Scams succeed by creating urgency, so you act before you'd normally stop and think. A handful of habits, most of them free and none of them complicated, block the overwhelming majority of attempts.
Use difficult, unique passwords
A long, random password for every account, never reused, is the single biggest thing standing between a data breach at one company and someone getting into your accounts everywhere else. A password manager makes this realistic, since you only have to remember one master password.
Turn on multi-factor authentication (MFA)
A second step, like a code sent to your phone or generated by an app, required in addition to your password. Turn it on for email, banking, and investment accounts especially: even if a password leaks, MFA generally stops someone from actually getting in.
Don't click links in texts or emails you don't recognize
The most common way accounts get compromised. If a message claims to be your bank, the IRS, a delivery service, or Social Security and asks you to click a link or call a number, don't use anything in that message. Go directly to the official app or website yourself, or call the number printed on your card or a past statement.
Verify before you trust an urgent request
Scammers rely on urgency and pressure to skip the step where you'd normally double-check. If someone contacts you asking for money, gift cards, wire transfers, or account information right now, pause and verify through a separate channel you already know is real before doing anything.
Protecting older family members
Older adults are disproportionately targeted, in part because scammers assume, sometimes correctly, less familiarity with common tactics and more accumulated savings to go after.
- Check in regularly. Routine contact makes it easier to notice when something feels off, and gives an elderly relative a trusted person to run a suspicious request by before acting.
- Talk about scams openly, before one happens. Knowing the family password, and knowing that legitimate callers never demand gift cards or wire transfers, is far more useful in the moment than learning about it after money is already gone.
- Consider a trusted contact on financial accounts. Many banks and brokerages let you name a trusted contact the institution can reach if they notice signs of possible fraud or cognitive decline on the account, without giving that person any actual access or control.
- Watch for warning signs. Unusual withdrawals, new "friends" or online relationships asking for money, secrecy about finances, or sudden changes to a will or beneficiary designations are all worth a closer look.
Common scam types
Phishing. A fake email or text designed to look like a real company, bank, or government agency, aiming to get you to click a link or hand over login details.
Imposter scams. Someone posing as the IRS, Social Security, a tech support agent, or even a family member, using urgency and fear to get you to act fast.
Romance scams. A relationship built, often for months, purely online, that eventually leads to requests for money, typically framed as an emergency.
Investment scams. Promises of guaranteed or unusually high returns, often involving pressure to act immediately. See the FAQ's list of investments worth extra caution.
If you've been targeted
The Federal Trade Commission's official fraud reporting site.
For reporting online and internet-based fraud specifically.
If financial accounts or personal information may have been exposed, see Protecting Your Credit for how a credit freeze can help.