My Parents Are Aging
Menu

Safety content

Your Parent's Account Was Hacked: The 60-Minute Response

Someone got into a parent's email, bank, or phone account. The next hour decides how bad this gets — here's the order of operations, and what to say so they tell you about the next one instead of hiding it.

Last reviewed: 2026-08-08 Freshness class: F3 (security practices change) Reading time: 7 minutes

The short version: lock the email first (it's the key to everything else), then the phone account (SIM-swap protection), then banks and cards. Change passwords on a different, trusted device, sign out of every session, and check for forwarding rules and saved payment methods. Then set up two-factor on the critical accounts and the family vault so it doesn't happen again. And lead the conversation with "this happens to good people every day" — not "how did this happen."

Why email first

Almost every account recovery system uses email: "forgot password" resets go there, bank alerts go there, and so do the verification codes for everything else. An attacker with the email account has a key to the whole house. That's why it's step one — not the bank.

The 60-minute sequence

  1. Use a device you trust. Not the compromised phone or computer — a different device (your laptop, a tablet, the library is acceptable in a pinch). If the parent's device had remote-access software installed, disconnect it from the internet until it's cleaned.
  2. Lock the email. Use "forgot password" on a trusted device to reset it, or the account-recovery flow. Change to a long, unique password. Sign out of all other sessions/devices (every major provider has a "sign out everywhere" option).
  3. Check for forwarding rules. Attackers quietly add rules that forward copies of incoming mail to themselves — check settings for any forwarding address that isn't theirs, and delete it. Also check recovery phone/email and change them if tampered with.
  4. Lock the phone account. Call the carrier and ask for SIM-swap protection (most carriers add a PIN or passcode requirement). If the phone lost service suddenly, that's the SIM-swap signature — escalate immediately.
  5. Banks and cards. Change the online banking password, then call the number on the back of the card (or visit a branch) and tell them the account was compromised. Ask what they see: new payees, transfers, changed contact info. Freeze cards if anything looks wrong.
  6. Credit freeze. If the attacker saw personal info (address, SSN, DOB), freeze credit at all three bureaus (Equifax, Experian, TransUnion) — free, and stops new accounts being opened in the parent's name. The FTC's credit freeze guidance walks through it.
  7. Change the important passwords. Email, bank, phone carrier, and anything with saved payment methods. The family vault guide has the full setup, but even just unique passwords on these four is a huge step up.
  8. Turn on two-factor for the email and bank — an authenticator app or a code sent to a number the attacker doesn't control. This is the single strongest defense going forward.

What to check in the following days

  • Sent mail and deleted items — attackers often use the account to send phishing from the parent's own address (to their contacts!). Warn contacts if you see that.
  • Saved payment methods — remove any card the parent doesn't recognize from shopping accounts.
  • Account contact info — confirm the recovery phone/email on each important account is the parent's, not the attacker's.
  • Statements for the next 2–3 months — small test charges sometimes come before the big ones.
  • The phone bill — new lines or device changes on a shared plan can mean the carrier account was used.

The conversation that matters most

How you react to the hack decides whether you hear about the next one. The research on older adults and fraud is consistent: shame hides the next attempt. Say these in order:

  1. "You did nothing wrong — you were targeted." Account hacks and scams are a numbers game, and older adults are deliberately over-represented in the targeting. It's not a character flaw.
  2. "Thank you for telling me." This is the sentence that saves the next account.
  3. "We're fixing it together, and here's the rule from now on." One rule: if a call or message asks for codes, money, or account info, hang up and call back on a number you looked up yourself. See the full playbook for the rest.

And if money was already moved — don't try to recover it alone. Follow the scam recovery guide, which covers the payment-channel-specific steps and reporting in order.

Prevent the next one

Sources & verification

This page follows the evidence hierarchy in our editorial policy, preferring government sources for security guidance. Reviewed 2026-08-08:

Found an error? Report it — we log and correct material mistakes publicly.