Your Digital Privacy & Safety Guide
for Seniors and Beginners

Clear, step-by-step guidance in plain language — no advanced technical experience needed

📋 Jump to a Section

Part 1 — Start Here

  1. Protecting Your Passwords
  2. Freeze Your Credit
  3. Your Phone and Computer

Part 2 — Everyday Safety

  1. Recognising Scams
  2. Browsing the Web Safely
  3. Email Safety
  4. Social Media Privacy
  5. Shopping Online Safely

Part 3 — Staying Off the Radar

  1. Removing Your Info from the Internet

Part 4 — If You Need Help

  1. If Something Goes Wrong
  2. Letting Family Help You
  3. Plain-Language Word List
  4. Getting More Help

⭐ Your 5 Most Important Steps

  1. Use a different, strong password for every account — a password manager does this for you automatically
  2. Turn on two-step sign-in for your email — so only you can access it, even if your password is stolen
  3. Freeze your credit at all three bureaus — it's free and stops criminals from opening accounts in your name
  4. Never click links in unexpected emails or text messages — go directly to the website yourself instead
  5. Remove your personal information from people-search websites — your address and phone number are searchable by anyone right now

Start with these 5 — they matter most. The rest of this guide is organised into 4 parts below, walking through everything else step by step. There's no rush; work through it at whatever pace feels comfortable.

💡 A note on menu instructions: This guide gives exact menu names like "Settings → Privacy & Security" — but phones and computers update their menus from time to time, so what you see may be worded slightly differently. If a step doesn't match exactly, look for a similarly named option, or search your device's Settings app for words like "privacy," "security," or "passwords" to find it.

Prefer paper? Print a copy to keep by your computer or share with a friend.

Part 1 of 4 — Start Here Your foundation: the 3 sections that protect you most

🔑Protecting Your Passwords

Why this matters: Most account takeovers happen because people use the same password on multiple websites. When one site gets hacked, criminals try that password everywhere else — including your bank and email.

Use a password manager

A password manager is a secure app that remembers all your passwords so you only need to remember one. It also creates strong, unique passwords for every website automatically.

✅ Bitwarden — recommended (free)
Download at bitwarden.com. Free, trusted, and works on your phone, tablet, and computer. An independent security firm checks it every year.

Getting started with Bitwarden

  1. 1
    Go to bitwarden.com and click "Get Started Free"
  2. 2
    Create one strong master password. Try combining three random words you can picture, like "PurpleCoffeeWindow82". Make it memorable to you, but avoid your birthday or pet's name
  3. 3
    Write this master password down and keep it somewhere safe at home (not on your computer)
  4. 4
    Each time you log into a website, let Bitwarden save the password — over time it builds up your secure vault
  5. 5
    When you need a new password anywhere, click "Generate" in Bitwarden — it will create a strong one for you
💡 Tip: Your browser (Chrome, Firefox, Safari) also offers to save passwords — this is better than nothing, but Bitwarden is more secure, works everywhere, and is checked by independent experts.

Two-step sign-in (also called "two-factor authentication")

Why this matters: Even if someone knows your password, two-step sign-in means they still can't get into your account. It sends a code to your phone as a second check.

Turn on two-step sign-in for your email first — it's the most important account to protect. A text message (SMS) code is the easiest way to start.

Turn on two-step sign-in for Gmail

  1. 1
    Go to myaccount.google.com
  2. 2
    Click Security in the left-hand menu
  3. 3
    Under "How you sign in to Google," click 2-Step Verification
  4. 4
    Follow the steps to add your phone number — Google will text you a code each time you sign in

Turn on two-step sign-in for a Microsoft / Outlook account

  1. 1
    Go to account.microsoft.com and sign in
  2. 2
    Click Security, then Advanced security options
  3. 3
    Under "Two-step verification," click Turn on and follow the steps
💡 Signing in with your face, fingerprint, or PIN: Your phone or newer computer may offer to let you sign in to apps and websites using your fingerprint, your face, or the same PIN you use to unlock your device — instead of typing a password. This is called a "passkey," and it's both safe and easier — it can't be guessed or stolen the way a password can. If you don't use fingerprint or face unlock, a passkey still works with your device PIN. If you're offered this option when signing in, it's fine to say yes.

Lock your phone number with your phone company

Why this matters: Text-message codes go to your phone number, not your phone. A criminal who convinces your phone company to move your number onto their phone will start receiving your codes — and can then get into your email and your bank. Locking your number stops this, it is free, and you only do it once.
  1. 1
    Verizon: in the My Verizon app, go to Account Settings and turn on Number Lock. Also set an Account PIN
  2. 2
    AT&T: in the myAT&T app, go to Profile, then Sign-in Info, and set an Account Passcode. Also turn on Wireless Account Lock
  3. 3
    T-Mobile: in the T-Mobile app, go to Profile Settings, then Privacy and Notifications, and turn on Account Takeover Protection
  4. 4
    If you are not sure, call your phone company and ask them to "lock my number so it cannot be transferred"
💡 Before you get a new phone: this lock also stops you from moving your number, so tell the shop assistant it is on. You unlock it the same way you turned it on, or by calling your phone company.

Sign-in checklist

🔒Freeze Your Credit — Free and Essential

Why this matters: Identity thieves use stolen personal information to open credit cards, loans, and phone contracts in your name. A credit freeze blocks anyone from opening new accounts using your name — without affecting your existing accounts or credit score at all.

You must freeze your credit at all three bureaus. It is free by law, takes about 10 minutes per bureau, and you can temporarily lift it any time you need to apply for credit.

Freeze your credit at all three bureaus

💡 Keep your PIN or password for each bureau in a safe place — you will need it to temporarily lift the freeze if you apply for a new credit card, loan, or phone contract. Write it down and store it with your important documents.
💡 Also set up free fraud alerts: Visit annualcreditreport.com to check your credit reports for free once a year from all three bureaus. Look for any accounts you do not recognise.
⛔ Do not search for the credit bureau's phone number

Criminals pay for adverts so that fake phone numbers and fake websites appear at the top of search results for things like "Equifax freeze". People have called these numbers believing they were real.

What to do: use only the addresses and numbers printed above, or type the company's name directly into the address bar yourself.

Turn on alerts from your bank

Why this matters: Checking your statement once a month means fraud can run for weeks before you notice. An alert tells you within seconds, while the bank can still stop it. This is the single most useful thing you can switch on with your bank.

Log in to your bank's website or app, look for Alerts or Notifications in the settings, and turn on a text or email alert for every card payment and every withdrawal. If you would rather not do this yourself, your bank will set it up over the phone or at a branch.

Guard your Medicare number

Why this matters: Your Medicare number is as valuable to a criminal as your bank details. It is used to bill for treatment you never had, which costs the programme billions and can leave wrong information in your medical record.
💡 If you see something you don't recognise on a Medicare statement, call 1-800-MEDICARE (1-800-633-4227). Being wrong costs nothing; staying quiet can cost a great deal.
💡 Never carry your Social Security card in your wallet. Keep it in a safe place at home. If your wallet is ever lost or stolen, a thief should not be able to find your Social Security number along with your ID.

📱Your Phone and Computer

Why this matters: Outdated phones and computers have known security weaknesses that criminals actively target. Keeping them updated is one of the simplest and most effective things you can do.

Keep everything updated

Use a strong PIN on your phone

Use a 6-digit PIN rather than your birthday, 123456, or a simple pattern. Face ID and fingerprint are convenient, but a PIN is more secure if your phone is ever lost or stolen.

Check what your apps can access

Many apps ask for access to your location, microphone, contacts, and camera — even when they don't need it. Review and remove any permissions that seem unnecessary.

💡 Tip: If an app like a flashlight or a simple game asks for your contacts or location, that is a warning sign — deny it or delete the app.

Protect your computer from viruses and malware

Why this matters: Malicious software can steal your passwords, spy on you through your webcam, or lock your files and demand payment to get them back.

Windows computers come with a free built-in security program called Windows Defender. Make sure it is turned on:

  1. 1
    Click the Start button and type "Windows Security"
  2. 2
    Click Virus & threat protection
  3. 3
    Make sure it says "No action needed" — if not, follow the prompts to turn it on

Mac computers have built-in protection called XProtect that runs automatically. Keep your Mac updated and you do not need to install extra antivirus software.

💡 Avoid free antivirus programs advertised online — many of these are scams themselves, or they collect and sell your data. Windows Defender on Windows and the built-in protection on Mac are free, trusted, and sufficient for most people.

Keep a copy of your photos and documents

Why this matters: Some harmful programs lock up every file on your computer and demand payment to unlock them. If you have a copy of your files somewhere else, you can ignore the demand entirely. A copy also protects you from a computer that simply stops working, which is far more common.

The easiest approach is to let it happen automatically:

  1. 1
    iPhone or iPad: Settings → tap your name → iCloud → turn on Photos and iCloud Backup
  2. 2
    Android: Settings → Google → Backup → turn on Backup by Google One
  3. 3
    Windows or Mac: plug in an external hard drive (about $60 from any electronics shop) and turn on File History on Windows, or Time Machine on a Mac. It then copies your files on its own
💡 Unplug the drive when it has finished. A harmful program can only reach a drive that is connected. A drive sitting in a drawer is safe from anything happening on your computer.

Reduce scam phone calls (robocalls)

Why this matters: Most phone scams arrive as robocalls — automated calls from criminals. Reducing these means fewer opportunities for scammers to reach you.
Part 2 of 4 — Everyday Safety Spotting scams and staying safe while browsing, emailing, and shopping

⚠️Recognising Scams

Why this matters: Americans over 60 reported losing $7.7 billion to online scams in 2025 — a 59% rise in a single year (FBI IC3). The scammers are skilled and convincing — but they always follow patterns you can learn to recognise.
⛔ Real organisations NEVER do these things

Common scam types

💻 Tech Support Scam

You see a pop-up or get a call saying your computer has a virus. The caller, claiming to be from Microsoft, Apple, or your internet provider, asks to remote into your computer.

What to do: Hang up. Close the pop-up (restart if needed). Call Microsoft or Apple yourself using the number on their official website if you're concerned.

🏛️ Social Security / Medicare Scam

A caller says your Social Security number has been linked to criminal activity and will be suspended unless you pay immediately or provide your number to "verify" your identity.

What to do: Hang up. The Social Security Administration will never call you like this. If concerned, call SSA directly at 1-800-772-1213.

👨‍👩‍👧 Grandparent Scam

Someone calls pretending to be your grandchild (or a lawyer or police officer calling on their behalf), saying they're in trouble — arrested, in a hospital, or in an accident — and need money urgently. They beg you not to tell anyone.

What to do: Hang up and call your grandchild directly on their usual number. Never send money before speaking to them yourself.

💡 Set up a family code word: Agree on a secret word or phrase with your children and grandchildren that only your real family would know. If anyone calls claiming to be a relative in trouble, ask for the code word before doing anything else.
🤖 AI Voice Cloning ("Deepfake") Scams

A newer, more convincing version of the grandparent scam. Criminals use free AI tools to clone a real person's voice from just a few seconds of audio taken from a social media video, then call sounding exactly like your child or grandchild, panicked and asking for money. Caller ID can be faked too, so a familiar name on your phone proves nothing.

What to do: Hang up and call your family member back on the number you already have for them. Ask for your family code word — no AI can fake that. Stay calm and never send money, gift cards, or cryptocurrency based on a phone call alone, no matter how real the voice sounds.

💡 Limit how much of your family's voice is public. Consider setting family members' social media videos to "Friends Only" rather than Public — this makes it harder for scammers to find audio to clone in the first place.
💌 Romance Scam

Someone you've met online — on a dating site, Facebook, or even in a game — develops a romantic relationship with you over weeks or months, then has an emergency and needs money. They may have a convincing story, photos, and even video calls.

What to do: Never send money to someone you haven't met in person. Talk to a trusted family member or friend before doing anything. Report to the FTC at reportfraud.ftc.gov.

📧 Phishing Email or Text

An email or text that looks like it's from your bank, Amazon, the IRS, or even a family member, asking you to click a link, confirm your details, or pay an outstanding bill.

What to do: Don't click any links. Go directly to the company's website by typing the address yourself, or call them using a number you find yourself — not the one in the message.

🔁 The "we can get your money back" scam

This one follows a scam you have already suffered. Someone contacts you claiming to be a lawyer, an investigator, a government office, or a recovery company, and says they can get your lost money back — for a fee paid up front, or after you confirm your bank details. They may know exactly what happened to you, because lists of scam victims are bought and sold between criminals.

What to do: treat any unexpected offer to recover money as a second scam, because it nearly always is. No genuine government office charges a fee to help you. If you have already reported the fraud, the real agencies will contact you through the case you opened — not out of the blue.

📱 Text Message Scams ("Smishing")

A text message about a package delivery problem ("your parcel is held, click here"), an unpaid toll or bill, a "suspicious charge" on your account, or a wrong-number text from a friendly stranger who slowly tries to build a relationship. These are among the most common scams today. The link leads to a fake website designed to steal your details.

What to do: Don't tap the link or reply — even replying "STOP" tells them your number is active. Delete the message. If you're worried it might be real, contact the company directly using their official app or website. On iPhone and Android you can report the message as junk or spam.

💡 If you think you've been scammed: Tell a family member right away. Contact your bank immediately if any money has moved. Report to the FTC at reportfraud.ftc.gov or call 1-877-382-4357. AARP Fraud Helpline: 1-877-908-3360 (free, live advice).

🌐Browsing the Web Safely

Why this matters: The browser you use and the search engine you type into collect detailed records of everything you look up — and sell that information to advertisers.
✅ Firefox — recommended browser (free)
Download at firefox.com. Firefox is made by Mozilla, a non-profit, and does not sell your browsing history. It works on Windows, Mac, iPhone, and Android.
✅ DuckDuckGo — recommended search engine (free)
Instead of Googling something, go to duckduckgo.com and search there. It gives you the same results without tracking what you search.

How to set DuckDuckGo as your default search in Firefox

  1. 1
    Open Firefox and click the three horizontal lines (menu) in the top-right corner
  2. 2
    Click Settings, then Search
  3. 3
    Under "Default Search Engine," choose DuckDuckGo
✅ uBlock Origin — blocks adverts and fake warnings (free)
This is a free addition to Firefox that hides adverts. It matters for safety as well as tidiness: those alarming "YOUR COMPUTER IS INFECTED" boxes arrive through advertising, and this stops most of them appearing at all. In Firefox, open the menu (three lines), choose Add-ons and themes, search for uBlock Origin, and click Add. There is nothing to set up afterwards. Note that it no longer works properly in Chrome, which is a good reason to use Firefox.

Look for the padlock

When shopping or banking online, always check that the address bar shows a 🔒 padlock icon and that the address starts with https:// (the "s" stands for secure). Never enter passwords or payment information on a page without this.

Using public WiFi safely

At a coffee shop, library, or airport, the WiFi connection is shared with strangers. Avoid logging into your bank or email on public WiFi. If you must, use a VPN — a tool that creates a secure private connection.

✅ Proton VPN — free option for public WiFi
Download at protonvpn.com. The free version is enough for occasional use on public WiFi. A trusted, well-reviewed company that does not track or sell what you do online.

📧Email Safety

Why this matters: Gmail and Outlook scan your emails to show you targeted ads. More importantly, your email is the key to every other account — if someone gets into your email, they can reset your password for your bank, Amazon, and everything else.

Protect your existing email account

How to spot a phishing email

Criminals send emails that look exactly like messages from your bank, Amazon, or the government. Watch for these warning signs every time you receive an unexpected email:

🔍 Warning signs of a phishing email
💡 When in doubt, don't click. Go directly to the company's website by typing the address yourself, or call them on a number you look up independently — never use a number given in the email.

Want a more private email?

✅ Proton Mail — private email (free)
Available at proton.me. Based in Switzerland, Proton cannot read your emails — they are encrypted. Good option if starting fresh or wanting a second more private address.

👥Social Media Privacy

Why this matters: Your public social media posts can tell strangers your home address, daily routine, when you're away on holiday, and information about your family — all of which can be used by scammers or burglars.

Facebook privacy settings

  1. 1
    Click the three horizontal lines (menu) and go to Settings & Privacy → Settings
  2. 2
    Under Audience and Visibility → Posts, change "Who can see your future posts" to Friends
  3. 3
    Under How People Find and Contact You, set "Who can send you friend requests" to Friends of friends
  4. 4
    Under Apps and Websites, remove any apps you don't recognise or no longer use
⚠️ What NOT to share on social media

Social media checklist

🛒Shopping Online Safely

Why this matters: Online shopping fraud is one of the most common scams. Fake websites can steal your card details and your money.
⚠️ "Too good to be true" is a real warning, not just a saying

Scam shopping sites often advertise designer items, electronics, or furniture at 60–90% off. They copy real product photos and may even have fake "reviews." You pay, but the item never arrives — or a cheap counterfeit shows up instead.

What to do: If a deal seems far better than anywhere else, search the website name plus the word "scam" before buying. Be especially cautious with ads you see on Facebook or Instagram from brands you don't recognise.

Before you buy anything online

💡 Check before you trust: Search the website name plus the word "scam" or "reviews" to see what others say. Sites like Trustpilot can help.

Virtual card numbers — an extra layer of protection

A virtual card number is a stand-in number you give to a shop instead of your real card number. If that shop is later hacked, the criminals only get the stand-in — your real card is untouched.

✅ Best option — ask your own credit card company
Several credit card companies give you these free, including Capital One (called Eno) and Citi (called virtual account numbers). Ring the number on the back of your card and ask whether they offer virtual card numbers. This is the best choice because the protection stays with your credit card, which is the strongest protection you have.
✅ Privacy.com — if your card company doesn't offer it
Available at privacy.com, free, and only for people living in the United States with a US bank account. Create a separate card number for each shop, set spending limits, and cancel any card instantly. One thing to know: these cards take the money from your bank account rather than a credit card, so if something goes wrong the money leaves your account while it is sorted out. For that reason a virtual number from your own credit card company is the better choice when you can get one.
Part 3 of 4 — Staying Off the Radar Reducing how easily scammers can find your information

🗑️Removing Your Information from the Internet

Why this matters: Companies called "data brokers" collect and publish your full name, home address, phone number, relatives' names, and sometimes financial information. Anyone can search for you and find this — including scammers who use it to make their calls more convincing.

You can opt out of these sites for free, but it takes time and must be repeated every few months because sites repopulate the data. A paid service can automate this for you.

✅ DeleteMe — automated removal service ($129/year)
Available at joindeleteme.com. Searches dozens of data broker sites, submits opt-out requests on your behalf, and sends you a report. Worth it for the time saved and the ongoing protection.
✅ Optery — automated removal service (has a free tier)
Available at optery.com. Works like DeleteMe, and offers a free basic scan plus paid plans that remove your information automatically. A good option if you'd like to try it before paying.
✅ Free option — manual opt-out list
A journalist named Yael Grauer maintains a free guide to opting out of every major data broker yourself. Search for "Big-Ass Data Broker Opt-Out List" on GitHub or ask a family member to help.
Part 4 of 4 — If You Need Help What to do if something happens, and where to turn

🆘If Something Goes Wrong

Why this matters: Anyone can be scammed or have their identity stolen — it is not a sign of carelessness, and acting quickly makes a real difference. Know these steps before you need them.

If you think your identity has been stolen

  1. 1
    Freeze your credit immediately at all three bureaus if you have not already (see the Credit Freeze section above)
  2. 2
    Call your bank and card companies to report any unauthorised charges and request new card numbers
  3. 3
    Report it to the FTC at identitytheft.gov — they will create a personalised recovery plan and official report
  4. 4
    Change your passwords, starting with your email, then your bank and any other financial accounts
  5. 5
    Tell a trusted family member what happened so they can help you monitor accounts

If you think you've sent money to a scammer

  1. 1
    Contact your bank or card company immediately — the faster you act, the better the chance of stopping or reversing the payment
  2. 2
    If you paid by gift card, call the retailer (Target, Apple, Amazon, etc.) right away — some can freeze the card if it has not been used yet
  3. 3
    Report it at reportfraud.ftc.gov and to local police
  4. 4
    Call the AARP Fraud Helpline (1-877-908-3360) for free, judgment-free guidance on next steps
💡 You will not be in trouble. Scammers are skilled manipulators, and reporting what happened helps protect you and others. The sooner you speak up, the more can be done.

👨‍👩‍👧Letting Family Help You

Why this matters: Having a trusted family member or friend who can help you in a digital emergency — a hacked account, a suspicious call, or a lost phone — is one of the most practical protections available.

Share access to your password manager safely

Bitwarden has an "Emergency Access" feature that lets you give a trusted family member the ability to access your vault in an emergency — but only after a waiting period that you set, during which you can decline the request.

  1. 1
    In Bitwarden, go to your account and click Emergency Access
  2. 2
    Invite a trusted family member by their email address
  3. 3
    Set a waiting period (5–7 days recommended) — if you're able, you can always deny access before it is granted

What to tell your trusted contact

When the problem is someone close to you

Why this matters: Most money taken from older people is not taken by strangers on the phone. It is taken by relatives, carers, friends, and people in positions of trust. This is uncomfortable to read, and it is worth reading anyway, because it is the hardest kind to spot and the least often reported.

Sharing access with someone you trust is still the right thing to do. The protection is not secrecy — it is that more than one person can see what is happening.

⚠️ Signs worth paying attention to
💡 If any of this feels familiar, you can talk to someone confidentially. Call the Eldercare Locator on 1-800-677-1116 and ask to be put in touch with Adult Protective Services in your area. You do not need proof, and you are not accusing anyone by asking a question. Your bank can also add a second contact who is told about unusual activity.
💡 If you think you've been hacked: Change your email password first — then all other passwords. Call your bank. Ask a trusted person to help check your accounts. It is never too late to act.

📖Plain-Language Word List

Why this matters: You don't need to memorise any of these — but if you come across one of these words and aren't sure what it means, here's a simple explanation.

📚Getting More Help