Home · Elder fraud
Almost every warning page about elder fraud is about strangers on the phone. The federal data says the largest losses come from the opposite direction — and it changes what actually protects your parent.
The Consumer Financial Protection Bureau analysed roughly 176,700 Suspicious Activity Reports filed by financial institutions on elder financial exploitation between April 2013 and December 2017. The average loss rises sharply with how close the suspect is to the victim.
| Who took it | Share involving a loss | Average loss |
|---|---|---|
| A stranger | 75% | $17,000 |
| Someone they know | 79% | $50,200 |
| A fiduciary — someone with legal authority over the money | 88% | $83,600 |
Nearly 80% of those reports involved a real monetary loss, and fewer than one-third — 28% — were reported by the filer to any law enforcement or state authority.
This is not an argument for suspecting your relatives. It is the plainest available argument for why a second set of eyes on the money matters more than another article about phone scams. A spam filter cannot see a power of attorney.
The FBI's Internet Crime Complaint Center and the Federal Trade Commission both publish annual losses for people aged 60 and over. They use different collection systems and different scopes, and both rely on people choosing to report. The result is a gap most consumer pages quietly resolve by picking one.
| Year | FBI IC3, ages 60+ | FTC, ages 60+ |
|---|---|---|
| 2024 | $4.885 billion | $2.4 billion |
| 2025 | $7.748 billion | not yet broken out by age |
Never add these together or average them. They are two measurements of an overlapping thing, not two halves of it. The Senate Special Committee on Aging's own 2025 publication uses the FBI figure, so a family reading a Senate document and an FTC document will see numbers that differ by roughly 2× and reasonably conclude somebody is lying. Nobody is; the systems are different.
The FTC is also candid that reported losses are the floor, not the total. Its own estimate of the true cost of fraud to older adults in 2024 runs between $10.1 billion and $81.5 billion — a range that wide is itself the finding.
This is the most useful and least known thing in the FTC's data. Older adults report losing money to fraud at a lower rate than younger adults, and report spotting and avoiding scams at a higher rate. What changes with age is not gullibility — it is what one loss does to you.
The practical consequence: awareness content is not the highest-value control. Friction on large and irreversible transfers is. Everything in the checklist below is friction.
On 28 April 2026 the Social Security Administration's Office of the Inspector General warned of a surge in imposter scams using real SSA and OIG employee names, fabricated badge images, and fraudulent social media profiles. Its guidance: do not trust caller ID — scammers can spoof government numbers.
The standard advice to ask for a name and badge number now works in the caller's favour: they have a real name and a convincing badge, and supplying them makes the call feel verified. The only safe move is to hang up and dial the agency on a number you looked up yourself. Never a number the caller gave you, and never a number from the caller ID.
One more thing worth knowing about where the contact comes from: for every age group except 80 and over, social media is now the top-loss contact method. For people 80 and over, the phone is still number one.
Every one of these is free, already law, and mostly unused. None of them requires buying anything. Each entry says plainly what it does not cover, because a protection people misunderstand is worse than none.
FINRA requires brokerage firms to ask for a "trusted contact person" on the account record. Most accounts have the field blank, because the rule also says the absence of one cannot stop the firm opening or maintaining the account. Nobody follows up, so nobody fills it in. Separately, FINRA Rule 2165 lets a firm freeze a disbursement for up to 15 business days when it reasonably believes an account holder aged 65 or over is being exploited — extendable by 10 more, and by a further 30 where it is reported to a regulator or court. The firm must notify the trusted contact within two business days.
These are one item, not two. Without a trusted contact on file, the hold has nobody to call. Adding the name is a five-minute phone call to the brokerage and it is the single highest-value thing on this page.
What it does not do: Rule 2165 is permissive, not mandatory — the firm may hold, it is not required to. It covers broker-dealers only, not bank accounts. And a trusted contact receives information; they gain no authority over the account.
Most states have adopted the NASAA Model Act to Protect Vulnerable Adults from Financial Exploitation. Where adopted, reporting is mandatory, not permissive: a qualified individual who reasonably believes exploitation may have occurred shall promptly notify Adult Protective Services and the state securities commissioner. Holds run 15 business days, plus 10 on agency request.
Adopted, by year: 2016 — AL, IN, VT, LA · 2017 — CO, MD, NM, ND, OR, TX, AR, MS, MT, TN · 2018 — AK, DE, KY, MN, UT · 2019 — ME, NH, AZ, CA, RI, VA · 2020 — FL, NJ, WV, OK, PR · 2021 — HI, IA, MI, NE, OH, SC · 2023 — CT, GA, WY · 2024 — KS · 2025 — ID. Washington, Missouri and Nevada adopted parts of it earlier.
Why it matters more than it sounds: it creates a second escalation channel that does not run through the institution stonewalling you. If the firm will not act, the state securities commissioner is a separate door.
The universal failure in a live incident is the bank saying we cannot discuss this account, we could be liable. Under 12 U.S.C. § 3423, trained employees of banks, credit unions, broker-dealers, advisers and insurers are immune from civil and administrative liability for good-faith disclosure of suspected exploitation to covered agencies — which expressly include law enforcement and adult protective services. The institution's immunity is conditioned on having trained the employee first, which gives it a strong reason to act.
In December 2024 the Federal Reserve, CFPB, FDIC, FinCEN, NCUA, OCC and state regulators jointly reinforced this, recommending institutions let account holders designate trusted contacts and noting that supervised institutions have used transaction holds and disbursement delays to prevent losses. Ask for the BSA/AML or fraud team by name. The branch counter cannot help you; that team can.
What it does not do: the immunity protects the institution's disclosure to agencies. It does not create a family member's right to see the account.
Free by federal law. Placed within one business day of a phone or electronic request, and lifted within one hour by the same route. It lasts until removed. It must be done at all three bureaus separately.
That one-hour thaw is the answer to the usual objection — that a freeze will get in the way of a car loan or a new card. It will not.
What it does not do: a freeze blocks new accounts being opened. It does nothing about fraud on existing accounts — which, per the CFPB data at the top of this page, is where the money actually goes.
Anyone with a Social Security number or ITIN who can verify their identity may enrol. It is a six-digit number that stops a return being filed under their SSN.
Three routes: online is fastest; Form 15227 by mail if adjusted gross income is under $84,000 single or $168,000 joint, taking about four to six weeks; or in person, about three weeks. Those income thresholds mean most retirees qualify for the low-friction mail route.
The trap: the PIN is valid for one calendar year and a new one is issued annually. A forgotten PIN causes the return to be rejected, so this one needs a recurring reminder, not a one-time setup.
Free, with identity verification. The reason to enrol is pre-emptive: an attacker who registers at your parent's address first can see daily images of their incoming mail — including new cards and account statements.
Be clear about what this is: the Postal Service makes no claim that Informed Delivery protects against mail theft or fraud, and neither do we. Its value here is denying the account to somebody else, nothing more.
The Social Security Administration can also block electronic and automated-telephone access to a person's record — after which, in SSA's words, "no one, including you, will be able to see or change your personal information on the Internet or through our automated telephone service." It is reversible on request. We are not publishing a how-to for it, because we could not verify the current procedure against SSA's own documentation; call SSA and ask.
Dividing federal loss totals by population produces nonsense. The honest prevalence figure comes from a meta-analysis of 12 population-based studies covering 41,711 people: a one-year prevalence of 5.4% — roughly 1 in every 18 cognitively intact, community-dwelling older adults each year. The authors add that this likely underestimates the true figure.
A methodological detail with a practical lesson: studies that asked about specific fraud events found 7.1%, while a single general question found 3.6%. How you ask determines what you learn. "Has anything odd happened with the accounts?" is a much weaker question than "has anyone asked you for a gift card, a wire, or your Medicare number this year?"
A six-year study of 935 older adults without dementia found that low scam awareness was associated with later Alzheimer's dementia (hazard ratio 1.56) and mild cognitive impairment (1.47), and with greater β-amyloid at autopsy.
Read that carefully, because it is widely misused. The authors state plainly that their measure of scam awareness "is too weak for prediction at the individual level." It explains why susceptibility changes across a population. It is not a screening test, nobody should treat a parent falling for a scam as a diagnosis, and any product claiming to detect dementia this way is misrepresenting the research.
What is modifiable is more encouraging. In 639 adults without dementia, susceptibility was negatively associated with income, cognition, psychological well-being, social support and literacy. Social support and well-being are not knowledge variables — which is the empirical case for making sure somebody else is in the loop, rather than for sending your parent another quiz.
Two honest caveats. A 2023 microsimulation found that raising either well-being or literacy reduced susceptibility, with well-being directionally better but not significantly so — so nobody should claim one beats the other. And a 2022 review found no evidence that older adults are over-represented among online fraud victims generally. We could find no randomised trial of friction, third-party review, or trusted-contact effectiveness. The case for those controls is regulatory and institutional, not experimental, and we would rather say that than imply an evidence base that does not exist.
That is genuinely all of it, and you can do every one yourself for free — the whole point of this page. Resbit exists for the families where nobody has a spare afternoon to make six phone calls during business hours. That is the paid part, and it is $49 a month flat.
See what else your family qualifies for →