loss in silence, which means the scammer faces no consequences and moves on to the next victim.
  • Social isolation. Loneliness makes people more vulnerable to romance scams, fake customer service calls, and anyone who shows them sustained attention. A scammer who calls twice a week may be the most consistent voice in someone's life.

Your parents aren't falling for scams because they're not smart. They're falling for scams because these scams are specifically engineered to exploit people exactly like them.

The Top Scams Targeting Older Australians

High risk

1. NBN / Telstra Impersonation

A call comes in: "This is Telstra. We've detected a problem with your internet connection and need to fix it remotely." They ask your parent to install remote access software like AnyDesk or TeamViewer. Once installed, the scammer has full control of the computer — they can see banking passwords, transfer funds, install malware, and access personal files.

Variations include NBN Co warning about a disconnection, or Optus offering a refund that requires "verification." The caller is patient, polite, and sounds completely legitimate.

Tell your parents: Telstra, NBN Co, and Optus will never call and ask you to install software or give them remote access to your computer. Ever.

High risk

2. ATO / myGov Fakes

A text message or email arrives claiming to be from myGov or the ATO. "You have an outstanding tax debt." "Your Medicare payment is ready — click here to claim." "Your myGov account has been locked." The link leads to a perfect replica of the myGov login page. Your parent enters their credentials, and the scammer now has access to their tax records, Medicare, Centrelink, and more.

Tell your parents: The ATO will never send you a text message with a link. If you get one, delete it. If you're worried, log into myGov directly by typing the address into your browser.

High risk

3. Grandparent Scams (AI Voice Cloning)

This is the cruelest one. Your parent gets a call and hears what sounds exactly like their grandchild's voice, crying, saying they've been arrested or in a car accident and need bail money immediately. "Please don't tell Mum and Dad." The voice is an AI-generated clone, built from a few seconds of audio scraped from social media.

The emotional manipulation is devastating. A grandparent hearing their grandchild in distress will do almost anything to help. Some versions include a fake police officer or lawyer who takes over the call to add authority and provide bank details.

Tell your parents: If someone calls claiming to be family and asks for money, hang up and call that person directly on their normal number. Always verify. A real emergency can wait 60 seconds.

Rising threat

4. Romance Scams

These don't start with a request for money. They start with companionship. A charming person on Facebook, a dating site, or even Words With Friends strikes up a conversation. Over weeks or months they build a deep emotional bond — daily messages, phone calls, future plans. Then gradually, the requests begin. A medical emergency. A business problem. Funds needed to book a flight to finally meet.

AI chatbots have made this scalable. A single scammer can now run dozens of simultaneous romance scams, each one personalised and emotionally convincing, available around the clock.

Tell your parents: If someone you've never met in person asks you for money, it's a scam. No exceptions. Real love never starts with a bank transfer.

High risk

5. Tech Support Scams

A pop-up appears on the computer: "YOUR COMPUTER HAS BEEN INFECTED. CALL THIS NUMBER IMMEDIATELY." Or the phone rings and someone claims to be from Microsoft, Apple, or their antivirus provider. They say the computer is sending out viruses and needs to be fixed urgently.

They talk your parent through installing remote access software, then "show" them fake evidence of viruses. The fix? A payment of $200–$800, during which they also install actual malware and harvest banking credentials.

Tell your parents: Microsoft and Apple will never call you. Pop-ups telling you to call a number are always scams. Close the browser. If it won't close, hold the power button.

Rising threat

6. Investment Scams

Slick websites promoting cryptocurrency, AI trading platforms, or property investments with guaranteed high returns. They often use deepfake celebrity endorsements — fake videos of well-known Australians recommending the platform. Your parent invests a small amount, sees impressive "returns" on a fake dashboard, invests more, and then can't withdraw.

Tell your parents: If someone promises guaranteed returns, it's a scam. Always check ASIC's MoneySmart investor alert list before investing in anything.

Rising threat

7. Facebook Marketplace Scams

Your parent lists something for sale. A buyer immediately offers to pay via a link, a QR code, or a "PayID verification" that's actually a phishing page. Or they're buying — they pay for an item that never arrives from a seller with a fake profile. Gift card payment requests, shipping fee scams, and overpayment tricks are all common.

Tell your parents: Only accept cash for local pickups. Never click payment links sent by strangers. If a buyer sends you a link, it's a scam.

7 Things to Set Up on Their Devices This Weekend

You don't need to be a tech expert to do these. Each one takes five minutes or less, and together they create a genuine safety net. Sit down with your parent, do them together, and explain each one as you go.

  1. Enable two-factor authentication (2FA) on their email — Email is the master key. If a scammer gets into your parent's email, they can reset passwords on banking, myGov, and everything else. Set up 2FA so that logging in requires both the password and a code sent to their phone. On Gmail, go to Security settings. On Outlook, go to Account > Security. This single step blocks the majority of account takeovers.
  2. Install an ad blocker in their browser — Many scams start with malicious ads — fake virus warnings, fake giveaways, fake tech support pop-ups. Install uBlock Origin (free, trusted, open-source) in Chrome, Firefox, or Edge. This dramatically reduces the chance of them clicking something dangerous while browsing normally.
  3. Silence unknown callers on their phone — On iPhone: Settings > Phone > Silence Unknown Callers. On Android: Settings > Phone > Caller ID & spam > Filter spam calls. This sends calls from numbers not in their contacts straight to voicemail. Legitimate callers leave a message. Scammers don't. This alone stops most phone scams cold.
  4. Bookmark Scamwatch and their bank — Open their browser and bookmark scamwatch.gov.au and their bank's real website on the bookmarks bar where they can see it. Tell them: "If you ever get a suspicious message, check Scamwatch first." Give them a single, reliable place to verify before they act.
  5. Agree on a family code word — Pick a word that only your family knows. Something unrelated to your lives — "pineapple," "thunderbolt," anything memorable. The rule: if anyone calls claiming to be a family member in an emergency, the first question is "What's the code word?" An AI voice clone can sound like your child, but it can't know a word that's never been spoken publicly. Review and update the word every year.
  6. Turn on automatic updates — Outdated software is full of security holes that scammers exploit. On iPhone: Settings > General > Software Update > Automatic Updates (on). On Android: Settings > System > System Update. On Windows: Settings > Update & Security > turn on automatic updates. On Mac: System Settings > General > Software Update > Automatic Updates. This ensures their devices patch vulnerabilities without them needing to remember.
  7. Help them write passwords in a physical notebook — This sounds counterintuitive, but for many older people, a password manager is one more piece of confusing software. A small notebook kept in a locked drawer at home is far better than reusing the same password everywhere or writing them on sticky notes on the monitor. Help them create unique passwords for their most important accounts (email, banking, myGov) and write them down properly. A burglar is not their biggest threat — password reuse is.

Do these together, not for them. If you take their device into the other room and come back with everything "fixed," they won't understand what changed or why. Sit beside them. Show them each screen. Let them tap the buttons. They'll remember it better and feel respected in the process.

How to Have the Conversation Without Being Condescending

This is the part most people get wrong. You sit down with good intentions and it comes out as: "Mum, you need to stop clicking on things." And now your mum feels like a child being told off, shuts down, and nothing changes.

The conversation matters as much as the technology. Here's how to get it right.

Start with a story, not a lecture "I saw this story about a woman on the Central Coast who lost $40,000 to someone pretending to be from Telstra. It made me think about you and Dad, and I just want to make sure you're set up properly." Leading with someone else's experience removes the implication that they've done something wrong.
Normalise it by including yourself "I almost fell for a dodgy text last week — it looked exactly like it was from Australia Post." When you show that even you are targeted, it stops being about their competence and starts being about how good the scammers are.
Position yourself as a partner, not an authority "Can we sit down together on Saturday and go through your phone settings? I want to make sure we're both set up properly." The word "we" matters. You're not fixing them. You're doing this together.
Give them a simple rule, not a complex system "If anyone asks you for money, access to your computer, or personal details — just hang up and call me first. That's it. You'll never get in trouble for checking with me." One rule they can remember is worth more than ten they'll forget.
Respect their independence The goal is awareness, not control. Don't take away their ability to use technology. Don't make them feel like they need permission to answer the phone. Empower them to pause and verify — that's all it takes.

The best time to have this conversation is before anything happens. The second best time is right now.

What to Do If They've Already Been Scammed

If your parent tells you they think they've been scammed — or you discover it yourself — here's the exact order of operations. Speed matters, but staying calm matters more. They're already scared. They need you to be steady.

  1. Contact their bank immediately — Call the fraud department (the number on the back of their card). Ask them to freeze the account and reverse any recent suspicious transactions. If money was transferred, the bank may be able to recover it if you act within hours. Stay on the line until it's done.
  2. Change their email password first — If a scammer has access to their email, they can intercept bank reset emails and lock your parent out of everything. Change the email password immediately and enable 2FA. Then change banking, myGov, and social media passwords.
  3. Report to Scamwatch — File a report at scamwatch.gov.au. This helps the ACCC track and disrupt scam networks. Your report protects others.
  4. Contact IDCARE if identity documents were shared — If your parent shared their driver's licence, Medicare card, passport, or TFN, call IDCARE on 1800 595 160. They're Australia's national identity and cyber support service. They'll tell you exactly which documents to replace and how to set up credit monitoring.
  5. Get the device professionally checked — If they installed remote access software, clicked a suspicious link, or downloaded anything, their device likely has malware running in the background — keyloggers, screen recorders, or banking trojans. A factory reset or professional malware removal is essential, not optional.
  6. Report to police via ReportCyber — For significant financial losses, file a report at cyber.gov.au/report. This goes to the Australian Cyber Security Centre and can trigger formal investigations.

The Emotional Side — Shame, Support, Not Blame

Here's what nobody talks about enough: the emotional damage of being scammed often hurts more than the financial loss.

Your parent may feel stupid, humiliated, and angry at themselves. They may withdraw. They may stop using their computer or phone entirely out of fear. They may not tell you about it for weeks, months, or ever — because admitting they were fooled feels like admitting they're losing their faculties.

This is where you have to be very careful with your words.

Don't say: "How could you fall for that?" or "I told you to be careful" or "You should have known better."

Do say: "These scams are designed to fool people. Smart people get caught every day. I'm just glad you told me so we can fix it together."

The single most important thing you can do after a scam is make sure your parent knows that telling you was the right decision. Because if they feel punished for telling you, they won't tell you next time. And next time will be worse.

Professional scammers spend their entire working day figuring out how to manipulate people. They test scripts, they refine techniques, they exploit psychology that has been studied for decades. Being deceived by a professional doesn't make your parent foolish. It makes them human.

If your parent has been scammed, they may benefit from talking to someone beyond the family. Lifeline (13 11 14) and Beyond Blue (1300 22 4636) both offer support for the emotional impacts of fraud, including the anxiety and depression that often follow.

External Resources

Scamwatch — ACCCReport scams, check current alerts, and access recovery advice IDCAREFree national identity and cyber support service — 1800 595 160 eSafety CommissionerOnline safety resources, reporting tools, and guides for seniors

Worried a device has been compromised?

If your parent clicked a suspicious link, installed remote access software, or had their accounts accessed — bring the device in. We'll remove malware, secure their accounts, check for keyloggers, and make sure nothing is still running in the background. We're patient, we explain everything, and we won't make anyone feel silly for asking.

Book a Security Checkup