Email security for seniors
Knowledge
Updated on 19 Oct 2026: We added email scam reporting steps and updated our advice on recovering a compromised email account.
Your email account connects to many of your other online accounts, including banking, healthcare, shopping, and government services. Protecting your email helps protect everything connected to it.
Scam emails rely on urgency, fear, excitement, and pressure to make you act before thinking. When an email rushes you, slow down.
Key takeaways
- Never reply to an email with your password, verification code, PIN, or other login information.
- Be extremely suspicious of any email that tells you to pay with gift cards, cryptocurrency, cash, or a wire transfer.
- Never move money because an email says you need to "protect" it.
- Don't use a phone number or link contained in a suspicious email. Contact the organization yourself using information you know is legitimate.
- Use a different password for each important account and turn on multi-factor authentication for your email when it's available.
- A familiar-looking sender name, email address, or attached photo doesn't necessarily prove who actually sent a message.
- If something goes wrong, act quickly. Contact your bank, change affected passwords, and ask someone you trust for help.
- The most important rule is simple: stop and verify before you click a link, reply, or act on anything in an email.
Why email security matters for seniors
Think of your email inbox as more than a place to read messages. For many people, it's the front desk for their entire digital life.
Many services send password-reset messages to your email when you forget a password. That means someone who gains access to your email can use those messages to get into other accounts.
Scammers also know this. Email is often part of a scam, even when a phone call or text is involved. Protecting your email helps protect these connected accounts. It doesn't require becoming a computer expert. Most of the protection comes from a handful of habits: using good passwords, turning on additional login protection, questioning unexpected emails, and verifying unusual requests before acting.
Why scammers target older adults
Scammers target people of every age, but some criminal operations deliberately target older adults by email. Some target retirement savings or access to financial accounts; others exploit unfamiliarity with online scams.
Scam emails are also built to manipulate emotions. They might make you afraid that your bank account has been compromised, worried that a relative is in trouble, excited that you've won a prize, or concerned that your computer has a virus. The goal is usually the same: get you to act on the email before you have time to check the story.
Learning to recognize that pressure is one of the most effective ways to protect yourself.
How phishing emails use unexpected messages and emotional pressure to create urgency, and when to stop and verify.
How to recognize phishing emails
Email phishing is a scam that impersonates a trusted sender to trick you into sharing information or taking an unsafe action. It can pretend to come from your bank, Medicare, the IRS, a delivery company, Amazon, a utility company, or even a friend or relative. The email might ask you to click a link, call a phone number, open an attachment, reply with personal information, or make a payment.
Poor spelling and strange formatting used to make phishing emails easy to recognize. That isn't always true anymore. Modern phishing emails can contain professional-looking logos, correct grammar, and realistic formatting copied directly from the real company. Don't decide that an email is safe simply because it looks professional.
Watch for unexpected urgency
One of the most reliable warning signs is an email that pressures you to act immediately.
You might see subject lines like:
- "Your account will be closed today."
- "Your payment was declined."
- "Your computer is infected."
- "You owe the IRS."
- "Your Social Security benefits have been suspended."
- "Suspicious activity detected on your account."
- "Urgent: your grandson needs your help."
- "Your subscription renewed for $499."
The story changes, but the strategy doesn't. The email wants you focused on the supposed emergency instead of whether the message makes sense.
Whenever an email creates an unexpected emergency involving money, accounts, passwords, or personal information, stop. Give yourself time to verify what's happening before you click or reply.
Check who actually sent the email
The name displayed on an email doesn't necessarily tell you who sent it. A scammer can make the sender name say "Bank Security Department" or "Amazon Customer Service" without the message actually coming from either one. Click or tap the sender's name to see the complete email address, and look for obvious misspellings or domains that don't match the organization (for example, "arnazon-support.com" instead of "amazon.com").
Don't rely on this check alone, though. Some fraudulent emails can be very difficult to distinguish from legitimate ones. The real takeaway: a familiar-looking name or address isn't proof of who sent an email. If it's important or unexpected, verify it another way.
If the email tells you to call a number, don't use that number
Many scam emails don't ask you to click anything at all; they simply provide a phone number and ask you to call about a charge, a virus, or a suspended account. This can feel safer because you're the one making the call, but the number in the email belongs to the scammer, not the real company.
Even if the person who answers sounds professional, and even if your phone's caller ID shows the right name when they later call you back, that doesn't prove who they are. Caller ID can be faked just as easily as an email address. If an email asks you to call about a problem, close the email and find the organization's real number yourself.
Verify important requests another way
Suppose you receive an email saying someone made a $2,000 purchase using your credit card. Don't click the email's link, and don't call the number in the email. Instead, take out your card and call the number printed on the back, or log into your account by typing the company's website address yourself.
The same idea works for any organization: use a phone number printed on your card or statement, the organization's official website, an official app you already use, or a number you've previously saved. You don't have to prove that an email is fraudulent; you only have to avoid acting on it until you've independently confirmed that it's legitimate.
Protect your personal information
Money isn't the only thing scam emails try to collect. Be cautious about replying to any email that unexpectedly asks for your Social Security number, Medicare number, driver's license information, birth date, bank or card numbers, passwords, PINs, photos of identification, or answers to security questions.
Sometimes scammers collect information gradually across several emails: one asks for your birthday, another asks for your address, another asks for part of your Social Security number. You don't need to figure out exactly what a stranger intends to do with the information. If an email unexpectedly asks for sensitive information, stop and independently contact the organization it claims to be from.
What DMARC protects against
Organizations can use DMARC to tell receiving email systems how to handle messages that fail authentication checks for their domain. DMARC monitoring shows these failures; a monitoring-only policy does not request blocking. A quarantine or reject policy asks receivers to filter or reject failed messages. DMARC does not stop lookalike domains or messages sent from hacked accounts, and a passing result does not prove that an email is safe.
Suped is our email authentication platform. Families or community organizations with a custom email domain can use Suped to review DMARC reports, identify legitimate senders with authentication problems, and fix SPF or DKIM settings before requesting quarantine or rejection. A domain health check helps review existing DNS settings. Your email provider manages domain authentication for addresses on its own domain.
Government, Social Security, and Medicare scams
Government agencies are frequently impersonated by email because names like the IRS, Social Security Administration, and Medicare can make a threat sound serious.
- Social Security: A phishing email can claim your Social Security number was involved in criminal activity or threaten to suspend benefits unless you verify your identity or pay. SSA does not threaten to suspend your Social Security number or demand payment to avoid arrest. Legitimate account notifications can arrive by email, so open your my Social Security account directly to check any notice. See SSA's scam guidance for the warning signs.
- IRS: The IRS does not initiate email contact to request personal or financial information. An email demanding immediate payment or threatening arrest is a scam warning sign. Check tax notices through your official account or contact the IRS independently.
- Medicare: Protect your Medicare number like other sensitive personal information. Be cautious of emails offering a new Medicare card, free medical equipment, or a special benefit in exchange for your number. Only share it with verified healthcare providers or others who need it for your care, and use a secure channel confirmed directly with the provider.
- Police and government-fee emails: An email can claim you missed jury duty, have an outstanding warrant, or owe a fine, with a link or reply address to resolve it immediately, often by gift card, cryptocurrency, or wire transfer. Do not reply or pay. If concerned, contact the agency directly using contact information you look up yourself; preserve the message if you need to report it.
- Medical-benefit emails: Unsolicited emails offering free braces, medical equipment, or genetic testing, or claiming to "upgrade" your insurance, are usually attempts to collect your Medicare or insurance information. If you're interested in a benefit, contact Medicare, your insurer, or your doctor directly rather than replying to the email.
Tech support scams by email
Some tech-support scams begin with a pop-up warning on your screen rather than an email, but many arrive the same way other phishing does: an email claiming your antivirus has expired, your computer is infected, or your security software needs to be renewed, with a link or phone number to "fix" the problem immediately.
Don't click the link and don't call the number. Microsoft, Apple, and other technology companies don't send unexpected emails announcing that your specific computer is infected.
If you do call a number from one of these emails, a fake technician can ask you to install a program that lets them see or control your computer. Don't do this in response to an email you didn't expect. Once someone has control of your computer, they can see personal information or manipulate what appears on your screen, sometimes to fake a "refund" and then ask you to send money back. If a follow-up email or call about your computer starts discussing bank transfers, refunds, or gift cards, stop immediately.
Fake subscription and renewal notices
Another common phishing email is an invoice for something you don't remember purchasing: an antivirus subscription, an Amazon or PayPal charge, a streaming renewal, or a computer warranty. The amount is often large enough to make you worried, and the email provides a phone number: "Call immediately if you did not authorize this purchase."
That phone number belongs to the scammer, not the company. Don't call it. Check the account yourself by opening the company's app or typing its website address directly into your browser.
Bank and financial scam emails
Financial scams can be particularly convincing because they copy your bank's logo and familiar email wording.
You might receive an email saying, "We've detected unusual activity, verify your identity now," with a link to a fake login page. If you type your username and password into that page, you've just given it to the scammer. Always go to your bank's website or app directly instead of clicking a link in an email like this.
This deserves its own rule: never transfer money because an email tells you your account has been compromised and the money needs to be moved somewhere "safe." A scam email can direct you to move money to another bank account, a cryptocurrency account, a payment app, or a wire-transfer service. Your bank will never ask you, by email, to secretly move your own money to protect it.
If an email tells you to buy gift cards and reply with the numbers from the back, stop, regardless of who it claims to be from. Gift cards are for gifts and ordinary purchases, not for paying fines, taxes, or fees.
Email scam warning signs: gift cards, wire transfers, cryptocurrency, "safe" accounts, and guaranteed returns.
Family emergency scams by email
These scams exploit one of our strongest instincts: helping someone we love. Instead of a phone call, you can receive an email that appears to come from a relative's real address (because it's been hacked) or a lookalike address, saying something like: "I'm stuck overseas, lost my wallet and phone, and can only reach you by email right now. Can you wire money?" The request to communicate only by email, and not to call, is itself a warning sign, because it prevents independent verification.
Don't reply to the email. Contact that family member directly using a phone number you already have, or contact another relative to check the story, before sending anything.
AI can make scam emails more convincing
AI can imitate a person's writing style or generate realistic images for an email, so familiar wording or a photograph does not prove who sent it. AI can also imitate a voice, so a familiar-sounding incoming call is not proof of identity.
You don't need to become an expert at detecting AI-generated content. If an email claims to be from a relative and involves an unexpected request for money, don't reply to it. Call that person, or another family member, using a number you already have. Consider establishing a family verification word for emergencies. The goal isn't to determine whether an email was written by AI, it's to independently confirm who actually sent it.
Romance and relationship scams
Romance scams can begin on a dating site or app and then move to personal email. The scammer can ask to "email instead" so the conversation isn't visible to the platform's safety monitoring. A scammer can spend weeks or months exchanging emails, learning about your life and building a relationship, before ever mentioning money.
Eventually there is a problem raised over email: a medical emergency, a travel expense, a package stuck in customs, or an investment opportunity. Be especially cautious when someone you've never met in person starts asking for money over email, and never let embarrassment or emotional pressure stop you from discussing the emails with someone you trust.
Investment scam emails
Be cautious of any investment pitch that arrives unexpectedly by email, especially from someone you've only met online. Warning signs in the email include guaranteed profits, little or no risk, unusually high returns, pressure to invest immediately, requests for cryptocurrency, or language discouraging you from discussing the opportunity with family or a financial professional.
Legitimate investments involve risk. If an email claims an investment is guaranteed, take that as a reason to investigate independently before sending anything.
Prize, sweepstakes, and lottery scam emails
An email announces, "Congratulations! You've won!" Then comes the catch: a reply asking you to pay taxes, processing fees, delivery charges, or legal fees before receiving the prize.
Don't reply or pay money to collect a prize you didn't know you'd entered for. Foreign lottery emails and unexpected sweepstakes-winning notices are common scam themes.
Fake check scams
These scams often start with an email replying to something you sold online, or accepting a "job" you were offered by email. A check can look real, and your bank can make the funds available before discovering it is fraudulent. Available funds do not prove that a check is genuine. The scammer emails you saying they accidentally overpaid and asks you to send the extra money back. You send it. Later, the original check is discovered to be fake, and the money disappears from your account. You can be held responsible for what you sent.
Never send money back because an email claims a check was an accidental overpayment. If you're unsure about a check tied to an email exchange, talk directly with your bank before spending or returning any of the money.
Online shopping and delivery scam emails
- Fake stores: A promotional email can advertise unbelievably low prices from a store you've never heard of, or ask you to pay by gift card or cryptocurrency rather than a normal payment method.
- Marketplace emails: If you're buying or selling on an online marketplace, keep communication and payment within the platform's own messaging system. Be wary of a buyer or seller who asks to move the conversation to personal email and pay outside the platform.
- Fake delivery notifications: An email can claim "We were unable to deliver your package" and ask you to click a link and pay a small redelivery fee, often just a dollar or two. The small charge isn't necessarily the real goal; the fake page can be designed to steal your card information. Instead of clicking the email, go directly to the delivery company's website or app and check your shipment using your own tracking number.
Messages from a friend's hacked email account
Sometimes a scam email really does come from a real person's real email address because their account was hacked, not because they're impersonated. You might get an email from a friend or relative's actual account saying they're stranded, need a gift card, or want you to click a link.
Because the address is genuine, this can be one of the harder scams to catch by looking at the sender alone. If a friend or relative's email unexpectedly asks for money, gift cards, or personal information, contact them a different way, by phone or in person, before responding.
Scams that exploit difficult or emotional situations
- Charity and disaster scams: After a hurricane, fire, war, or other tragedy, you can receive an emotional email asking for an immediate donation. If you want to help, look up the charity's official website yourself rather than donating through a link in an unexpected email.
- Funeral and obituary scams: Scammers can find names and family relationships in publicly posted obituaries, then email surviving family members claiming to be a funeral home, creditor, or agency owed money by the deceased. Don't reply or pay because an email claims the deceased owed money. Ask for documentation and independently contact the organization involved.
Never share passwords or verification codes by email
Your password belongs only to you. No legitimate company will ever ask you to email it to them, and you should never reply to an email with it.
The same rule applies to verification codes, including the codes your own email provider sends you to reset a password or confirm a login. If you receive a code and then get an email or call saying "please reply with the code we just sent so we can verify your identity," don't do it. That code is often exactly what a scammer needs to get into your account.
Never email a sign-in or password-reset code to anyone, even if you started the process. Enter it only in the official app or website you opened yourself. Deny any sign-in approval request you did not start.
Be careful with links and QR codes in emails
Instead of trying to decide whether every link in an email is safe, use a simpler habit: for important accounts, go there yourself. Open the app you normally use, use a bookmark, or type the website address you already know, rather than clicking a link in an email. A QR code can lead to a fake login page just like a written link. Treat an unexpected QR code with the same caution. HTTPS or a padlock only means a website connection is encrypted; it does not prove that the website is legitimate.
Be careful with email attachments
Don't open an unexpected attachment simply because the email appears to come from someone you recognize; a hacked account or forged sender name can make the message look genuine. Ask yourself: Was I expecting this? Does the request make sense? Can I check with the sender through a separate channel first? If you're unsure, verify before opening it. Malware is harmful software that an attachment or download can install. Never enable document macros or install software just because an email attachment tells you to.
Secure your email account and recovery options
- Use different passwords: Using one password everywhere creates a chain reaction. If criminals obtain the password from one account, they can try it on your email and other accounts. Give your email, bank, and other important accounts their own unique passwords. Use a long password or passphrase that is hard to guess, such as several unrelated words. Avoid birthdays and relatives' names.
- Turn on multi-factor authentication (MFA), also called two-factor authentication (2FA) or two-step verification. This adds a separate check to a password login, such as a code from an authenticator app or a security key. If your email or phone asks "Are you trying to sign in?" and you are not, choose No or Deny. An unexpected request can mean someone else has your password.
- Protect your email especially carefully: Because your email can often be used to reset passwords for other accounts, give it a strong, unique password and multi-factor authentication, and make sure its recovery phone number and backup email address are current and belong to you. Store any backup recovery codes somewhere secure that you can reach without signing into that email account.
- Use a passkey when available. A passkey lets you sign in with your device's screen lock and resists fake login websites. Set it up on a personal device and keep recovery options current in case the device is lost. Google's security guidance explains how passkeys resist phishing.
- Consider a password manager: A password manager can remember strong, unique passwords for you, so you don't have to memorize each one. Many phones and browsers already include one. If you're uncomfortable setting one up yourself, ask a trusted family member or knowledgeable person to help.
Keep the devices you check email on secure
- Install updates: Software updates fix security problems. Turn on automatic updates for your phone, computer, and email app when possible. Get updates through device settings or an official app store, rather than an unexpected email or pop-up.
- Use a screen lock: Protect the phone, tablet, or computer you read email on with a PIN, password, fingerprint, or face recognition in case the device is lost or stolen.
- Be cautious checking email on shared or public computers: Avoid checking email or logging into other accounts on public computers when possible. If you must, don't save your password or select "Remember me," and sign out fully when you're finished.
What to do after responding to a scam email
What you do next depends on what happened. Most importantly, don't wait because you're embarrassed or unsure; it's better to ask for help quickly.
- If you clicked a link in a suspicious email but didn't provide information: Close the page and do not enter information or download anything. Clicking a link alone does not automatically mean your account was taken over. If a file downloaded or you opened one, update your device's security software and run a scan; get trusted help if you are unsure.
- If you entered your password on a page linked from an email: Use a device you trust to change that password through the real website or app. Sign out all other account sessions, change the password anywhere else you reused it, and turn on multi-factor authentication. If you are locked out, use the provider's official account-recovery process.
- If you replied to an email with a verification code: Follow the same steps to change your password and sign out other account sessions immediately. If the code involved a bank or financial account, call the institution using its official number.
- If you shared card or bank information: Call the card issuer or your bank's fraud department immediately using the number on your card or statement. Explain exactly what information was shared and ask how to stop unauthorized use.
- If you sent a wire transfer because of an email: Call the bank immediately, explain that it resulted from fraud, and ask whether the transfer can be stopped or recalled. Speed matters.
- If you bought gift cards because of an email: Keep the cards and receipts, and contact the company that issued them immediately to explain what happened. Don't throw the cards away.
- If you opened an attachment or gave someone remote access after an email: If remote access is active, disconnect the device from the internet immediately. Use another trusted device to contact your bank and change affected passwords. Update security software and run a scan if an attachment opened or downloaded harmful software. Get trusted technical help to remove harmful or remote-access programs before using the device for banking again.
- If you emailed your Social Security number or other identity information: Use the FTC's IdentityTheft.gov for recovery steps based on the information shared. If your Social Security number was exposed, consider a free credit freeze with each of the three nationwide credit bureaus to make it harder to open new credit accounts in your name. Keep notes about what happened.
- Preserve evidence: Don't immediately delete the scam email, related texts, receipts, transaction records, or screenshots. These can be useful when talking with your bank or reporting the incident.
- Ask for help quickly: You don't need to solve this alone. Depending on what happened, contact your bank, credit-card company, email provider, mobile carrier, a trusted family member or friend, the organization being impersonated, or appropriate fraud-reporting authorities.
If your email account was accessed, check its settings after regaining control. Remove unfamiliar forwarding rules and recovery details, review connected apps, and check your Sent and Deleted folders. Warn contacts through another channel if scam messages went out from your account.
Watch for follow-up recovery scams. Do not pay someone who contacts you promising to recover lost money for an upfront fee.
How to report and block scam emails
You can report a suspicious email even if you did not lose money. Use your email app's reporting controls rather than a button or link inside the message.
- Choose "Report phishing" when available, or use "Report spam" or "Junk". These controls are usually in the message menu.
- Do not reply or use an unsubscribe link inside a suspected scam. The link can lead to an unsafe website. For legitimate newsletters you recognize, unsubscribing is appropriate.
- Save evidence first if you shared information or money, then report and delete the message. Blocking the sender can reduce repeat messages, but scammers also change addresses.
- In the U.S., report scams to the FTC at ReportFraud.ftc.gov by typing the address yourself. For Social Security impersonation, use the SSA's scam reporting page.
For help reporting fraud affecting someone age 60 or older in the U.S., call the National Elder Fraud Hotline at 833-372-8311. Contact your bank first if a payment needs to be stopped; filing a report does not reverse a transaction.
How family members and caregivers can help
Family members can make email security easier without taking control away from someone.
- Set things up together: Offer to help set up multi-factor authentication on email, a password manager, automatic updates, and current recovery information, explaining what you're doing rather than simply changing settings. Ask permission before changing settings and let the account owner enter their own passwords and codes.
- Establish a family verification rule: Agree that any unexpected email requesting money gets independently verified by phone first, and consider a family verification word for emergencies.
- Create a trusted person to check with: Everyone should have someone they feel comfortable emailing or calling to say, "I got a strange email, can you look at it with me?" That message can prevent an expensive mistake.
Create a personal security emergency list
Make this list before you need it, and keep it somewhere accessible even if you can't get into your email. Include your bank's fraud phone number, credit-card company numbers, your email provider's account-recovery page, your mobile-phone company, a trusted family member or friend, and important government fraud resources. For banks and credit cards, use the numbers printed on your cards or official statements. Having this information ready removes the need to search for it while you're stressed.
Senior email security checklist
- Use different passwords for important accounts.
- Turn on multi-factor authentication for your email.
- Never reply to an email with a password or verification code.
- Don't click unexpected links or QR codes in emails involving important accounts.
- Don't trust a phone number found in an email, even if caller ID looks right when they call back.
- Verify unexpected email requests independently, through a number or website you look up yourself.
- Never move money because an email says it's in danger.
- Don't pay someone with gift cards or cryptocurrency because an email told you to.
- Don't open unexpected attachments or grant remote computer access based on an email.
- Report suspicious messages using your email app's own controls, and save evidence first if you shared money or information.
- When an email feels wrong, stop and ask someone you trust.
The most important habit: stop and verify
You don't have to memorize every scam; scammers constantly change their stories. The more useful skill is recognizing when it's time to stop.
If an email unexpectedly asks you to send money, move money, buy gift cards, reply with a password, reply with a verification code, give personal information, open an attachment, click a link, or act immediately, stop. Don't click. Don't reply. Don't pay. Contact the person or organization another way.
You don't have to prove an email is a scam before refusing to act on it.
Flowchart for stopping and verifying an unexpected email before acting.
Frequently asked questions
Stop and verify the request through a phone number, app, or website you already know. Do not use the contact details in the email.
No. Never email a sign-in or password-reset code, even if you started the process. Enter it only on the official app or website you opened yourself, and deny sign-in requests you did not start.
Use a trusted device to change the password through the real website or app, sign out other sessions, and change reused passwords. Turn on multi-factor authentication. For an accessed email account, also check forwarding rules and recovery information.
Yes. A real account can be hacked. Verify unexpected requests for money, gift cards, or personal information through another channel.
Set up account protection together, agree to verify money requests by phone, and be available to review unusual messages without judgment.
Email scam reporting and support resources
These resources provide scam-reporting contacts or practical email security guidance. The government reporting contacts listed here are for the U.S.
- Social Security Administration scam reporting Official warning signs and reporting options for Social Security impersonation.
- National Council on Aging phishing guidance Practical phishing-prevention advice for older adults.
- National Elder Fraud Hotline Free help with reporting fraud affecting people age 60 or older in the U.S.
- FBI spoofing and phishing guidance How sender impersonation and phishing work, with steps to avoid them.
- Google security guidance Guidance on passkeys, account protection, and avoiding scams.
- Cyber-Seniors cybersecurity resources Cybersecurity lessons and digital literacy support for older adults.
