The Trust Trap: Protecting Aging Parents From Phone and Online Scams

Hackers & Hooks | Season 1, Episode 11

The phone rings, and the caller says they are with the bank he has used for decades. There has been a mistake: money was accidentally transferred into his account, and it needs to be sent back. The caller is polite and patient and walks him through every step. He drives to the next town, wires the money, and realizes almost as soon as it is gone what just happened.

That story came up on this episode of Hackers & Hooks, and it captures what the episode calls the trust trap. Nick Gipson and Isaac Reed were joined by John Nanavati of House and Mouse, a nonprofit he started that provides technical support and home repair to seniors, people with disabilities, and families with limited resources. John teaches classes and speaks with groups of older adults about technology, and the scam stories he hears follow a clear pattern.

Scammers Do Not Break In. They Borrow Your Trust.

Nothing in that bank call involved hacking a computer. The scammer borrowed a relationship that already existed and used it to get a person to act. The man in the story had even been coached to call a family member before acting on anything suspicious. In the moment, he did not. Wiring money through a service like Western Union works like sending cash, and the Federal Trade Commission warns that once it is sent, the money is usually gone.

John shared other versions of the same trick. Someone at one of his presentations got a call from a person claiming to be their doctor’s office: the doctor had reviewed their test results and wanted more tests, so could they share some information to get started? John nearly fell for a scam himself when he was starting his business. A prospective customer offered to pay him far more than he asked, a red flag he recognized once they started talking money. That pattern matches the fake check scam, where you deposit a check, send part of it back, and are left owing the bank. The FTC notes that banks must make deposited funds available within a day or two, but it can take weeks to uncover a fake check.

Not every scam is after money right away. John pointed out that scammers also want personal information and access. In another story from the episode, one old email account that was linked to everything was compromised, and the attackers used password resets to take over social media, shopping, and even a toll road account. Nick also described “pig butchering” scams, named, according to the U.S. Treasury’s FinCEN, after fattening a hog before slaughter: scammers spend time building a friendship or romance before pitching a fake investment.

Artificial intelligence is making all of this more convincing. John uploaded a short recording of his own voice to an AI service and got back a voice profile he called pretty convincing. The FBI has warned that criminals use cloned voices in emergency scams that impersonate family members.

Hook, Ask, Pressure: The Pattern Behind the Scam

When John talks with groups, he boils every scam down to three flags. First comes the hook: you won a prize, you owe the IRS, a loved one has been arrested. Then comes the ask: money, information, or access. Finally comes the pressure: act now or something terrible will happen. Scammers appeal to emotion because, as John explained, the goal is to confuse you until you stop thinking.

“Someone’s going to hook you. And it’s a matter of, as you’re going down the path, how to identify these flags and put the brakes on.”

John Nanavati, Hackers & Hooks

His other piece of advice is simple: talk it out. John has a neighbor he calls when something feels off, and saying the story out loud often exposes it.

“Just having someone to talk to and verbalize it, it starts to sound more questionable.”

John Nanavati, Hackers & Hooks

Lessons for Families and Small Businesses

• Learn the three flags. A hook, an ask, and pressure to act fast is the signal to stop. Teach it to parents, grandparents, and staff, because it applies to phone calls, texts, emails, and social media alike.
• Hang up and call back on a number you already know. If “the doctor’s office” or “the bank” calls out of the blue, thank them, end the call, and dial the number on your card or statement. To donate to a cause, go to its official website rather than following a link in an email.
• Create a family safe word. John recommends a word that anyone calling on a loved one’s behalf must know. The FBI made the same recommendation in a December 2024 alert. In a business, the equivalent is a set verification step, such as confirming any payment or account change request by phone with a known contact.
• Name your trusted advisors in advance. Pick a couple of people you will call before acting on anything unusual, and agree to follow their advice even when it is not what you want to hear.
• Protect the email account that unlocks everything. Use a strong, unique password and multi-factor authentication (a second check beyond the password), and close or unlink old email accounts you no longer watch.
• Know what to do if money goes out. Contact the bank or wire service right away and ask them to reverse the transfer, then report it at ReportFraud.ftc.gov. A plan written down ahead of time is far easier to follow than one invented in a panic.

How Gipson Cyber Helps

Nick made a point on the episode that applies to every family and business: the question is not if someone will try, but when, and what the plan is when they do. No one can stop every attack. Gipson Cyber is built to respond, with real human responders who help limit the damage and explain clearly what happened.

For households, that plan matters just as much: everyone should know what to do if an account is taken over, money goes missing, or a scam gets through. If you are looking for family cybersecurity protection for aging parents or your whole household, learn more about our family protection.

The same trust tricks reach businesses, including messages that pretend to come from the boss. Business SOCaaS provides 24×7 monitoring by real human responders, works with the tools you already have, and fits alongside your existing IT team or MSP. If a scam has already turned into an incident, Business DFIR helps investigate and contain it, with clear reporting at the end. If it is happening right now, go to 800cyber.com.