Developing Digital Judgment: The Strongest Form of Online Security for Older Adults

Strong passwords and antivirus software matter — but they don’t stop the scams that cause the most financial damage to older adults. Investment fraud, romance scams, and government impersonation cost seniors billions of dollars every year, and none of those attacks are blocked by security software. They’re blocked by judgment — the ability to recognize something as suspicious, slow down, and verify before acting. Digital judgment is a learnable skill, and this guide explains exactly how to develop it.

Why Judgment Matters More Than Software

In 2025, Americans over 60 reported $7.8 billion in losses to internet crime — a 59% jump from the previous year, according to the FBI’s Internet Crime Complaint Center. Investment fraud alone cost this group $3.5 billion. Tech support scams cost another $1 billion. Romance and confidence fraud added $584 million more.

None of these losses were primarily caused by weak passwords or unpatched software. They were caused by convincing human interactions — phone calls, messages, and online relationships — that bypassed technical defenses entirely. A scammer who calls you on the phone and convinces you to wire money doesn’t need to hack your computer. Your antivirus software can’t help you decide whether the person on the phone is telling the truth.

This is why the FBI consistently describes education and awareness as the most important fraud prevention tools available. Technical security measures are necessary but not sufficient. The decisions you make in the moment — whether to call back, whether to click, whether to send — are where most losses are actually determined.

The Core Skill: Recognizing Patterns Before They Become Problems

Digital judgment isn’t a single skill — it’s a collection of habits that become automatic with practice. The most important ones are:

Distinguishing between expected and unexpected contact. The simplest question to ask about any call, email, or message is: was I expecting this? A call from your bank is routine if you recently had account activity — but suspicious if it arrives out of nowhere claiming there’s an emergency. An email from a company is normal if you recently made a purchase — but worth scrutiny if it arrives without context asking you to confirm your account details. Unexpected contact isn’t automatically fraudulent, but it deserves more careful evaluation than contact you initiated yourself.

Recognizing the four pressure signals. Nearly every major scam targeting older adults uses some combination of urgency, fear, secrecy, and promised reward. Urgency pushes you to act before thinking. Fear makes you compliant. Secrecy prevents you from getting a second opinion. Promised reward — an investment return, a lottery prize, a romantic relationship — lowers your guard. When any of these signals appears in an unexpected contact, treat it as a reason to slow down, not speed up. The presence of pressure is the warning sign, regardless of what the contact claims.

Verifying through independent channels. If a caller claims to be from your bank, hang up and call the number on the back of your card. If an email claims to be from Social Security, go to ssa.gov directly in your browser rather than clicking any link in the email. If a text message claims there’s a problem with a package delivery, log into the shipping company’s official website rather than clicking the link. This single habit — always verifying through a source you find independently rather than one provided by the contact — stops the majority of phishing and impersonation scams cold.

Using the pause and consult rule. Before responding to any unexpected contact that involves money, personal information, or account access, pause and consult someone you trust — a family member, a close friend, or a neighbor. This doesn’t need to be a lengthy conversation. “I just got a call from someone claiming to be from Medicare — does this sound right to you?” is enough. Scammers keep victims on the phone specifically to prevent this consultation from happening. Any contact that discourages you from talking to family is almost certainly fraudulent.

How to Evaluate Specific Types of Digital Contact

Phone calls. Caller ID can be spoofed — a call that displays your bank’s name or a government agency’s number can come from anywhere in the world. Never rely on caller ID to verify who is calling. If you receive an unexpected call from any organization asking for personal information or payment, hang up and call back using a number you find independently. Telling a legitimate caller “I’m going to hang up and call you back at your official number” will never cause a problem with a real organization.

Emails and text messages. Before clicking any link in an email or text, look at where the link actually goes. On a smartphone, press and hold the link without tapping — the full web address will appear. On a computer, hover your mouse over the link and the address will show at the bottom of the screen. If the address looks unfamiliar, contains misspellings, or doesn’t match the organization it claims to be from, don’t click. Go directly to the organization’s website by typing the address yourself.

Social media contacts and online relationships. Anyone can create a social media profile with a stolen photo and a convincing backstory. If someone you’ve never met in person asks for money — for any reason, after any amount of time — treat it as a serious red flag. The FBI notes that romance scammers often spend weeks or months building trust before making any financial request, specifically because extended contact makes victims less suspicious. Before sending money to anyone you’ve only known online, discuss it with a trusted family member or friend who knows the situation.

Pop-ups and on-screen alerts. Legitimate security warnings from Apple, Microsoft, or Google do not include phone numbers to call, do not lock your screen, and do not demand immediate payment. If a pop-up appears claiming your computer is infected and providing a number to call, close your browser — or restart your computer if the pop-up won’t close — and do not call the number. If you’re concerned about your device’s security, call the manufacturer’s official support line directly.

Building the Habit: Practical Steps You Can Take This Week

Digital judgment improves with deliberate practice. Three concrete steps that build the skill quickly:

Save official phone numbers for organizations you use regularly. Add your bank’s customer service number, your Medicare number (1-800-633-4227), and the Social Security Administration’s number (1-800-772-1213) to your phone’s contacts. When you receive an unexpected call from any of these organizations, you can immediately call the saved number to verify whether the contact was legitimate — without needing to search for it under pressure.

Designate one trusted person as your “second opinion.” Identify a family member or close friend you can call immediately when something feels off. Tell them that you’d like them to be your first call when you receive any unexpected contact involving money or personal information. Having this relationship established before a crisis makes it far more likely you’ll use it when you need it.

Practice the pause. The next time you receive any unexpected call, message, or email — even from a legitimate source — practice pausing before responding. Take a breath, ask yourself the basic questions (Was I expecting this? Is there urgency or pressure? Does this feel right?), and then decide how to proceed. This habit costs nothing when the contact is legitimate and prevents significant harm when it isn’t.

If you ever suspect you’ve been targeted by a scam, report it to ic3.gov or call AARP’s Fraud Watch Network Helpline at 877-908-3360, staffed by fraud specialists who can help you assess the situation and determine next steps. You can also sign up for free scam alerts from the FBI and AARP, which notify you when new scam patterns emerge — giving you advance warning before criminals have the chance to reach you.