Eight Questions to Ask Your Ageing Parents (and Yourself) to Keep Their Phones Safe From Hackers

Scammers have a lot of opportunities to bilk people during the holiday season. How do you make sure they aren’t tricking someone you love—particularly someone who is especially vulnerable to scams?

While swindlers will target people of all ages, older Americans have become the favoured mark. Adults 60 and over lose the most money to fraud each year, and phone scams do the most financial damage, according to a Federal Trade Commission report released in October 2022.

So, it is vital to make sure your older family members know how to keep their phones safe. The best way to start is by looking in the mirror. Figure out what security steps you take—or should take—with your own phone and how you could protect yourself better, and then help your relatives tighten up their defences. Remember, age might make some people more susceptible to these risks, but anybody can miss key security strategies. And no criminals will check your age before they hack you.

The holiday season—with its heightened spending and tension—is a prime time to think about smartphone fraud, says Mark Ostrowski, head of engineering at Check Point Software Technologies, an internet-security firm.

“Around this time, emotions run high,” he adds. “And that’s exactly what scammers want. They want an emotional response because that causes you to overlook something or make a bad decision.”

So how do you make sure your relatives are as safe as possible from hackers? You don’t want to be condescending. Instead, talk to them about their concerns, and yours. And during the discussion, make sure to ask them the following questions.

1. Is your phone password protected?

It may be tempting to not bother adding a lock screen to your smartphone, so you can bypass the hassle of punching in a number to get access. But having a four- or six-digit passcode is the first line of defense against hackers: If someone physically steals your phone, they won’t be able to get into the device easily without knowing your code.

Still, there are alternatives to PINs if those feel too cumbersome. Fingerprint scanning and Apple Inc.’s Face ID let you access your phone quickly without any codes, and some Android devices let you create a unique pattern on the screen that you then trace when you want to unlock the device. (Remember, though, that even if you have these types of defences, you will still have to type in your PIN when the phone restarts.)

“You would be surprised how many seniors don’t lock their device because of the inconvenience,” says Danielle Deibler, founder and chief security officer of Quad9, an online service that blocks cyber threats. “Make it so that they have to give consent for another person to get into their device.”

2. Do you update your phone’s software?

Smartphone software updates often include security patches to close loopholes that are potentially accessible to hackers. Third-party apps send out these types of changes, too. Make sure your loved ones—and you—know how to update their smartphone’s operating system and apps when prompted. And show them where to find and download the updates in their settings.

“There’s always security goodies embedded inside of those updates,” says Karim Toubba, chief executive of password-management service LastPass. “You would be surprised at how much value you get out of something that simple.”

Also remember that apps frequently offer multi-factor authentication, providing more security than websites on mobile browsers, says David Nuti, senior vice president at Nord Security, an internet-privacy company. That means to log in, you must provide at least two distinct forms of identification—such as a password and confirmation code via text—to gain access to an account. Help your loved ones set this up for banking and other apps, and be sure to do it for your own.

3. Do you have spam filters set up?

Turning on spam-protection software can prevent your loved ones from falling prey to phone scams. Apple devices running iOS 13 and later and Android phones running Android 6.0 or later can automatically silence unknown callers, and mobile providers can add another layer of protection: AT&T, T-Mobile and Verizon all offer features for detecting robocalls.

4. Do you get alerts from your bank?

Many banking apps offer text alerts for transactions when money enters or leaves an account, so you can tell immediately if you are being robbed. Ask if your family members need help navigating their mobile-banking apps to set those up.

But you shouldn’t rely solely on text messages for security. Scammers can send phishing texts posing as a bank to steal personal and financial information, for instance. So, remind your relatives to not click any text-message links that seemingly come from banks, and to not share sensitive information with someone who says they are calling or texting from a bank.

Instead, instruct them to call the number on the back of their card if they have questions. They can also run any suspicious texts or emails by you.

“Make yourself a firewall for online activity they’re unsure about,” Mr. Nuti says.

5. Have you added a trusted backup contact?

Find out if your relatives have named people to help them access their online accounts if they forget their password. You don’t have to know their password, and security experts say it is often best that you don’t because shared passwords carry more security risks than private ones.

With Apple’s recovery contacts, for instance, you can help validate your parents’ or grandparents’ identities to regain access to their iPhone and iCloud accounts. When they are locked out, they can follow the steps on their devices to share on-screen instructions with a recovery contact; the contact will get a six-digit code that will unlock the device and let them reset their Apple ID password.

For Google accounts, people can add your email address as a backup recovery option. If they get locked out of their Gmail account, they can have Google send you a verification code. Give them the code, and they can reset their passwords.

6. How do you track your passwords?

Keeping up with passwords can be a challenge for people of all ages. For some, pencil-and-paper records stored somewhere safe can be the best option, but password managers can also help.

Reputable digital password managers can be simple to set up and use. Apple’s iCloud Keychain for iOS and Google’s Password Manager for Android offer free, built-in options that store your passwords and sometimes other information such as addresses and credit cards. Both work in apps and web browsers.

Third-party password managers are solid options, too, with many offering additional features such as support across multiple operating systems. You have to remember only one password—the one for the password manager itself. Then, when logging into a website, the password manager automatically fills in your credentials, similar to the Apple and Google offerings.

7. What do you want to happen to your tech when you die?

No one wants to think about their loved ones dying—let alone themselves—but it is smart for them to have a plan about what will happen to their various accounts and devices.

Apple’s Legacy Contacts gain access to photos, contacts, documents, notes and more, all of which would be inaccessible without knowing their relative’s iCloud password.

Google offers an Inactive Account Manager, which will notify designated contacts if an account hasn’t been used for a set period ranging from three to 18 months. Facebook‘s Memorialization Settings let users choose someone to look after their profile when they die. The designated custodian can’t log into that account directly but can request that it be either “memorialised” or deleted.

8. Does anything concern you?

To make sure you haven’t missed anything, it’s helpful to find out if there are concerns that your relatives have but never mentioned. After all, scammers are evasive and find new ways to deploy old tricks.

Ask your family members if they have come across any messages on social media, shopped on new websites or gotten phone calls asking for their banking information that made them feel uncomfortable.

“Find out if they’re noticing new types of offers in their emails, or anything concerning,” Ms. Deibler says. “It can be a positive thing to reinforce things they’ve been skeptical about.”

The past five years have been good to stock-market investors. The S&P 500 index has climbed an annualised 12% during that period, outstripping the 9% annualised gain over the past 40 years. This year alone the index is up 6.9% as of April 26, tacking on to the 24% gain in 2023.

But signs are emerging that the stock market could be due for a breather. As of April 25, the S&P 500 went 133 trading days without a decline of at least 10%, according to PNC Institutional Asset Management. To be sure, that’s still short of the 172-day average since 1928. But the S&P 500 has jumped 24% in the past six months (about 180 days), which buttresses arguments for a correction.

What’s more, the multiyear ascent has arguably sent stocks to overvalued levels. The S&P 500’s forward price-to-earnings ratio—a gauge of market valuation based on earnings estimates for the next 12 months—registered 20 as of April 26, exceeding the five-year average of 19.1 and the 10-year average of 17.8, according to FactSet.

“A correction is certainly possible,” says Jack Ablin , chief investment officer at wealth-management firm Cresset Capital, pointing to the high valuations and the prospect that rate cuts will come later than expected thanks to inflation that has been higher than expected.

Given the danger of a stock-market correction, commonly defined as a 10% to 20% drop, how can investors guard the profits they have made in recent years?

Wait and see

Assuming you have a well-diversified portfolio and aren’t counting on the money from your stocks to finance an imminent expense, financial advisers say the best strategy is to hang tight.

Corrections generally don’t stick around long. Since 1985, declines between 10% and 20% for the S&P 500 have lasted only 97 days on average—three-plus months—according to a CFRA analysis of S&P data.

It then has taken the market an additional 101 days on average to recover the ground lost during the correction. So in about six months, investors tend to be back where they were before the correction.

“If there’s a shallow correction of 5% to 10%, we recommend riding it out,” says Karim Ahamed , an investment adviser at wealth-management firm Cerity Partners. “Eventually the market recovers. The idea of selling out and climbing back in is difficult to achieve. You’re more likely to stay on the sidelines with your losses crystallising.”

The S&P 500 did fall more than 5% in recent weeks, from March 28 to April 19.

Sell losers

Some people, though, simply find it impossible to do nothing if they fear a correction is looming. At the least, they want to protect the gains they have earned so far. What’s the most prudent way for them to reduce their market exposure?

Keep in mind that most actions you can take to guard your stock profits carry a cost. The easiest method, selling stocks, subjects you to capital-gains taxes unless you are selling from a tax-advantaged retirement account. That tax rate varies according to your income, but will likely be 15%.

One way to limit the burden is through tax-loss harvesting, says Amanda Agati , chief investment officer of PNC’s asset-management group. That is when you sell stocks at a loss, lowering your net capital gain. If you have any dogs in your portfolio—stocks with poor fundamentals—you can unload those.

If you do sell stocks, you could put the proceeds into a money-market fund for now, financial pros say. Many such funds yield 5% or more, far higher than rates over the past 15 years. Or if you want to increase the safety of your overall portfolio, you could put the money into safe government bonds. Three-year Treasury notes yield around 4.75%.

Play defence

If you are going to unload stocks, but don’t want to sell right away, you can put in a stop-limit sell order through your brokerage. That order can automatically sell your shares if they slide to a level you designate (they can go below it, too), protecting you from big drops.

Say you bought 100 shares of Tesla at $140, and they are now trading at $165. If you don’t want your profit to disappear in a downturn, you could enter a stop-limit sell order with your brokerage at $150 for some or all of your shares. Those shares can be sold if the price reaches $150, securing some of the gains.

You also might shift your holdings more toward defensive stocks, such as utilities and consumer-staple companies, which generally outperform during market downturns, says Michael Sheldon , executive director of wealth-management firm RDM Financial Group.

PNC’s Agati suggests an emphasis on quality stocks, those with high recurring revenues, strong and dependable profit margins, high cash flow and low debt. These stocks—such as AutoZone and Visa , she says—have lagged behind the leaders of the market’s surge over the past year.

Consider options

Advisers also suggest looking at “put” options to protect your stock gains. Puts give you the right but not the obligation to sell a security at a preset price by a preset deadline.

Note that we’re talking about a risk-reduction approach here, not the kind of risk-taking—to try to amplify returns— that has been rampant in the options market . The simplest strategy could be to purchase a put option on a market-index exchange-traded fund, such as one based on the S&P 500. You could buy puts on individual stocks rather than an index ETF, but that may get expensive and complicated as each option carries a purchase premium.

Here’s how the ETF strategy would work: First, buy an option that would let you sell the ETF at a price below the current one, protecting you from declines beneath that level. You wouldn’t have to sell the ETF, and you wouldn’t even have to own it. As the S&P 500 falls, the put option gains in value, and you can sell it.

Say on April 16 you wanted to protect 100 shares of SPDR S&P 500 ETF Trust (SPY) from a decline of more than 10%. With the ETF trading at $505 a share, you could buy an option that covers 100 shares for $1,050, or $10.50 a share. You’re paying a premium equal to 2% of your position.

The option’s expiration date is December, and its strike price is $455 a share, or 10% below the current value. The strike price is the price at which you could exercise the option. But generally you sell the option rather than exercising it, so you don’t have to dump any shares, especially if you don’t own them.

If the market doesn’t go down 10% by December, you let the option expire worthless, and you’re out the $1,050 you paid for it. If the market drops more than 10%, you can sell your option at a profit whenever you want until December.

While it might be more lucrative to sell it early, Ablin recommends holding until expiration if you’re using the option to protect your portfolio. “Think of it like homeowner insurance,” he says. “You pay a premium, like a deductible for insurance, and your coverage runs for a term.”

Keeping the option until expiration extends your coverage for the longest possible period.

By using options, you don’t have to sell any of your stocks, which are typically the best asset to generate strong long-term returns. “If you have the wherewithal to hold the S&P 500 for 10 years, your odds of making money are over 90%,” Ablin says.