Most families know they should do something about their parent’s online security.
They just never quite get around to it.
Not because they don’t care. Because “getting around to it” means figuring out where to start, what actually matters, and how to do it without spending an entire weekend on technology — or starting an argument at the kitchen table.
This checklist solves that problem.
Ten concrete steps. Clear priority order. Realistic time estimates. Everything your parent needs to go from unprotected to genuinely secure — in a single weekend, with no technical expertise required.
The FBI reports that Americans over 60 lost $3.4 billion to cybercrime in 2023. Every item on this list addresses a real, documented attack vector targeting seniors. None of them require more than twenty minutes to complete.
Start at the top. Work down. By Sunday evening, your parent will be more protected than 90% of seniors online.
Before You Start: How to Use This Checklist
Do this together. Sitting side-by-side — or on a video call with screen sharing — works far better than doing it for your parent while they make coffee. Their participation means they understand what’s been set up and why. Our guide on how to talk to elderly parents about online safety has specific scripts if you’re worried about how to start that conversation.
Prioritize the first five items. If you run out of time, items 1 through 5 address the highest-impact vulnerabilities. Items 6 through 10 add meaningful additional protection — but the first five are non-negotiable.
Don’t try to explain everything. For each item, one sentence of plain-English explanation is enough. Your parent doesn’t need to understand AES-256 encryption. They need to know that it works and that you’ve set it up.
Take breaks. An hour of focused setup, then a break, then another hour works better than a four-hour marathon that ends in frustration on both sides.
Let’s get started.
Item 1: Place a Credit Freeze at All Three Bureaus
Time required: 15–20 minutes
Cost: Free
Impact: Prevents new fraudulent accounts from being opened in your parent’s name
This is the single most impactful preventive step available — and one of the least known.
A credit freeze instructs the three major credit bureaus — Equifax, Experian, and TransUnion — to block any new credit applications in your parent’s name. No new credit cards, loans, or financing can be opened without first lifting the freeze. Scammers who obtain your parent’s Social Security number cannot use it to open accounts.
It’s free. It’s reversible anytime. And it stops one of the most common forms of senior identity theft before it starts.
How to do it:
Go to each bureau’s website and create an account to place the freeze:
- Equifax: equifax.com/personal/credit-report-services/credit-freeze
- Experian: experian.com/freeze/center.html
- TransUnion: transunion.com/credit-freeze
Each site requires your parent’s Social Security number, date of birth, and address. The freeze is effective immediately after confirmation.
Write down the PIN or confirmation number each bureau provides — you’ll need this to temporarily lift the freeze if your parent applies for new credit in the future. Store it with the other important documents from this checklist.
The one thing to know: A credit freeze doesn’t affect your parent’s existing accounts or credit score. It only prevents new applications. Your parent can still use their current credit cards, check their credit report, and apply for new credit by temporarily lifting the freeze.
Item 2: Set Up Identity Monitoring
Time required: 25–30 minutes
Cost: ~$12–37/month depending on plan
Impact: Real-time alerts on SSN misuse, financial fraud, and dark web exposure
A credit freeze prevents new accounts. Identity monitoring catches everything else — Social Security misuse, existing account takeover, tax fraud, dark web credential exposure, and dozens of other threat vectors that a freeze doesn’t address.
Think of it this way: a credit freeze is the lock on the front door. Identity monitoring is the security camera system watching the entire property.
For most families, Aura is the strongest choice — simultaneous three-bureau monitoring, alerts in as little as four minutes, dedicated U.S.-based fraud resolution specialists, and $1M in identity theft insurance per adult. The family plan covers up to five adults and lets you receive shared alerts alongside your parent.
If brand recognition matters to your parent — if they’ve heard the name before and that familiarity will make them more likely to engage with alerts — LifeLock with Norton 360 is a credible alternative. We covered both options in detail in our honest review of LifeLock for seniors.
How to set it up:
Go to aura.com (or lifelock.com) and sign up for a family plan. Enter your email as the account manager. Invite your parent as a family member. Enter their Social Security number, date of birth, and address. Configure alert delivery to both your parent’s phone and yours via SMS.
Done. It monitors automatically from that point forward.
Item 3: Install a Password Manager
Time required: 20–30 minutes
Cost: ~$3–5/month
Impact: Eliminates password reuse — the #1 cause of account takeover
If your parent uses the same password on multiple accounts — and most do — a single breach at any website exposes everything. Their email. Their bank. Their Medicare portal. All of it, compromised by one stolen password from one website breach they had nothing to do with.
A password manager solves this completely. 1Password generates and stores a unique, strong password for every account. Your parent remembers exactly one master password — or uses Face ID on their phone. 1Password handles everything else automatically.
The setup process also surfaces every weak or reused password currently in use — giving you a clear picture of what needs to be fixed and a tool to fix it.
For the complete setup walkthrough including how to generate a memorable master passphrase, see our guide to creating a strong password seniors will actually remember.
How to set it up:
Go to 1password.com and sign up for the Families plan. Install the app on your parent’s phone and computer. Install the browser extension. Enable Face ID or fingerprint login on mobile. Save their three or four most-used passwords together during this session. Print and store the Emergency Kit.
Item 4: Enable Two-Factor Authentication on Critical Accounts
Time required: 5–10 minutes per account
Cost: Free
Impact: Blocks 99.9% of automated login attacks even with a stolen password
Two-factor authentication adds a second verification step — usually a text message code — after the password. Even if a criminal has your parent’s password, they can’t log in without also having your parent’s phone.
It is the most impactful single security setting available on any online account. It costs nothing and takes five minutes per account.
Start with these accounts, in this order:
- Email (most important — it’s the recovery address for everything else)
- Online banking
- Medicare.gov
- SSA.gov (my Social Security)
- Amazon
For each account: go to Security Settings → Two-Factor Authentication → enable → choose Text Message → verify with your parent’s cell phone number.
Our complete guide to setting up two-factor authentication for elderly parents covers every major platform with step-by-step screenshots.
The one thing to say to your parent:
“After you type your password, your phone will get a text with a short code. You type that code in. That’s all. It takes ten extra seconds and makes your account almost impossible to break into.”
Item 5: Install Antivirus Software
Time required: 15–20 minutes
Cost: ~$40–50/year
Impact: Blocks malware, phishing sites, tech support scam popups, and ransomware
The fake “your computer has a virus” popup that fills the screen with alarm sounds and a phone number to call. The malicious email attachment that installs spyware silently. The ransomware that encrypts decades of family photos and demands payment.
Bitdefender Total Security blocks all of these automatically — before they cause harm. It runs silently in the background, requires no input from your parent, and consistently earns the highest independent test ratings in the industry.
The Autopilot feature makes all security decisions automatically, without prompting your parent for input. No confusing “allow or block?” questions. No alarming red screens. Just quiet, continuous protection.
One license covers up to five devices — your parent’s laptop, phone, and tablet, plus your own devices.
How to set it up:
Go to bitdefender.com and purchase Total Security. Download and install on your parent’s computer. Run the first full scan. Enable Autopilot. Install Bitdefender Mobile Security on their phone via the App Store or Google Play.
Item 6: Set Up a VPN
Time required: 10–15 minutes
Cost: ~$4–5/month
Impact: Encrypts internet connection on all networks, especially public WiFi
If your parent ever uses the internet outside their home — at a library, coffee shop, doctor’s office, or the grandkids’ house — a VPN encrypts every bit of data they send and receive. Anyone monitoring that network sees nothing usable.
NordVPN is our top recommendation for seniors. One-button interface. Auto-connect means it activates automatically on every network. Threat Protection blocks malicious websites before they load.
The complete installation walkthrough — covering iPhone, Android, Windows, and Mac — is in our guide to setting up NordVPN for elderly parents.
The one thing to say to your parent:
“I’ve set up a program that protects your internet connection automatically whenever you go online — at home, at the library, everywhere. You don’t need to do anything. It just runs.”
Item 7: Review and Tighten Facebook Privacy Settings
Time required: 10–15 minutes
Cost: Free
Impact: Reduces the personal information available to scammers for targeted fraud
Facebook is the primary social media platform for seniors — and one of the most common hunting grounds for scammers who clone profiles, run romance fraud, and send fake investment opportunities.
Tightening privacy settings doesn’t mean your parent stops using Facebook. It means scammers have less information to work with when targeting them.
The key settings to change:
Log into Facebook on a computer. Go to Settings & Privacy → Privacy Settings:
- “Who can see your friends list?” → Friends
- “Who can send you friend requests?” → Friends of Friends
- “Who can look you up using your email?” → Only me
Go to the Profile and remove or restrict: birthdate visibility, hometown, workplace, and family relationships set to public.
Turn on “Review posts you’re tagged in before they appear on your timeline.”
The full playbook — including what to do about Facebook Marketplace scams and romance fraud — is in our guide to how scammers target seniors on Facebook.
Item 8: Enable Spam Call and Text Filtering
Time required: 10 minutes
Cost: Free to ~$4/month for premium apps
Impact: Reduces scam calls, robocalls, and smishing attempts
Most scam calls and smishing texts are delivered through the same phone number databases — lists of seniors purchased from data brokers and dialed automatically.
Two steps address this:
On the phone:
- iPhone: Settings → Phone → Silence Unknown Callers → On. Settings → Messages → Filter Unknown Senders → On.
- Android: Phone app → Settings → Caller ID & Spam → Filter spam calls → On.
Install a dedicated call-blocking app:
Nomorobo (free for basic, paid for mobile premium) or Robokiller (~$4/month) cross-reference incoming calls against databases of known scam numbers and block them before the phone rings.
The rule your parent needs:
“If you don’t recognize the number, don’t answer. Legitimate callers leave voicemails. Scammers usually don’t.”
Item 9: Remove Personal Data from Broker Sites
Time required: 10 minutes to set up (runs automatically after)
Cost: ~$7–13/month
Impact: Reduces targeted scam calls, phishing emails, and smishing texts
Data brokers — companies that compile and sell personal information — are a primary source for the targeting lists scammers use. Your parent’s name, address, phone number, email, age, and personal interests are available for purchase from hundreds of these sites.
Incogni contacts these brokers automatically and legally demands they remove your parent’s information. It’s an ongoing service — brokers re-add data regularly, so continuous removal matters more than a one-time cleanup.
Less personal data available means fewer targeted calls, less personalized phishing, and less convincing scam attempts. It makes every other protection layer more effective by reducing the raw material criminals work with.
How to set it up:
Go to incogni.com and sign up. Enter your parent’s name, address, and email. Incogni begins the removal process across hundreds of data brokers immediately. A dashboard shows which brokers have been contacted and which have complied.
Item 10: Create a Family Emergency Protocol
Time required: 15 minutes
Cost: Free
Impact: Stops grandparent scams, impersonation fraud, and panic-driven financial decisions
This is the only item on the list that doesn’t involve technology — and it may be the most valuable conversation you have all weekend.
Three things to establish before you leave:
The family code word.
Choose a word or phrase that only immediate family members know. If anyone — a “grandchild,” a “police officer,” a “Medicare agent” — contacts your parent claiming there’s an emergency and asks for money or information, your parent asks for the code word. No code word means the call is fraudulent. No exceptions, no matter how convincing the story.
The “call before you send” rule.
Before your parent sends any money — of any amount — to anyone they didn’t initiate contact with, they call you first. Frame it as a two-minute check-in, not as asking for permission.
The hang-up and call-back habit.
If any caller claims to be from the government, a bank, Medicare, or Social Security — your parent hangs up. Not rudely. Just firmly. Then, if they want to verify, they call the organization directly using a number from the official website. Not a number the caller provided.
Write these three rules on an index card. Put it near the phone.
Your Weekend Schedule: How to Do All 10 Items
Saturday Morning (90 minutes)
- Item 1: Credit freeze at all three bureaus (~20 minutes)
- Item 2: Identity monitoring setup — Aura or LifeLock (~30 minutes)
- Item 3: 1Password setup and first passwords saved (~30 minutes)
- Break
Saturday Afternoon (75 minutes)
- Item 4: Two-factor authentication on email and bank (~30 minutes)
- Item 5: Bitdefender installation and first scan (~20 minutes)
- Item 6: NordVPN installation and auto-connect setup (~20 minutes)
- Break
Sunday Morning (60 minutes)
- Item 7: Facebook privacy settings review (~15 minutes)
- Item 8: Spam call and text filtering setup (~10 minutes)
- Item 9: Incogni setup (~10 minutes)
- Item 10: Family emergency protocol conversation (~15 minutes)
- Review and questions (~10 minutes)
Total time: Approximately four hours across two days, with breaks.
The Best Tools Referenced in This Checklist
🥇 Aura — Best Identity Monitoring
Real-time alerts in as little as 4 minutes. All three credit bureaus monitored simultaneously. $1M identity theft insurance per adult. U.S.-based fraud resolution specialists. Family plan covers up to five adults.
→ Try Aura free for 14 days — Our #1 Pick
🔐 1Password — Best Password Manager
One master password. Unique strong passwords for every account. Face ID convenience on mobile. Watchtower alerts for breached passwords. Family plan with shared vault access.
🛡️ NordVPN — Best VPN
One-button interface. Auto-connect on every network. Threat Protection blocks malicious sites. Covers 10 devices on one subscription. 30-day money-back guarantee.
🦠 Bitdefender — Best Antivirus
99.9%+ detection rate. Autopilot makes all decisions automatically. Blocks tech support scam popups. Covers 5 devices. Minimal impact on older computers.
→ Get Bitdefender Total Security
🧹 Incogni — Best for Data Removal
Removes personal data from hundreds of broker databases automatically. Ongoing removal — not a one-time cleanup. Reduces targeted scam calls and phishing at the source.
What to Do After the Weekend: Maintenance in 15 Minutes Per Quarter
The setup weekend is the heavy lift. Maintenance is minimal.
Every three months:
- Check that all five tools are running and subscriptions are active
- Review the 1Password Watchtower for any new breach alerts
- Check for software updates on all devices (or confirm automatic updates are on)
- Review any Aura or LifeLock alerts from the past quarter
- Refresh the family emergency protocol — remind your parent of the code word
Once a year:
- Review and update the list of accounts saved in 1Password
- Check Facebook privacy settings haven’t reset after app updates
- Confirm the credit freeze is still in place at all three bureaus
- Review Incogni’s removal report and renewal
Immediately when something changes:
- New phone or computer → reinstall NordVPN, Bitdefender, and 1Password before using
- New phone number → update 2FA settings across all accounts and notify Aura/LifeLock
- Suspected scam contact → call you before doing anything else
Conclusion: The Weekend That Changes Everything
Most seniors who get scammed online weren’t careless. They were unprotected.
The gap between careless and protected is not a matter of intelligence or attention. It’s a matter of whether the right tools are in place before the right criminal comes along.
This checklist closes that gap. A credit freeze. Identity monitoring. Strong passwords. Two-factor authentication. Antivirus. A VPN. Tighter privacy settings. Scam call filters. Data removal. A family protocol.
Ten items. One weekend. Years of protection.
Your parent has spent a lifetime protecting you. This is one weekend where you get to return the favor — quietly, practically, and in a way that actually keeps them safe.
Start with Item 1 this Saturday morning.
Frequently Asked Questions
Q: Do I really need all 10 items, or will just a few do?
Items 1 through 5 address the highest-impact vulnerabilities and should be considered non-negotiable for any senior who uses the internet. Items 6 through 10 add meaningful additional layers — each one closes a real attack vector. The complete checklist is the complete protection. But if you can only do half this weekend, start at the top.
Q: What if my parent resists some of these steps?
Focus on the ones they’ll accept first. A partial setup that your parent trusts and engages with delivers more real-world protection than a comprehensive setup they ignore. The credit freeze (Item 1) is the most impactful step that requires zero ongoing engagement from your parent — start there regardless.
Q: How much does the full checklist cost per month?
Roughly $65–80/month for the complete stack: Aura family plan (~$37), 1Password families (~$5), NordVPN (~$5), Bitdefender (~$4), and Incogni (~$13). The credit freeze, 2FA, Facebook settings, and emergency protocol are free. For context, the average romance scam loss for a senior is over $9,000. The complete stack costs less than one month of an average scam’s financial damage.
Q: My parent already has some of these. Do I still need to go through the checklist?
Yes — but focus on the gaps. Having antivirus doesn’t mean it’s configured correctly. Having a password manager doesn’t mean 2FA is enabled. Use this checklist as an audit of what’s in place and what’s missing, not just a setup guide.
Q: What’s the most common mistake families make when setting this up?
Doing everything for their parent without explaining what’s been set up or why. If your parent doesn’t know they have identity monitoring, they won’t respond to alerts. If they don’t understand the family code word, they won’t use it under pressure. The setup matters. The conversation about the setup matters just as much.