Helping a Family Member Who Fell for Phishing
A parent, partner or friend clicked a phishing link or gave away details. How to help them secure accounts, contact the bank, report it and recover their confidence, step by step.
When someone you love calls to say "I think I did something silly", how you respond matters as much as what you do. Stay calm, thank them for telling you, and work through it together.
Step 1: find out what happened
Ask gently, without judgment:
- What did the message say, and how did it arrive?
- Did they click a link, open a file, or call a number?
- Did they enter a password, a code, card details or bank details?
- Did they send money or let someone onto their device?
Step 2: act in the right order
| What they shared | What to do first |
|---|---|
| Card or bank details, or sent money | Call the bank on the number on the card. See what to tell your bank. |
| A password or code | Change the password and sign out all sessions. See entered a password on a phishing page. |
| Remote access to their device | Disconnect from the internet and follow after giving remote access. |
| Only clicked a link | Close the page and run a security check. See clicked a phishing link. |
Step 3: report it
Report the message and any losses. See where to report phishing. In the US, the AARP Fraud Watch Network Helpline (877-908-3360) offers free support to anyone. In England and Wales, Victim Support offers free help after fraud.
Step 4: make it harder next time
- Set up two-step verification together. See securing accounts for older relatives.
- Agree a simple rule: "If a message asks for money, codes or passwords, call me first."
- Agree a family code word for urgent calls.
Watch for follow-up scams. People who have been phished are often contacted by fake "recovery" services. See recovery scams.
Give them a tool to check. Anyone can paste a suspicious message into CyberWatch AI Scan for a free check.
For more, see how to report phishing in our complete guide.
Frequently asked questions
What should I do first?
Find out what they shared: a password, a code, card details or money. That decides the order. Money and card details mean calling the bank first.
How do I talk about it without making them feel stupid?
Say clearly that phishing is designed by professionals to fool people, that anyone can fall for it, and that telling you was the right thing to do.
Should I take over their accounts?
Help them, but let them stay in control where possible. Set things up together so they understand and can manage them later.
Sources
- Recovering a hacked account, UK National Cyber Security Centre
- Report Fraud to the AARP Fraud Watch Network Helpline, AARP
- Victim Support, Victim Support
- IdentityTheft.gov, US Federal Trade Commission
