The Person Most Likely to Steal From You Isn't a Hacker

You have antivirus software. You know not to click suspicious links. You've changed your passwords. You're doing everything right.

But here's what the cybersecurity industry won't put on the box: the person most likely to steal from you probably already knows your bank's name, which account has the most in it, and where you keep your financial statements.

They might be in your family photos.

According to the National Adult Protective Services Association, roughly 60% of elder financial abuse is committed by someone the victim already knows — a family member, a caregiver, a financial advisor, or a close friend. The FBI and AARP put that number even higher in some categories, with adult children being the single most common perpetrator in financial exploitation cases.

That's uncomfortable. It's also the most important thing you can know about protecting yourself.

This isn't a reason to distrust everyone you love. It's a reason to build protection that matches the real risk — not the hacker in a hoodie the security industry keeps selling you on.

The Number the Cybersecurity Industry Doesn't Advertise

The global cybersecurity market is worth over $200 billion. Its marketing shows shadowy figures, dark screens, foreign hackers probing firewalls. The message is consistent: your enemy is a stranger, your computer is the battlefield, and software is the solution.

That framing is profitable. It's also only half the picture.

The AARP Public Policy Institute estimates that Americans over 65 lose between $28 billion and $36 billion to financial exploitation every year. The FTC reported that adults 60 and over lost $1.9 billion to fraud in 2024 alone — the highest of any age group, and rising every year.

Here's the part that rarely makes headlines: in cases of elder financial abuse tracked by the FBI, the perpetrator is known to the victim the majority of the time. Not a stranger. Not a hacker in another country. Someone with a key to your house. Someone you call for help with technology. Someone you've named in your will.

Your antivirus cannot protect you from someone who already has your password because you handed it to them last year when they were "setting up your new laptop."

No firewall stops that.

How Insiders Get More Access Than Hackers Could Dream Of

A sophisticated cybercriminal has to work hard to get into your accounts. They have to trick you, compromise a database, guess passwords, defeat two-factor authentication — all without you noticing.

A trusted insider often doesn't have to do any of that. Consider how much access accumulates naturally over time:

Shared banking credentials. Many seniors share online banking logins with an adult child "just in case of emergency." That login works fine for checking a statement. It also works fine for transferring funds to another account.

Email access. Your email inbox is the master key to your entire financial life. Anyone who can get into your inbox can reset every password connected to it — banking, investment accounts, Medicare portals, Social Security. If a family member or caregiver helps you manage your email, they potentially have the power to take over everything tied to that address.

Power of Attorney. A durable Power of Attorney is genuinely useful — and one of the most misused legal tools in elder exploitation cases. It gives someone nearly unlimited authority over your finances. The person you granted it to during a health scare may have rights to your accounts that you've forgotten about.

Physical access. Anyone who comes into your home can photograph financial statements, write down account numbers, or look at saved passwords in your web browser. No hacking required. No technical skill needed.

Caregiver relationships. Paid caregivers — even wonderful, caring ones — have access to your home, your mail, your devices, and sometimes your daily routine in ways that create genuine financial vulnerability. This doesn't mean caregivers are dangerous. It means access creates risk that should be managed.

The common thread: none of this requires breaking through your security software. It requires proximity and opportunity — both of which trusted people in your life already have.

Warning Signs That Are Easy to Explain Away

The most effective insider theft happens slowly and quietly. Small amounts. Gradual shifts. Things that are easy to rationalize or miss entirely.

New urgency around money decisions. Pressure to change a will, add someone to a bank account, sign over property, or make a large financial gift — especially attached to a family emergency or emotional appeal — is one of the clearest warning signs in elder financial exploitation cases.

Small, regular withdrawals you don't remember making. This is a classic pattern. Amounts small enough to fall below automatic bank alerts. Consistent enough to add up to thousands over months. Easy to dismiss as "I must have forgotten about that."

Changes to beneficiaries or estate documents. If someone you weren't expecting is suddenly named in your accounts or estate plan, or if existing arrangements have changed without a conversation you remember clearly, that deserves a careful independent review.

Growing distance from your other trusted contacts. Isolation is frequently the first step in financial exploitation. If someone seems to be creating distance between you and your financial advisor, your attorney, or other family members — if they're "helping" you manage those relationships — pay close attention.

Confusion or pressure during financial conversations. Trust your instincts. If you leave conversations about money feeling rushed, confused, guilty, or like you've agreed to something you don't fully understand, something may be wrong.

Most victims of trusted-insider fraud say afterward that something felt off before they had proof. That instinct deserves respect.

Building Protection That Works Against Everyone

The good news: the same protections that guard against strangers also guard against insiders. The key is setting them up so that you control the alerts — not sharing them with the person you may eventually need protection from.

Create a private financial email address. Use a separate email account — one only you access — for all banking, investment, Medicare, and Social Security communications. Do not share this address. Do not use it for family email. If alerts and statements go there, they go to you first.

Turn on transaction alerts on every account. Every bank, brokerage, and credit account you have should notify you immediately when money moves. Set the threshold low — $25 or $50. Those alerts should go to your private email and your phone. Anyone moving money will trigger a notification you see right away.

Understand your Power of Attorney — exactly. Meet with an independent elder law attorney (one you contact yourself, not one arranged by the person who'd benefit) to understand exactly what your current POA allows, when it activates, and how to revoke or limit it. Many people signed documents years ago and no longer remember what they granted.

Name a "trusted contact" at your brokerage — carefully. The SEC encourages investment firms to let clients name a trusted contact: someone the firm can call if they suspect exploitation. Critically, this person cannot make transactions — they can only be reached. Consider naming someone outside your immediate household.

Review your own accounts monthly. A 15-minute scan of every account statement once a month keeps small problems from becoming large ones. You don't need to be an expert. You just need to notice things that look unfamiliar.

Account Monitoring That Catches What You'll Miss

There's a limit to how much manual checking any of us will realistically do every month. That's where identity and financial monitoring earns its keep — not just for stopping hackers, but for catching the quiet activity an insider hopes you won't notice.

Aura monitors your bank accounts, credit cards, investment accounts, and credit file around the clock and sends you plain-English alerts the moment something unusual happens. It also scans the dark web for your personal information and provides up to $1 million in identity theft insurance if something does go wrong.

Here's why this matters for insider risk specifically: Aura is set up by you, alerts go directly to you, and the account credentials are yours alone. An insider who has access to your regular email cannot intercept those alerts if you've set up Aura with a separate address they don't know about. The monitoring runs independently of anything they can influence.

For seniors who don't want to manage complex software, Aura's interface is designed for non-technical users — straightforward alerts, clear language, no cryptic notifications to decode.

Affiliate Disclosure: This article may contain affiliate links. If you make a purchase through these links, we may earn a small commission at no extra cost to you. We only recommend products we genuinely believe in. This helps support our work and allows us to continue providing free content.

The Privacy Layer for Shared Households

If a caregiver, family member, or anyone else shares your home Wi-Fi network, they can potentially see which websites you visit. On an unencrypted connection, someone on your network could see that you logged into your bank's website, which financial sites you use, or what legal resources you're researching.

A VPN encrypts your internet traffic so that even people on the same network cannot see what you're doing online. You turn it on, and your browsing becomes private — from your network, from your internet provider, from anyone in your home.

NordVPN is consistently rated one of the simplest VPNs for non-technical users. It has an on/off button, clear apps for phones and computers, and the first month is free so you can try it without any commitment.

If you share your space with a caregiver, a family member, or anyone who uses the same internet connection — a VPN gives you a quiet privacy layer they'll never know is running.

The Conversation Worth Having Before You Need It

None of this is easy to think about. Most of us don't want to imagine that someone we love could exploit us financially — and in most cases, they won't. The people in your life are almost certainly exactly who they appear to be.

But protection that only works against strangers isn't complete protection. And the most reliable way to stay safe is to put systems in place before there's any reason to be worried.

A few concrete steps worth taking now:

Talk to an independent elder law attorney. Review your Power of Attorney, your beneficiary designations, and any shared account access. Make sure everything reflects what you actually want — not what you signed during a stressful moment years ago.

Ask your bank about large-transaction alerts. Many banks will flag your account for a direct phone call before processing large withdrawals. Ask yours what options they offer.

Name a financial accountability partner. This is someone outside your household — a trusted friend, a different family member, your attorney — who you agree to consult before making any financial decision over a certain dollar amount. A simple circuit breaker that makes exploitation much harder.

Keep your financial documents in a secure location only you access. A fireproof safe with a combination only you know is low-tech and extremely effective.

Protection That Matches the Real Risk

The cybersecurity industry has spent decades selling you tools designed for anonymous strangers hacking through your firewall. Those tools are worth having. But they were never designed to address where much of the real risk actually lives.

Real protection means: real-time account monitoring with alerts that go only to you, assets that require your physical presence to move, private browsing that no one on your network can see, and legal documents you've reviewed recently with an independent attorney.

That's not paranoia. That's an accurate map of where the risk is.

Your antivirus is doing its job. Now it's time to add the layers it was never built to handle.

Last updated: 2026-06-17

Get ClearShield's free weekly safety briefing.

One email per week. One clear, practical tip to help you stay safe and confident online. No jargon. No scare tactics. Just what actually matters.

Subscribe Free →