Seniors Lost Billions of Dollars to Scams Last Year. Here's How to Make Sure You're Not Next

From fake Medicare calls to AI-cloned voices, here's what's really targeting you — and simple ways to fight back.

This one runs longer than usual, and here’s why: the scam problem cost older adults $7.7 billion last year, spread across far more than just phone calls, and most articles barely explain how to actually stop each type. Every scam here gets its own explanation of what it is and specific steps to avoid it, not just a warning to “be careful.”

Why does this feel worse than it used to?

The calls feel smarter now, less robotic, more like a real person who somehow knows a grandchild’s name. That’s not imagination. The FBI’s 2025 data shows more than 3,100 complaints from older adults specifically referencing AI, with losses topping $352 million, and $5 million tied to voice-cloning calls where someone hears what sounds exactly like a loved one in distress.

---

Premium subscribers get full access to all Premium Guides (including our monthly brain health and AI For Seniors Deep Dives) plus lifetime tech support from our partner TechMaid (a $50/year value, included for free).

---

Spear phishing: the attack built just for one person

Regular phishing is a net thrown wide, a generic email claiming to be from a bank sent to millions of people at once. Spear phishing is different: it targets one specific individual, using details gathered about that person’s life, family, or interests to make the first message believable. Where a broad phishing email gets sent to anyone, a spear-phishing message is built around one target’s actual world.

The attack usually unfolds in stages, and the pattern is worth knowing:

• The scammer researches the target first, often pulling details from social media, obituaries, or public records, like a grandchild’s name, a church group, or a recent trip

• The first message references something real and specific, which makes it far more convincing than a generic “your account has a problem” email

• If the target responds, the conversation continues back and forth, with the scammer staying consistent and believable rather than rushing straight to a money request

• Trust builds over several exchanges before the actual ask arrives, whether that’s a link, a password, or a payment

This slower, more patient structure is exactly what makes spear phishing harder to catch than a typical scam email. A message that arrives out of nowhere is easy to dismiss, but a message that already knows real details and behaves consistently over several replies earns trust the way a real relationship does.

Here’s how to defend against it:

• Never trust a message just because it knows personal details. Scammers gather real information from public social media posts, so familiarity alone proves nothing

• Verify through a separate channel before responding to any request involving money or passwords. Call the person or company directly using a number already known to be theirs, not one provided in the message

• Slow down on replies that feel like a real back-and-forth conversation. The comfort of an ongoing exchange is precisely the trust spear phishing is designed to build; a pause to think doesn’t cost anything

• Use the SLAM method on anything suspicious: check the Sender’s address, hover over Links, avoid unexpected Attachments, and evaluate the Message for urgency or unusual requests

• Limit what’s publicly visible on social media, since birthdays, family names, and travel plans are the raw material spear phishers use to sound convincing

Romance scams: what they are and how to avoid them

A romance scam starts with what feels like a genuine connection, usually on a dating site, social media, or a message claiming a wrong number that turns friendly. AARP research found that roughly 9 percent of adults 50 and older have formed what they believed was a real romantic connection online, only to have that person ask for money or push a cryptocurrency investment. Adults 80 and older who report these scams lose money nearly 67 percent of the time, the highest rate of any age group.

Here’s exactly how to protect against it:

• Run a reverse image search on any profile photo. Save the photo, go to images.google.com, click the camera icon, and upload it. If the same face turns up under a different name or on a stock photo site, that’s the scam confirmed

• Insist on a live video call early. Someone who always has an excuse, bad connection, broken camera, works overseas, is avoiding it on purpose

• Refuse to move the conversation off the dating platform quickly. A fast push to WhatsApp or Telegram is a documented red flag

• Never send money, gift cards, or crypto to anyone met exclusively online, no matter how long the relationship has lasted

Pig butchering: what it is and how to avoid it

This scam combines a fake romantic or friendly relationship with a fraudulent cryptocurrency investment pitch. The scammer spends weeks building trust before introducing an “opportunity,” and adults 60 and older account for more than half of all US romance-scam losses by dollar value despite being a smaller share of internet users.

The warning signs are specific and worth memorizing:

• An online acquaintance casually mentions crypto trading and claims guaranteed or unusually high returns

• A trading app or website appears that nobody has ever heard of, and it isn’t registered with a real financial regulator

• Early withdrawals go through smoothly, then larger deposits get requested with promises the returns will grow

• An attempt to withdraw the full amount gets blocked by a sudden demand to pay “taxes” or “fees” first

The single most important defense: never invest money based on a tip from someone met online. Anyone can verify whether an investment platform is legitimate by checking it against a state or federal securities regulator’s registry before depositing a single dollar.

Tech support scams: what they are and how to avoid them

This scam usually starts with a pop-up claiming a virus was detected, often with a phone number to call immediately, or an unsolicited phone call claiming to represent a well-known tech company. Adults 60 and older are victimized roughly five times more often than adults in their 20s, and older consumers reported losing $159 million to this category in 2024.

The core rule: legitimate tech companies never initiate contact by phone, email, or text to report a computer problem, and a real security warning never asks for a phone call. A few specific habits close the gap:

• Never click a link or call a number inside an unexpected pop-up; close the browser entirely or restart the computer instead

• Never give a stranger remote access to a computer, even if they sound calm and professional

• Treat any request to pay by gift card, wire transfer, or cryptocurrency as an automatic red flag

Medicare scams: what they are and why they’re flooding Facebook right now

A Medicare scam is any attempt to get someone’s Medicare number, Social Security number, or money by posing as Medicare, a Medicare Advantage plan, or a government-affiliated benefits program. It shows up in several forms, and they all lean on the same trick: making a stranger feel like an official, trustworthy source.

One common version arrives as a phone call claiming a new Medicare card is being issued and needs “verification,” or that a recent claim looks suspicious and needs a callback. Another version shows up as a home visit or a booth at a health fair, where someone claiming to represent Medicare offers a free screening or genetic test kit in exchange for a Medicare number, then bills Medicare for services never actually provided. A third and increasingly common version runs as a paid advertisement on Facebook or Instagram, dangling a free benefit, a gift card, or a “better” plan, and collecting personal details through a form once someone clicks.

The Facebook and Instagram angle deserves its own callout because it’s grown fast. A recent investigation found that Medicare scam ads generated more than 215 million views on Facebook and Instagram in the past year, and another report found Meta allowed about $12 million worth of these ads to run on its platforms. During open enrollment, scammers take advantage of all the attention around plan choices and flood social media with promises that sound official or unusually generous.

Here’s the mechanism behind the ad version specifically: the ad usually offers something too good to ignore, a free benefit, a gift card for answering a few questions, or a plan upgrade that supposedly costs less and covers more. Clicking through leads to a form asking for a Medicare number, Social Security number, or bank details, and sometimes the scam continues with a follow-up phone call from someone pretending to be a licensed agent to make the pitch feel more legitimate. Once the scammer has that Medicare number, it gets used to bill the program for equipment, tests, or services that were never delivered, and the victim rarely notices unless they’re checking their claims statements.

Here’s how to block this kind of scam before it gets rolling:

• Treat a Medicare number exactly like a credit card number. Medicare’s own fraud guide says not to share a Medicare Number with anyone who contacts you unexpectedly by phone, email, or in person, unless permission was given in advance

• Assume any unsolicited call claiming to be from Medicare is fake. Medicare says it only calls in limited situations, such as returning a call, following up on a fraud report, or when a plan member is already enrolled and dealing with that plan

• Do not trust caller ID, especially during open enrollment. Scammers can spoof government-looking numbers or labels, so a familiar display proves nothing

• Use official contact routes instead of links in ads. If a Facebook ad or email mentions Medicare, go directly to Medicare.gov or call 1-800-MEDICARE rather than clicking through

• Report suspicious Facebook or Instagram ads directly on the platform by opening the ad menu and choosing the report option, then block the advertiser so the same campaign is less likely to follow you around

• Review Medicare Summary Notices or plan statements regularly. Check claims for services, supplies, or equipment never received, and use a secure Medicare account to track claims between paper notices

• Keep a simple appointment calendar and compare it with claims. Recording doctor visits and tests makes billing errors or fake claims easier to spot later

• Be wary of anything described as free. Never give out a Medicare Number in exchange for free equipment, gifts, or other offers, since dishonest providers can use that information to bill for services never delivered

This is one of those scams where a little technology helps a lot. Ad blockers can reduce some junk, but the real defensive tools are better habits: going to the official site directly, checking claims online, and treating social media ads about Medicare as marketing at best and fraud at worst.

What actually works, versus what sounds good?

The research on prevention has a counterintuitive finding: the tools beat the education. Practitioner studies rate spam detectors, call-blocking apps, and real-time banking alerts as the most effective defenses, because they remove the need for anyone to judge legitimacy in a stressful moment. A real-world study using Danish bank data found that brief scam warnings had no measurable effect on who actually got victimized.

What exactly are “scam-detection apps,” and who’s behind them?

These are apps or websites where a suspicious text, email, or link gets pasted in, and an AI tool assesses whether it looks like a scam. The companies behind them are the same names behind most antivirus software.

• Norton Genie, from Gen Digital, offers a free scam check via screenshot or pasted text, plus a paid “Scam Protection Pro” tier with call-blocking

• McAfee Scam Detector comes bundled into McAfee’s paid security plans rather than sold on its own

• Trend Micro Scam Check and Bitdefender Scamio work similarly, with Scamio running as a chatbot inside WhatsApp, Messenger, or a browser

An investigative team at KSL tested all four side by side, and the results were unimpressive: one flagged a phishing email the others missed, another falsely flagged a legitimate Amazon message as suspicious, and one wouldn’t commit to calling an obvious scam a scam. Treat these as a second opinion, not a verdict.

What’s the single best money-side protection?

Ask a bank or brokerage about naming a trusted contact. Under FINRA rules, brokerages must make a reasonable effort to obtain one, allowing the firm to reach out to that person if they suspect exploitation, without handing over control of the account. Banks can also set cash withdrawal limits, geographic transaction limits, and activity alerts.

What about a family code word?

If a voice on the phone claims to be a grandchild in trouble, feeling terrified is exactly the reaction the scam is built to produce. The FTC’s guidance is blunt: don’t trust the voice, hang up, and call the person back on a number already known to be theirs. A family code word works as a simple backstop, since AI clones the sound of a voice, not the knowledge of a private phrase agreed on in person.

What’s worth doing this week?

• Limit what family details, travel plans, and birthdays are visible on public social media

• Run a reverse image search on any online romantic contact’s profile photo

• Verify any investment platform against a securities regulator before depositing money

• Refuse to call any number listed in an unexpected computer pop-up

• Go straight to Medicare.gov or 1-800-MEDICARE for any plan question instead of clicking a Facebook or Instagram ad

• Save the National Elder Fraud Hotline number, 833-372-8311, staffed by case managers who can walk anyone through federal, state, and local reporting

Frequently Asked Questions

• Q: How is spear phishing different from a normal scam email?

• A: Spear phishing targets one specific person using real personal details gathered in advance, making the message far more convincing than a generic scam email sent to thousands of people.

• Q: How do I run a reverse image search on a phone?

• A: Open the Google app or images.google.com, tap the image, then tap the Google Lens camera icon to search for matches across the internet.

• Q: Should I trust a Medicare ad on Facebook if it looks official?

• A: No. Use Medicare.gov or 1-800-MEDICARE instead of clicking through from social media, because scammers use official-looking ads and spoofed branding to collect personal information.

• Q: Should I ever call a phone number shown in a computer security pop-up?

• A: No, legitimate security warnings never display a phone number to call, and doing so connects directly to a scammer.

For federal guidance on reporting fraud, the FTC’s consumer alert page at consumer.ftc.gov is worth bookmarking. For Medicare fraud help, Medicare.gov/fraud and the Senior Medicare Patrol at smpresource.org are both useful starting points.