Hi Mom, it's your IT support

Jana is the hero of the Sunday afternoon. Her mom got a new TV, and in three hours Jana has done it all: Wi-Fi connected, streaming apps installed, 400 channels sorted, the news right where Mom wants it. There was coffee and cake. Family IT support, level: legendary.

On her way out, her mom mentions that someone once called the neighbor: the neighbor's daughter had caused a car crash, and now bail was needed. The neighbor hung up. Just about. And Jana realizes in the hallway: she explained how to turn on subtitles. She never explained what to do when someone on the phone is crying and saying "Mom". Channel list: sorted. Scam talk: skipped. Sound familiar? Then this is your afternoon plan.

First things first: this isn't about age

Let's be clear: it's not "old people" who fall for these scams. It's people. According to the Berlin police, even police officers and criminologists have been caught out. The callers work from call centers with scripts and pick older people on purpose, for example through first names in the phone book that sound like a certain generation. Shock calls alone caused 117 million euros in damage across Germany in 2023, according to the Berlin police. So you don't walk in as the know-it-all. You walk in as the accomplice.

The scams, and how your parents can spot them

The stories change, the pattern stays. Here are the classics.

"Hi Mom, this is my new number"

A WhatsApp or text message from an unknown number: the phone broke, this is the new one. After some small talk comes the problem: a bill has to be paid urgently and online banking isn't working. Could Mom just send the money? Germany's consumer advice centers (Verbraucherzentrale) call this the daughter or son trick. Red flags: unknown number, urgency, money going to a stranger's account, often abroad. The fix is wonderfully low-tech: call the old, known number.

Shock calls and the grandchild scam

Someone is crying on the line and says "Mom", then a supposed police officer or prosecutor takes over: your daughter caused a serious accident, and only bail will keep her out of jail. A courier is on the way. According to the Berlin police, the classic grandchild scam ("Guess who's calling?") has become rare and shock calls have taken its place. The truth: in Germany, bail is never collected at the front door. A lawyer is always involved, not a courier with a tote bag.

Fake police officers

The version with a uniform on the phone: a burglary gang was caught nearby, and your address was on their list. To keep your savings safe, a plainclothes officer will pick them up. The facts: German police never call from 110 (the police emergency number) and never take money or valuables into safekeeping. Since 1 December 2022, German carriers must even cut off calls that show 110 or 112 as the caller, and calls from foreign networks may no longer display a German number (except mobile phones roaming abroad). Still: caller ID is a hint, not proof. It can be faked (caller ID spoofing).

Fake bank staff and the app approval

The call seems to come from your own bank, and the number matches (or, as in one case described by the Hamburg consumer advice center, is only off by the last digit). Suspicious transactions need to be stopped together, so please confirm a quick approval in your banking app (in Germany often called pushTAN). What actually gets approved: a transfer to the scammers, a new card or a new device for online banking. The money is usually gone, and courts are often unforgiving: the Higher Regional Court of Braunschweig rated such pushTAN approvals over the phone as grossly negligent (decision of 6 January 2025, 4 U 439/23). The customer was left with a loss of almost 7,900 euros.

The rule for Mom: the approval app shows you what you're approving. Read it. And anyone who asks for a PIN, TAN or approval over the phone is not your bank. Scammers have even spoofed 116 116, Germany's central card and account blocking hotline. The real hotline never calls you.

Fake Microsoft support

Sometimes someone calls, often in English or broken German. Sometimes a bright red warning blocks the browser, complete with a phone number: the computer is full of viruses. The friendly "technician" wants remote access, and then it gets expensive. According to the consumer advocates, Microsoft does not make unsolicited calls to fix devices. And the red window? Close the browser, restart the computer if needed. Never call that number.

Parcel texts and prize draws

The parcel text: an address detail is missing, please confirm via the link, small fee included. Click it and you land on a fake site, or on Android you install a malicious app. The prize draw: "You've won!", but first please pay a fee or call a pricey premium number. The consumer advocates' rule fits on a fridge magnet: if you've really won, you don't pay anything.

The golden rules for the phone table

Write these rules on a card and put it next to the phone. Old-fashioned? Absolutely. It still works, because nobody googles in a moment of panic.

1. The police never call from 110 and never collect money or valuables. When in doubt, hang up and dial 110 yourself.
2. The bank never asks for a PIN, TAN or approval over the phone.
3. If it's about money, data or remote access: hang up. Then call back on a number you know, not via the redial button.
4. Anyone claiming to be family and asking for money has to know the family code word.
5. Anyone who says "Don't tell anyone about this" is a scammer. Every time.

About that code word: pick something that isn't on Facebook. Not the dog's name that's tagged in 40 holiday photos. Go for something silly only you know, like the name of that questionable caravan from the family vacation everyone pretends never happened.

And tell your parents explicitly: hanging up isn't rude. Real police officers and real bank staff can handle a callback.

The talk: accomplice, not lecturer

Now the hardest part, and it has nothing to do with tech. Open with "Mom, you fall for everything" and the conversation is over before it starts. This works better:

• Start with yourself. "I almost clicked a fake parcel text once" opens more doors than any statistic.
• Make it a team effort. You protect each other, and the code word works both ways.
• Take the shame out. If someone nearly fell for it, they should be able to say so without an eye-roll. Every call they shut down is a win.
• Practice instead of preaching. With a heads-up, play the fake bank advisor once. Anyone who has said "No, I'm hanging up now" out loud will find it easier next time.

And if Dad says "That won't happen to me": great. He's now head of household security and helps with the setup. What matters is that it gets set up.

The parent setup in one afternoon

Coffee, cake, a charging cable, that's all you need. Go through the list in order and briefly explain what you're doing. Don't secretly change everything, or Mom will wonder in three weeks why her phone suddenly swallows calls.

Updates and screen lock

Automatic updates are the most boring and most effective security measure in the world. On iPhone: Settings > General > Software Update > Automatic Updates, switch everything on. On Android the wording differs by manufacturer, usually under Settings > System. On a Windows PC: Settings > Windows Update. Add a screen lock with a PIN, face or fingerprint. The PIN is not a birthday. Yes, I know. That's exactly why.

Passwords: manager or password book

The textbook answer is a password manager, an app that stores all passwords encrypted and only needs one main password. Germany's Federal Office for Information Security (BSI) explicitly recommends them. If your parents get along with one: great, set it up.

Now the honest answer: for many parents, that's one hurdle too many. In that case, a well-kept password book beats one password for everything. My take: for most people, a burglar hunting for the password book is a much smaller risk than a reused password from a data leak. The ground rules:

• One book, not 30 sticky notes.
• Not next to the PC, but with the important paperwork.
• A separate, long password for every account, ideally three or four random words.
• Banking PINs and card details stay out of it.

MFA, the second key

Multi-factor authentication (MFA) means that besides the password, you need a second proof, such as a code sent to the phone. Turn it on at least for email, the Apple or Google account, Amazon and PayPal. Email first, because it can reset every other password. Then the most important sentence for your parents: you never share this code with anyone. Ever. Not even with "support".

Filter calls and clean up the phone book listing

• iPhone (iOS 26 and later): Settings > Apps > Phone > Screen Unknown Callers. "Silence" sends unknown callers to voicemail, "Ask Reason for Calling" (where available for your language) makes them say who they are and what they want first.
• Android: turn on spam protection in the Phone app's settings. In the Google Phone app it's called "Caller ID & spam", other manufacturers use similar names.
• WhatsApp: Settings > Privacy > Calls > Silence unknown callers.
• Phone book: German police recommend removing the listing, or at least shortening the first name to an initial and dropping the address. One call to the phone provider does it.

Before that, save the family doctor, care service, pharmacy and neighbors as contacts. Otherwise the doctor's callback ends up on voicemail too, and that's on you. Fair enough.

Carrier billing block

Third parties can bill subscriptions through the mobile phone bill, sometimes after a single accidental tap. A third-party billing block (Drittanbietersperre) stops that. You request it from the mobile carrier via app, customer portal, email or letter (the German consumer advice centers offer a template). Setting it up is free, only unblocking may cost a fee.

Banking: limits and alerts

The underrated lever. If scammers do get through, the limit decides how much it hurts.

• Lower the transfer limit: set a daily limit in online banking or at the branch that fits real life. Someone who never transfers more than 1,000 euros a day doesn't need a 10,000 euro limit.
• Turn on push notifications for every transaction. That way Mom notices right away if something goes out.
• Walk through the approval app together: what does it show, and why do you read it before every confirmation?
• Ask at the branch about a power of attorney for the account, so you can act in an emergency.

Emergency contacts and account recovery

On iPhone, fill in the Medical ID in the Health app and add yourself as an emergency contact; on Android it's usually under Settings > Safety & emergency. And for the day Dad forgets his Apple password: Settings > his name > Sign-In & Security > Account Recovery, and add yourself as a recovery contact. Then you can give him a code to get back into his account, without seeing any of his data.

Remote help, done right

Sooner or later the call comes: "Everything's gone." So you don't have to drive 50 miles every time, set up legitimate remote help. Ideally one that's already built in.

• iPhone and iPad (iOS 18 and later): during a FaceTime call, Mom shares her screen and you can request control. She has to approve it every time. Sensitive actions such as payments or changes to the Apple Account are blocked.
• Windows: Microsoft's Quick Assist app. You choose "Help someone" and give Dad the six-digit code. He enters it and clicks "Allow". You only get full control if he grants that too.
• Android: there's no single built-in solution. Often, screen sharing in a video call is enough to see where things are stuck.

And now the rule to burn into your parents' memory: remote help only happens when YOU call them or they call YOU. Never when a stranger calls, emails or a warning pops up. Even Microsoft says so in its own guide. You call real support. Real support doesn't call you.

If it has already happened

Your first sentence to Mom or Dad: "I'm glad you told me." No but, no blame. People who feel ashamed wait, and with fraud every hour costs money. Then, in this order:

1. Call the bank immediately, using the number on the card or the official website. Ask whether the transfer can still be stopped.
2. Block everything: Germany's blocking hotline 116 116 (Sperr-Notruf) blocks debit cards, credit cards, online banking access and SIM cards around the clock, as long as the bank or carrier takes part. From abroad: +49 116 116.
3. Police: if a courier is about to show up at the door, call 110 right away. Otherwise, report it at the local station or through your federal state's police online reporting portal (Onlinewache). You'll need the police report for the bank, too.
4. Secure evidence: don't delete messages, take screenshots, write down the time, number, names and account numbers.
5. After remote access to the PC: disconnect from the internet, remove the remote access software, change email and banking passwords from another device. After a parcel text with an app install: airplane mode on and inform the carrier.
6. Talk: the victim support hotline of the charity WEISSER RING, 116 006, is free and available daily from 7 a.m. to 10 p.m. For subscriptions, contracts and refunds, the consumer advice centers can help.

And then: talk about it, with the neighbors too. Scammers rely on victims staying silent.

Your checklist for the next visit

• Had the talk, without the finger-wagging
• Agreed on a family code word
• Put the rule card next to the phone
• Automatic updates and a screen lock with a sensible PIN
• Password manager or password book set up
• MFA for email, Apple or Google account, Amazon and PayPal
• Spam filter and WhatsApp silencing on, important numbers saved as contacts
• Phone book listing removed, carrier billing block set up
• Transfer limit lowered, push notifications on
• Medical ID and recovery contact set up
• Remote help tested, "only when YOU call" rule explained
• 116 116 and your number saved as contacts

The best support call is the one before

By the way, Jana went back to her mom's the following Sunday. No TV this time, just coffee, a card with five rules and a code word I'm obviously not telling you. Her mom laughed at her first, then taped the card to the phone and brought a second one to the neighbor.

Your turn: call your parents. Before someone else does. And while you're at it: Turn on MFA. Think purple.