Protecting Family Finances Online

An urgent message arrives using a relative's name and mentioning a trip they really are taking. The details make the request believable. Yet those details may have come from public posts rather than from the person whose name appears on the screen.

Protecting family finances online involves both account security and a shared process for handling requests. Technical controls are useful, but a familiar story can still persuade someone to send money or reveal information.

Notice what ordinary posts can reveal

Travel dates, school names, birthdays, family relationships, and workplace details can help an impersonator construct a plausible message. A photograph can also reveal documents, addresses, or location information that was not the intended subject.

Discuss what family members are comfortable sharing and obtain consent before posting about someone else. Privacy settings can limit an audience, but they cannot guarantee that information will remain private or prevent a recipient from copying it.

Make a separate-channel check normal

Agree that an urgent request for money, a new payment destination, or a request for an authentication code will be checked independently. Use a telephone number or contact method already known to be genuine, not one supplied in the suspicious message.

For example, if a message appears to come from a relative who has lost a wallet, pause and contact that person or another trusted contact through the existing address book. An instruction to keep the request secret or act before checking is a reason to slow down.

The FTC's impersonation-scam guidance describes common warning signs. This process should apply even when a voice, image, or writing style feels familiar.

Protect accounts and their recovery paths

Use unique passwords and strong multifactor authentication where available. Keep recovery details current and understand how a lost phone or inaccessible email account would affect access. A password manager can help organize unique credentials, but its own security and recovery arrangements matter too.

Limit access to shared family or business accounts to people who need it. Remove obsolete access after roles change. The CISA social-media protection guide provides account-security measures that complement these habits.

An account with strong authentication can still be misused if an authorized person is deceived into approving a request. Verification and technical controls work together.

Plan what happens after a suspicious event

If money may have been sent fraudulently, contact the bank or relevant provider promptly using a verified channel. If credentials were exposed, follow the provider's recovery process and review related accounts. Keep records of messages and transactions for the institution or authorities handling the report.

A family plan should identify who to contact and where those verified details are kept. Avoid circulating passwords, recovery codes, or sensitive financial documents in an ordinary group chat.

Keep the conversation open

People are more likely to ask for help early when they expect a calm response. Frame the process as a routine household habit rather than a test of someone's technical ability. Younger and older adults can both encounter convincing impersonation attempts.

Revisit the plan as devices, accounts, and responsibilities change. The objective is to reduce opportunities for an avoidable loss and respond quickly when something seems wrong, while recognizing that no process eliminates every risk.

Questions to Discuss With Your Advisor

• How will we independently verify an unusual request involving family money?
• Who can access shared accounts, and are recovery details current?
• Which verified contacts should be available if a suspected fraud occurs?
• What financial documents need a more appropriate sharing method?