The Phishing scam - Cyber security in senior living

RHONDA DEMENO: Welcome to The Senior Advisor podcast. My name is Rhonda DeMeno, and I will be your host for today's discussion. Today's discussion is titled "The Fishing Expedition: Protecting Seniors in Senior Living Communities From Modern Scams." We know that scams today are targeting older adults and senior living communities. And they continue to grow in sophistication, frequency, and really can impact the senior living community financially.

In this episode, we will talk with our cybersecurity expert, Sean Scranton, to explore the evolving world of phishing, fraud, and social engineering schemes affecting both residents, staff, and communities. So today, I'd like to welcome Sean Scranton. Sean, welcome to our podcast.

SEAN SCRANTON: Thank you, Rhonda.

RHONDA DEMENO: It's so good having you. And I know we've already had one discussion earlier. But today's discussion is really going to delve into scammers and really why they are targeting senior living communities and seniors in general. So we might as well get the topic started and the questions flowing here, Sean. So I'm going to start off by asking you, why do you think scammers target seniors and senior living communities?

SEAN SCRANTON: Rhonda, I think it's interesting. Because, as we look at seniors, often, we have retirement savings. We got established credit and very much a very trusting nature through decades of personal interactions. Our environments, usually also very highly connected. Residents, family members, caregivers, everyone's communicating frequently.

Criminals are not really targeting that person's technical knowledge. They are exploiting some of those things. They're looking for trust, for fear, especially maybe loneliness providing a sense of urgency in their requests. And seniors are usually fairly compassionate as well. And so you combined all those together where you have retirement savings, money, the trusting nature, and maybe the loneliness and the fear and the compassion, and that just makes for a little bit of a perfect storm for a scammer.

I think staff members should also remember that they use the same tactics against employees as well, whether they're trying to get information from the residents or whether they're trying to get access to the organizational funds. So we have to remember that scammers, they are professional manipulators. It's not about intelligence. It's about human psychology and manipulation.

RHONDA DEMENO: Yeah, and I think you brought up a really good point, Sean, about how, oftentimes, seniors can be isolated and pretty lonely, especially when they're a new move in to a community. So if you were talking to seniors, if we were in front of a group of seniors or in front of a senior living organization giving a presentation, what would you tell them the biggest warning signs of a phishing email, text, or phone call?

SEAN SCRANTON: Yeah, sure. One of the biggest ones we almost always see is a sense of urgency. And we always tell people, stop, take a minute, wait a minute, let's look this over. Is this really for real or is this a scam? You will see scams, we just charge your credit card for $399 for antivirus. It was a renewal. Please, call this number for a helpline.

OK, I know that's not right, didn't say anything about what kind of credit card I had or whatever. So I'm just going to take a minute and just think this through before I call that number. What happens if I call that number? If I call that number, someone's going to get on the line, and they're going to help me go to the computer and help me provide my banking information to them. And then things go south from there.

You may also see scams-- another red flag is account suspension. We suspended your account. Please, call this help number. Or we arrested your grandson. We have him here. Please, contact this number to arrange bail. Those kind of things. Anytime you see poor grammar-- I think we'll probably want to talk about AI a little bit later. And so it's getting more and more difficult to fish out some of these scams, as far as poor grammar.

You'll also see almost, always, there's some sort of monetization, whether it's direct money we charge your credit card or whether it's you need to go and get some Apple gift cards or you need to go need to go buy some Bitcoin. It's those kind of things with crypto. There's usually some sort of monetization involved.

RHONDA DEMENO: That's pretty scary, actually, when you think about it. Personally, I got an email not too long ago saying that I needed extra space in my email account. Is it just best to avoid those types of emails, would you say?

SEAN SCRANTON: I think it's important to, if you can, ask somebody else. Like, hey, have someone else, take a look at this. Hey, can you look at this? Does this look real? What do you think? I mean, you don't have to have access to the Sean level of security. But even just a second pair of eyes on it to take a look at it, that's going to help things, especially if it's something like you need to call this number. We're seeing quite an uptick in those kinds of scams.

I mentioned AI from the more convincing emails. It used to be we'd read about the Nigerian Prince and kindly do this and kindly do that. I'm from the Midwest and not a lot of people say kindly on the Midwest. And I know there's other kind of tells that you might pick up on from someone that's outside the US.

But now with AI, the scammer can say, I want you to craft an email that tries to fool someone into doing this and this. And I want the email to be in the tone of someone from the Midwest. And AI will generate that email. It will generate that script for them.

So now, it's extremely difficult to assess those out, as far as, yeah, definitely a scam; no, definitely not a scam. It's getting more and more difficult. And as AI continues to advance and the ease of AI usage continues to become more prevalent, I think we're going to see a lot more of those. Unfortunately, it's just going to get worse.

RHONDA DEMENO: So you mentioned grandchildren, those grandchildren scams. Is AI being used for any voiceovers, to really scare seniors, to maybe recording voices so they feel that their loved ones in a bad situation? Have you heard of anything like that happening?

SEAN SCRANTON: Unfortunately, absolutely. And we saw this more in the corporate world, where this first occurred from a vendor change type of thing. Like, hey, we need to change this vendor and here's the next invoice. Well, the invoice was to the naughty scammer.

And then it went to voiceovers to change vendors. It's the CEO's voice. Well, it's because they found the CEO speaking on YouTube somewhere, and they took their voice, ran it through AI, and they got the "CEO," quote, unquote, to say whatever they wanted. And now, they're off changing vendors.

Unfortunately, we see the grandkids as well to where-- I'm a little older. So I have a grandchild. But we know a lot of the kids nowadays are on Instagram and they're putting some of their videos out there. They can very easily be brought into an AI tool and then made to say whatever they want.

So it sounds like you just got a voicemail from your grandchild saying, hey, I'm in such and such jail. I need-- usually, it's Apple gift cards, go figure that one out. Can you please call this number? We need to have Apple gift cards.

And there's other scams, where they're saying, we have an intermediary, as far as your grandchild been kidnapped. We have an intermediary where you actually need to have a bag of money and you need to bring it to this location. And at that point, they're actually tailing you. So that's probably more on the extreme end. What we're usually seeing is either grandkid in jail or grandkid ransom and we need some money. Unfortunately, it's all a scam, and they're using AI to do it.

RHONDA DEMENO: So always take that extra step and make another call to a family member or to your grandchild just to make sure that before you do anything, that you're really doing some work on your own to investigate.

SEAN SCRANTON: And Rhonda, if I may, too. So this didn't happen to my sister-in-law. But what my sister-in-law did-- and she is not very technologically savvy, but I'll give her kudos for this-- is that her Facebook account was hacked. And one of the first things she did was to try to get it back was, of course, she called me.

But what she did on her own is she texted to our family chat and she said, if you get any calls from anybody, I want you to use this code word. And this is something that, obviously, only our family knew. And so that is one way to where if you're in a scam or it's more of a ransom or your grandchild's in jail or whatever, well, what's the code word? And they probably don't have the code word.

RHONDA DEMENO: I like that. Yeah, I like that, really good advice. So again, going back to seniors being lonely, they still date. And even in senior living communities, we even hear of residents meeting in a senior living community and getting married. So let's talk a bit about the romance scams. They seem very personal. Can you tell us how they work?

SEAN SCRANTON: Absolutely. And usually, these are through text. And I will get about one of these about once a month or so. And they start off with, hi, Alicia, how are you doing? Long time, no see. OK, well, my name's not Alicia. I don't know an Alicia.

And so I'll reply back. And I pretty much what's going on by then because I get so many of them. I'll reply back saying, sorry, you must have the wrong number. Oh, I'm sorry. Oh, you're so nice. What's your name? And then it starts from there. And then at that point, it's a trust building exercise. It's like, well, where are you from? Oh, really, well I'm from-- and I'm from Midwest. Oh, I'm from St. Louis. And we've been along the same type of ground and that kind of thing.

And it's just constant communication. And they're building trust and conversation after conversation. And in my world, these usually go on with me for about a couple of days. Well, usually, two things happen. Either they start asking for money or my wife sees it and she's like, what are you doing? And I'm like, it's for work. It's for work. And she's like, OK, yeah, great.

But not being funny, unfortunately, these work. And where they go is, eventually, they will keep asking for money as like, oh, I just traveled to this city and I'm trying to get back home or I need money for my car or whatever. And can you please send me this? Well, the best way to send it is it's more fungible if you send me some Apple gift-- I'm not picking on Apple. But if you send me some Apple gift cards or some Amazon gift cards or those kind of things.

Or cryptocurrency, here's how you set up a Bitcoin wallet. And can you send it over to Bitcoin? Because that way, we won't have any fees and it's easy, that thing like that. It's just knowing that people are just not going to randomly-- they do randomly find you, but they're building trust with you to get the money. And unfortunately, many of our seniors are lonely, and they prey on them for that loneliness.

RHONDA DEMENO: And those types of transactions are really not very traceable. So that should definitely put up a warning sign to these scammers that are trying to become friends with our seniors. So you mentioned grandchildren in jail. Why does that scam continue to work?

SEAN SCRANTON: It's a sense of urgency. Hands down, having grandkids is a life changing event. And I would do anything for my grandchild, I will say. And so it's that sense of urgency. It's that sense of compassion. It's knowing that you are able to help. And maybe it's convincing to where the AI grandchild says, please, please don't tell mom and dad, this is what's happened, and that kind of thing.

And you're not trying to subvert or anything like that. You just want to help. You just want to get them out of the jam from that perspective. And we're talking about family bonds here. And that's why it continues, unfortunately, to work is you're preying on two or three of the things that form a real integral part of a scam. And sadly, it just works.

RHONDA DEMENO: Yeah anything to deal with grandchildren, I'm right there, too. I would do anything for my grandchildren. So there are certain times of the year, I would think, that scams become more common. Talk to me a little bit about tax season, is that a time of the year, where we see more scammers?

SEAN SCRANTON: Sure. These things can tend to be a little cyclical. And they will prey on that cyclicality, as far as-- for instance, as you mentioned with tax season, we will see an uptick of scams. It's the IRS. We need to send your W-2S in for verification or it's ADP or if it's some type of HR thing. Well, it's really the scammer you're sending your W-2S. Why do they want those? Well, the scammers want W-2 so that they can file fraudulent tax returns and file fraudulent refunds and then have the refunds sent to them.

Similarly, on the personal side, we see an uptick in emails, as far as your refund was delayed. If it's after April 15, your refund was delayed. You need to click here or you need to call the IRS at this line. Well, it's actually not the IRS. It's really the scammers, quote, unquote, "help desk" type of thing. And so, again, going back to that sense of urgency, oh my gosh, it's my money. I want to get my money. I want to get my money now. It's the sense of urgency of wanting to get that money and fix these things.

We will also see an uptick around Thanksgiving time and Christmas time to where-- I buy quite a few things off Amazon, maybe some Christmas presents. And we'll see your package is delayed, click here to log into your Amazon account. Well, you're not logging into your Amazon account. You give them your Amazon password.

If you give them your Amazon password, you don't have two-factor authentication, they can get into your Amazon account. And maybe they can start sending themselves some packages, those kind of things. Or your package is delayed, please call this Amazon helpline. And it's not the Amazon helpline. It's actually the scammers. Again, it's that sense of urgency. It's that we see a lot of emails where, absolutely, my package does get delayed during November, December. It's impacting on those fears.

RHONDA DEMENO: And that's such a busy time of the year. I think it's very easy to get caught off guard and just innocently give information, not thinking that there's these scammers out there that are really trying to take advantage of you. When we're looking at when a vendor asks a resident to change banking or payment information, what should staff do or what should the residents do?

SEAN SCRANTON: This really goes to ensuring that you have a good program in place, as far as providing residents knowledge on these scams. And obviously, you don't have to have it every week or anything like that, but maybe every couple months, some tips and tricks, just friendly reminders, those kind of things. From the vendor side, this is usually more on the staff side to where staff will get an email to them that says, hey, obviously, we're one of your vendors. Well, more than likely, the vendor was hacked.

We're one of your vendors and we need you to change our banking information because we changed we just changed banks from there. And then, well, you change the banking information, but you're changing it to the scammer's banking information. And so the next invoice you get then that you pay, you're paying the scammer rather than the vendor.

What usually happens about a month and a half later, the vendor calls and they say, hey, wait a minute, where's my money? We've sent you invoices and you haven't been paying them. Like, well, yes, we have. We paid all the invoices. No, you haven't. And then it's the oh, oh realization that email back from a month and a half ago from changing the banking information, that wasn't real.

And maybe there's regular invoices, and maybe there's fraudulent invoices. And meanwhile, the scammer has sucked all the money, and they're gone. And the best way around that is if ever there's any sort of a vendor change, especially with banking information, it's what we call positive confirmation, and that's pick up the phone.

I can say on the residents side, you're always going to have a sense of urgency-- take a step back, wait a minute. On the vendor side, on the staff side, pick up the phone, make a call, call the vendor. Did you just send me an email to change banking information? Can you verify that? And not the phone that you get in the email, it's the phone number that you have on file for that vendor.

RHONDA DEMENO: Very good. I personally had a phone call from a local police station. And I was out of town. And I called immediately because I was concerned about my husband because it was the Sheriff's Department. And they were like, you need to call us right away.

And so I really got caught up in the sense of urgency, those things that you just address, thinking, well, something might have happened to my husband. And I'm out of town. And then the scammer sent a text message, giving me instructions on where to go. Because I was out of town, they said I needed to pay money to get more advice, or. I don't even want to lay out the specifics of.

But things like this happen so innocently. And when you are caught off guard, it makes you feel so vulnerable. So could you walk us through, just in that example, some immediate steps to take after a suspected scam or a cyber incident? If you feel that your computer's been hacked or your banking's been hacked, can you give us some immediate steps to take?

SEAN SCRANTON: Yeah, absolutely. First thing to do, probably the zeroth thing to do, is realize that this happens to lots of people. And it's OK if you feel embarrassed, but please temper that embarrassment with let's fix it. And realizing that it happens to a lot of people, that's one way.

A lot of people don't say anything because they're embarrassed. It's OK. I don't want to say it happens to everybody. It almost does. I can say almost everybody gets these types of scams. And lots of people fall for them. That's why they're out there. It's because they work.

Number one is make sure you tell somebody-- tell a family member, tell another resident, tell somebody on staff, tell anybody. It's acting quickly. It's calling your bank. It's going to your bank or having a family member go to your bank to straighten this out.

I work with a credit union here in my hometown. And I can't tell you how many issues that our tellers see with seniors coming in. And they're saying, I need to withdraw this money. I can't tell you why. And eventually-- we have credit unions, so it's members-- the member customer representative says, OK, would you like to talk to somebody about this? Because this sounds like a scam to me. And it's OK if it is. And sometimes, they will fess up and say yes. I don't know if it is, but it feels like one.

And the ones that we catch, the ones that the credit union catches, it's very much the scammers is running some type of a thing with-- they're trying to combat fraud at the bank or the credit union. And so we need you to withdraw money so that we can see if it's this teller or not. It's those kind of things that if you take a step back and have someone else look at it, like, OK, that's really far-fetched. But when you're in that sense of urgency and you're right in the thick of it, it's like, well, OK, yeah, that's plausible. That makes sense.

So it's telling somebody. It's explaining the situation. And then it's fixing the problem. It's either calling the bank or going down to the bank and telling them what happened. It's calling your credit card company, not on the scammers email, but taking a look at the back of your credit card and calling that number and saying, hey, this is what happens. It's getting others involved and putting aside that little bit of embarrassment and realizing that lots of people get hit by these.

RHONDA DEMENO: Yeah, I mean, I was very embarrassed. I did share it with my teammates because I was actually at a conference when it happened. But it just really gives gave me such a feeling of how vulnerable I was. And I'm a risk manager. [CHUCKLING] So things happen. So thank you for that information. So could you give some examples of everyday cybersecurity practice that improve personal and organizational safety? Can you give any tips on that?

SEAN SCRANTON: Absolutely. So first off is using strong passwords, using strong passwords, and especially for your bank account for your financial account. Because that's what they're after. It's very rare for me to see or even hear of a scam that does not end in some sort of financial aspect.

So we know what they're after. So we will take steps to protect our bank accounts, our credit card accounts, our 401Ks, our IRAs, all those kind of things. Let's put two-factor authentication-- sometimes, it's called multi-factor authentication. Let's put multi-factor authentication on those accounts. So you have to enter a code from your phone, those types of things. Better your phone than your email, because attackers may have access to your email.

As far as if you get a request for sending money, stop, think about it. Take a look at it. Verify it, verify it with another person. Report it, report it to someone else. That's going to hit, probably, 95%, 99% of the fraud just doing those three or four things.

If you're on the staff side, primarily, you're going to see things with vendor changes if you're in treasury or questions as far as you need to call the help desk to change your password. Your Microsoft account has been compromised. Please, call this number. You're not going to get an email from Microsoft to call this number. If you do want to call a number, then you need to go google Microsoft and look at their number. And please, do it that way. But the help desk you're calling is a scammer's help desk. And things are going to go South from there usually.

RHONDA DEMENO: Very good points. So for our listeners today, if there are only three things that they take away from our discussion, what should they be?

SEAN SCRANTON: Absolutely. And I'll probably give you four.

RHONDA DEMENO: That's OK. That's all right.

SEAN SCRANTON: So please take a step back, pause, before acting on any urgency, even if it's your grandchild's in jail. I hope it's not my grandchild in jail because she's four years old, so-- but think about the aspects of what's going on, as far as the request. Number two, verify through a trusted source, have someone else take a look at it, especially if you have requests for sending money, especially if they're running some kind of a thing, where we want to catch this organization in fraud. You're going to help us out. Really? Really? I'm going to help you out. You want me to help you out, OK.

Number three, put aside the embarrassment, report it, tell somebody. We have this adage, see something, say something, absolutely true. Please report those concerns immediately. And the fourth one is from a senior living center aspect, please have some sort of education program with your residents. And again, like I said, it doesn't have to be once a week. It can just be tips and tricks. You can have somebody like me or have an IT person come in and talk about these things.

It's all about security awareness. It has to be refreshed. The more you keep that refreshed, absolutely, at some point, someone is going to come up to you and say you know what? Because of those little trainings we had, I did not click on this or I did not call this number or I knew this was a romance scam. And it's really going to make your day.

RHONDA DEMENO: Well, those are some really good takeaways and not overly complicated. But I hope that senior living communities, the operators that listen in to our conversation station today, use this podcast as part of their educational materials. They can feel free to listen to it and share this content with their employees and with the residents.

Because I think we really hit on some very important things-- strong passwords, be very transparent about what type of correspondence you're getting that you may be very insecure about, any transaction or request for monies. Sean, you really highlighted a lot of those areas that scammers are using, why they are targeting senior living communities. So Sean, thank you very much for sharing your expertise and knowledge with us today.

SEAN SCRANTON: My pleasure.

RHONDA DEMENO: It was a pleasure having you. And I look forward to future conversations. And we hope that our listeners found this information very beneficial. Thank you for attending our Senior Advisor podcast. We hope you found the information to be informative. And we hope that you join us for future podcast.

SPEAKER: Thank you for joining us for this WTW podcast featuring the latest perspectives on the intersection of people, capital, and risk. For more information, visit the Insights Section of wtwco.com. WTW hopes you found the general information provided in this podcast informative and helpful.

The information contained herein is not intended to constitute legal or other professional advice and should not be relied upon in lieu of consultation with your own legal advisors. In the event you would like more information regarding your insurance coverage, please do not hesitate to reach out to us. In North America, WTW offers insurance products through licensed entities, including Willis Towers Watson Northeast incorporated in the United States, and Willis Canada incorporated in Canada.