Twenty minutes to lock down a parent's email (Gmail, Yahoo, AOL)

Last year the FBI logged over 48,000 phishing reports from people 60 and up, about double the year before. Almost all of it comes in by email. A friend's parent kept getting hit, so we sat down one afternoon and went through the account together. Here is what we did, in the order we did it. Do it with your parent at the keyboard, not you. It goes better.

1. Two-step sign-in. Gmail: Google Account, then Security, then 2-Step Verification. Yahoo and AOL: Account Security, then Two-step verification. Use their phone number. Most account takeovers stop right here.

2. Recovery email and phone. Someone who breaks in changes these first. Check that both belong to your parent or to you.

3. Forwarding and filters. In Gmail that's Settings, See all settings, then the Forwarding tab and the Filters tab. If mail is being forwarded to an address you don't know, delete that rule. On accounts that have already been broken into, this is the thing I find most often.

4. Devices and connected apps. Google Account, Security, Your devices, and Third-party access. Sign out of anything they don't recognize.

5. Unsubscribe. Ten minutes in the Promotions tab clicking unsubscribe. Fewer emails a day means the bad one has nowhere to hide.

6. One rule, said out loud: nobody real asks for gift cards, and nobody real needs you to do something in the next hour. If an email does either, they call you first. We wrote it on a sticky note and put it on the monitor.

7. Report what you find. Phishing goes to reportphishing@apwg.org. Money lost goes to reportfraud.ftc.gov and ic3.gov.

That’s it...just an afternoon. It can be a little difficult if you run into resistance…. but it can save needless headache, and countless hours/days/weeks of cleanup.