curious to hear from those much more well versed in this stuff than i am....

ive got an aging mother who im worred about getting easily tricked from some of these scam emails, calls, etc...and while i know you can't 100% protect yourself from anything, some of these security companies that claim to remove your information from all these sites have peaked my interest...

of course the only ones i hear about are advertised by certain youtube channels i consistently watch, the most common one i hear about is Ingogni (i know there's others just cant remember their name)....but im interested to hear from folks here....

1. generally speaking, are these companies good? do they accomplish what they claim?
2. cost wise are they all mostly the same or is there something to be said for cost vs results?
3. does anyone here have personal experience using them or is it feedback from things you've heard in the industry?

I am in the same situation and the only thing I've come up with is putting her under something like a conservatorship. My little brother would never go for it, so I know it won't happen.

I am glad she does very little online stuff and every time the local PD releases a report about someone getting tricked I send it to her in hopes she learns from someone else's mistakes.

Having gone through this twice, it is great you are thinking about it. But don't forget the phone! The predators know these are older folks and may not be tech savvy. They will call and text and scam them personally - both deceptively and aggressively. You really have to have the conversations with her. If you can swing it, I would recommend going as far as monitoring her financial accounts to watch for things.

My MiL passed last Fall. My wife was in charge of things and had her phone. She received over 40 texts and 40 calls most days from people trying to get money from this fixed income lady. We also found that she was "giving" over 250 a month of her limited income to various groups like this. Guess what the most common group was.....Political fund raising.

I received a phishing e-mail last night. It was some kind of invitation, but it didn't say to what. And it came from a couple I know who live about ten to fifteen miles out of town.

It looked like it was on the level until I went to the web site and clicked on the link (running LibreWolf in a separate container). The link wanted me to click on my e-mail provider and enter my username and password to receive the invitation.

From what I could find about it on-line, that scam commonly has an attachment they have to download to read the invitation. Sheesh!

I've been trying to get in touch with the couple since then. If I have to, I'll drive out to their house to talk to them.

As a minimum, their most urgent need is to start changing passwords to their on-line banking and credit cards, but from a different computer that is not compromised. And enable MFA. And contact the bank and make sure that their accounts are not being drained.

And they need to run every kind of legitimate malware and virus checker they can find.

If it were me, I would:
1) Have the bank create a new bank account for me and move my money to it.
2) Replace the operating system completely -- don't even try to save it.

Change a few passwords. My passwords tend to be quite solid passphrases and don't get reused.

This morning, I thought of an addition reason to use Password Managers that I hadn't thought of before. The password managers will provide your passwords to sites you visit, but they should never confuse a look-alike site with the real site. For example, if you have an account at americanexpress.com and some scammer sets up a page at americanexpres.com (one s) that perfectly mimics the real page, it might fool a lot of people, but not the password manager. For this reason, I'm going to start advocating Password Managers more than ever.

For what it's worth, I have never seen anyone express this idea anywhere. Perhaps they do and I just haven't seen it. To me, this may be the most important reason of all to use Password Managers.

Most scammers get their information from known data breaches and most of that information is already out there.

I've noticed somewhat fewer spam calls after signing up Incogni but I wasn't getting a lot to begin with.

My big problem is some old guy had my phone number before T-Mobile assigned it to me and I get daily spam for him. Not much I can do about it.

One thing that might help for some scams is:

1) Add a password manager to her computer/cell phone. ProtonPass is a good choice for reasons we'll see.

2) For her e-mail and other accounts that support passkey, enable passkey and save it.

ProtonPass can hold the passkeys. I haven't tried it from a cell phone, but on my workstation, I have the ProtonPass extension on LibreWolf and Vivaldi browsers. Whenever I log into anything with ProtonPass, the extension pops up for me to click on the account to log into. After clicking, it lets me in with no password required. It couldn't be simpler.

She can even log into TexAgs with PassKeys.

3) Use the password manager to create a ridiculously complex password for her accounts that have passkey. She will probably not need to use the passwords again.

4) If she receives a phishing e-mail wanting her username and password, she won't be able to provide it to the scammers. She might know her username, but with a long passphrase with 10 words, numbers, and special symbols, she would have to look it up and probably would have trouble letting them in.

---

I am new to passkeys, but what I've seen so far is encouraging.

I'm getting ready to check to see if my on-line banking uses passkey. If so, I will enable it.

Another possibility might be to get her a yubikey. She could use that to log in without using a password. There would still be passwords out there, but you should be able to help her if she ever needs the password again.

Be aware that not everyone uses passkeys. So far, I've only enabled them on TexAgs and on Gmail.

I don't know if the free ProtonPass plan handles multiple devices. If not, the paid plan will synchronize between them and make life easier for you.

The Proton Authenticator is great, too. You could set that on her accounts that handle outside authenticators and put it on your account. You would have to experiment with it, but with the ProtonPass storing the passkeys, it probably won't need to doe the MFA using Proton Authentication on those accounts. For an attacker to get in, he would need her to get the MFA code and give it to them for them to log in to those accounts.

Unfortunately, some people are willing to hand out the code if asked. Scammers are very good at convincing people that they are security trying to save them from attackers. What you could possibly get by with is to put the Authenticator on your cell phone, not hers. If a scammer called her, she wouldn't be able to give them the code.

By the way, if you want a paid Proton account for her, you can use my referral code, https://pr.tn/ref/AZ0CPNEP , to sign up. It will give both you and me a $20 credit.

If she doesn't do on-line banking, you might want to set up an on-line account for her in order to black scammers from setting up an on-line account "for her" and taking control of her bank accounts. I don't need on-line banking but I set up an on-line account just to be sure that it's my account and not some scammer setting it up without my knowledge. Give it a long passphrase and she won't be able to give the account to scammers.

In other words, if you can act as her gatekeeper for some of these issues, you could potentially save her a great deal of financial issues.

After some thought, I came up with something that needs to be addressed by everyone with an account that handles passkeys whether they use it or not.

If an attacker gets into the account, for example into gmail, they can add a passkey for themselves and would have access to the account even if the user changes the passwords.

It looks to me like we should be checking every account we have that uses passkeys maybe once a month or more often to be sure that there are no unauthorized passkeys. And that applies whether or not you use passkeys.