The Phone Call Isn't Always Who It Says It Is: Digital Security for Older Adults

The telephone network was built on the assumption that the number in a call setup request was trustworthy, the same way early email assumed a From address meant what it said. Neither assumption survived contact with people who had a reason to lie about it. Caller ID spoofing tools are widely available, and scammers use them specifically to display a number that matches your bank, your grandchild's area code, or a real government agency.

The fix the industry actually built

Phone carriers have deployed a framework called STIR/SHAKEN, which lets a carrier cryptographically attest that a call actually originated from the number it claims. It genuinely reduces spoofing on calls that stay within participating carrier networks. It does not cover every call path, particularly international origination points that route through carriers outside the framework, which is exactly where a lot of scam call centers operate from. The honest summary: caller ID is more trustworthy than it was five years ago, and still not trustworthy enough to be the only check.

Grandparent scams and the voice cloning problem

The classic version of this scam is a call claiming to be a grandchild in trouble, arrested, in a car accident, needing bail or medical money wired immediately, with urgency deliberately built in to prevent the target from calling anyone to verify. The scam has worked for years on voice alone, because a stressed, crying voice on a bad connection is hard to positively identify or rule out from memory.

What has changed is how little audio is now needed to produce a convincing fake of a specific person's voice. A short public video, a voicemail greeting, even a few seconds of a social media clip, can be enough source material for current voice cloning tools to generate a synthetic clip. This does not require the caller to be technically sophisticated; the same generation is available as a hosted service, which means the barrier to running this scam has dropped for the "urgent stressed voice" version specifically.

The call-back rule

The single most reliable technical defense against both spoofed caller ID and a cloned voice is the same action: hang up, and call back using a number you already had before the call, not one the caller gave you and not the number that showed on the display. A bank, a government agency, or an actual family member will not be upset that you verified independently. A scammer's entire plan depends on you not taking that thirty seconds.

Government impersonation and the urgency script

A distinct family of scams spoofs a government agency directly, the Social Security Administration, the IRS, a county sheriff's office, and pairs the faked number with a script built entirely around manufactured urgency: your Social Security number has been suspended due to suspicious activity, there's a warrant out for unpaid taxes, a fine must be paid today by gift card or wire transfer to avoid arrest. Real government agencies do not operate this way. The IRS's own guidance states plainly that it initiates most contact by mail, not by phone, and never demands payment by gift card. The Social Security Administration does not suspend Social Security numbers; that isn't a mechanism that exists in how the agency actually operates. Knowing that one fact, that the premise of the call is structurally impossible, defuses the entire script regardless of how convincing the caller ID looks.

Romance scams and the slower con

Not every scam is urgent. Romance scams build a relationship over weeks or months on a dating platform or social media before any request for money appears, and by the time it does, the emotional investment makes skepticism feel like a betrayal rather than a reasonable check. The technical tell is usually consistency: a profile with few photos, a story that avoids video calls or in-person meetings, and a relationship that stays entirely inside one messaging app the scammer controls. The financial tell is any request that can't be reversed, wire transfers, gift cards, cryptocurrency, which is precisely why scammers ask for those methods specifically.

Account hardening that respects autonomy

Family members who want to help without overstepping have a narrower, more respectful set of options than taking over an account outright:

• Set up login alerts on email and banking so a notification goes out on any new device sign-in, visible to the account holder, not hidden from them.
• Add, don't replace, a password manager so unique passwords exist per site without anyone else holding the master password.
• Review account recovery options together, since a recovery phone number or email that's outdated is exactly what makes an account unrecoverable after a real takeover attempt.
• Agree on the verification phrase as a family, explicitly, before it's ever needed, rather than assuming everyone would think to ask for one under pressure.

None of this requires the family member being protected to become a security expert. It requires a small number of habits set up once, in a calm moment, so they're available in the moment that isn't calm.

One more habit is worth naming on its own: agreeing, as a family, that no request for money or gift cards over the phone gets acted on the same day, regardless of who it appears to be from or how urgent it sounds. Legitimate emergencies can wait the hour it takes to call back on a known number and confirm. Scams are built specifically so that they can't. That single delay, refusing to act inside the window the caller is trying to create, does more work than any piece of software on this list.