Discussions of elder financial abuse today generally focus on scams, and for good reason. Adults aged sixty and above in 2025 reported $7.749 billion in scam-related losses to the FBI’s Internet Crime Complaint Center (IC3). You can read our snapshot of IC3’s 2025 report to learn more.
One element of financial abuse that often overlaps with scams is identity theft. This article will introduce you to tools you can use to limit the chances of identity theft and decrease the amount of data internet trackers collect from you. The more data out there, the more identity thieves have to play with. That matters because even if a scammer cannot get sensitive information like a bank account number, they might still see that you, for example, commonly shop at one particular site online. Or, perhaps they figured out where you bank. That means they can target you with more convincing phishing attempts.
Securing Your Financial Information
Credit freezes
One major way to stop identity theft is to freeze your credit. Three main credit bureaus operate in the United States: Experian, Equifax, and TransUnion. A creditor typically checks your credit report with one or more of these three when you apply for credit. The credit freeze works by denying access to your reports, preventing an identity thief from opening a new credit account in your name. You can manage credit freezes online at the bureaus’ websites:
Remember that although this technique helps to stop identity theft, it does not stop a scammer from impersonating a legitimate company and convincing you to open a new account yourself. However, you can use the effort needed to unfreeze your credit as a friction point. That is, when you go to unfreeze your credit, remember to stop, take a step back, and confirm everything about the transaction is real.
Notifications about transactions
If you handle banking online, you can opt in to receive notifications from your bank. These notifications may vary in scope, but you should consider enabling the option for your bank to notify you when a transaction is made with your account. If small dollar transactions do not concern you, you can set a dollar limit so that you get a notification only when a transaction exceeds the limit.
Emergency financial contacts
Some financial institutions let you name an “emergency financial contact” they can reach out to when your account has suspicious activity. Suspicious activity includes when you yourself try to make a transaction that deviates from your normal account history. Adding the contact introduces a trusted person to the situation to confirm a transaction’s validity.
This approach is much more advisable than adding a trusted person as a joint accountholder. By adding someone as a joint owner to your account, you give them full access to your account. When you die, they will automatically take over the account if they have the “right of survivorship”. Although an emergency financial contact cannot manage your finances, you can make a power of attorney to give that authority to someone while retaining full control over your account. You would still need an emergency financial contact to get that extra layer of confirmation in the event of a suspicious transaction.
Strong passwords and multi-factor authentication
Today’s heavy reliance on the internet for financial transactions makes it critical that you protect your online accounts with proper security measures. The National Institute of Standards and Technology (NIST) published updated security recommendations in July 2025 in Special Publication (SP) 800-63B-4. The key takeaway for passwords was that complexity does not matter so much as length. When people need to use complex passwords, they commonly default to simple ones. For example, “1Password!” may be more complex than “password”, but it is not any less predictable to a scammer. You should make sure your passwords are at least eight characters long if your account uses multi-factor authentication and at least fifteen characters long otherwise. Using a memorable phrase or sentence can help you make a long password.
Some apps may have you use knowledge-based authentication, like “What was the name of your first pet?” or “What street did you grow up on?” These methods grow more insecure by the day as more and more information gets shared on social media and more and more “people finder” sites list home addresses, phone numbers, email addresses, etc.
You do not need to rely on a password for security. In fact, you should not. NIST recommends securing all your sensitive accounts with multi-factor authentication, which means you have a second authentication step after entering your password. Avoid email authentication if possible. Information sent over the internet can be intercepted or rerouted by DNS spoofing. You should likewise avoid SMS authentication (authenticating by a text message). Phones are vulnerable to SIM swap fraud, number porting, etc.
The best multi-factor authentication approach is a device bound application with local credentials. You can think of each time you log in to a service as a “session”. The service gives you a “session cookie” to remember you and save you from the annoyance of constantly needing to log in again. Scammers can steal these cookies to impersonate you without even needing your login information. This vulnerability has led to a push for binding sessions to individual devices. The scammer cannot take over your session because they do not have access to your device! The credit for leading the device bound security push goes largely to Google, and you can read more about the standard via the World Wide Web Consortium’s website.
The second component of the recommended approach involves where the information used to generate the authentication code is stored. By using an application with local credentials, all that information is stored on your device rather than online (where it could be vulnerable to a data breach).
Limiting Your Online Data Profile
Websites access an incredible amount of data about internet users, from your screen size, to your browser version, to the fonts on your device. You can get an understanding of what your web browser reveals by testing it at the Electronic Frontier Foundation’s Cover Your Tracks website. The following discussion highlights some of these tracking elements and how you can respond.
California Data Request & Opt-out Platform (DROP)
California’s DROP tool is worth a mention before getting into the details of tracking. This tool lets Californians enter their information in a web form that gets communicated to data brokers. As of August 1, 2026, the data brokers must delete the information they have about you and continue doing so every forty-five days. Users of all ages should use this tool to eliminate data identifying them.
Using a virtual private network (VPN)
A basic monitoring tool websites can use is tracking your IP address. Your IP address is not unique to your device. However, it still gives the website owner a general idea of your location. You can stop this by using a VPN. The VPN acts as a sort of intermediary between you and the website you are browsing. Normal internet traffic goes (1) from your device to your home router; then (2) from your router to the server storing the website (and vice versa). With a VPN, your internet traffic instead goes (1) from your device to your home router; then (2) from your router to a VPN server; then (3) from the VPN server to the server storing the website. This middle layer lets the VPN change the originating IP address, shielding your IP address.
A VPN has a second benefit: the VPN provider encrypts your internet traffic before it leaves your device and encrypts the information it sends you, which prevents Internet Service Providers (ISPs) from reading your traffic. Thus, the VPN eliminates not only IP address tracking, but also the potential for your ISP to sell what you do on the internet to a third party like an advertiser.
Problems: Using a VPN is not perfect. First, you need a trustworthy VPN provider to reduce the likelihood that the provider is monitoring your internet traffic. Second, you may experience slower internet speeds because the VPN adds two steps before you can see a website (one step when you are sending information to the website and a second when the website responds and sends information to you). Third, some sites do not accept IP addresses from known VPN servers, which means you may need to turn off the VPN to access these sites.
Deleting URL trackers
Sometimes URLs will contain information like a “utm_source” or “click_id,” like https://example.com/page?utm_source=facebook&click_id=9873421. This information tells the destination website where you are coming from, what ad you clicked, etc. You cannot disable this functionality by turning off browser “cookies” because the tracking capability is in the link itself. You can eliminate this tracking source by copying and pasting the URL to delete the extra tags in the URL instead of clicking the link itself.
Turning off or limiting cookies
Cookies are bits of information created by the websites you visit and saved on your computer so that each website can remember you when you return. For example, a website can use cookies to keep you logged in and remember your preferences. But cookies open up the possibility that sites can build a profile of you by continually observing/saving your internet usage.
Your browser lets you limit cookies, delete cookies, and turn them entirely off. Problem: Turning off cookies will stop some websites from working properly. You will also need to constantly log in to all your accounts online. Instead of turning cookies off, you can consider limiting them in a way that suits your needs. Browser extensions can help you do this, too.
Using browsers that prioritize privacy
Internet users today generally choose from four browsers: Chrome, Safari, Firefox, and Edge. Each browser has slightly different default settings and privacy offerings. Chrome, the most widely used browser, is typically regarded as the worst for privacy. It does not block third-party cookies by default and enables additional tracking technologies by default. Safari offers better privacy protections than Chrome and Edge, but it runs on Apple’s proprietary code. Firefox, on the other hand, uses open source code, meaning its code is publicly available. Firefox also has additional privacy protections like partitions between website data (Safari theoretically does this, too), DNS over HTTPS, and a free VPN that lasts for 50 GB of data per month.
Of the four browsers, Firefox likely offers the best security protections. A fifth, Brave, is often considered even better. Many sites can identify your device by using WebGL (Web Graphics Library) to have your computer run complicated mathematical operations. Those operations rely on your computer’s Graphics Processing Unit (GPU). GPUs are unique by make and model. An advanced enough tracker could even identify your individual GPU itself because of variations in the silicon wafers used to make each GPU. You can eliminate this version of tracking by turning off JavaScript. However, that will cause a great number of websites to stop functioning. Brave eliminates the tracking by randomizing WebGL signals (other signals are also scrambled to eliminate identification).
A much more niche browser, Tor, offers even better privacy than a VPN and gives a mostly anonymous fingerprint, making it more or less impossible to track you. However, its security means it runs much slower, and many websites will not work.