WWCWildWildCrypto
Menu

Scam defense / Updated 2026-09-24

The Conversation Before the Loss: Protecting an Older Parent From Crypto Fraud

People aged 60 and over reported 4.43 billion dollars of crypto losses in 2025 — 39 percent of the total. Why the scripts work, which safeguards exist in brokerage but not in crypto, and what to set up before anything happens.

How this guide is checked

Official sources first, no wallet connection, no guaranteed returns.

Reviewed on 2026-09-24 by WildWildCrypto Safety Desk. Method: Human editorial review with official-source checks, affiliate-disclosure checks, and no-financial-advice checks.

Publisher: WildWildCrypto Editorial. Corrections go through the contact page. We do not ask for seed phrases or tell you what to buy.

protecting older parents from crypto scams matters because You have probably tried to raise this once, watched it land as an accusation about competence, and backed off — which leaves you with a real concern, no way to act on it, and a parent who now knows this is a subject that causes friction.

This guide gives you the documented scale of the problem, an accurate explanation of why the scripts work on capable people, an honest account of which consumer safeguards exist in regulated brokerage and do not exist in crypto, and a short list of things to actually set up.

You will learn which loss figures are worth quoting and which are counterproductive, why the instruction to keep it secret is the mechanism rather than a detail, what a trusted contact does and cannot do, why a cash-to-kiosk instruction is the clearest single red flag, and what to do in the first day if money has already moved.

The numbers that should change how you read this

It is worth starting with the scale, because the usual family assumption is that this is a rare misfortune rather than the single largest concentration of crypto loss on record.

The FBI's 2025 Internet Crime Report is specific. Cryptocurrency complaints reached 181,565 with 11.366 billion dollars in losses, an average loss of 62,604 dollars, and 18,589 complainants losing more than 100,000 dollars each. Broken out by age, people aged 60 and over filed 44,555 of those complaints and accounted for 4,432,224,488 dollars — roughly 39 percent of all reported cryptocurrency losses from one age band.

The wider elder fraud picture in the same report is worse in its direction of travel: 201,266 complaints from people aged 60 and over, 7.748 billion dollars in losses, up 59 percent from 2024, with an average loss of 38,500 dollars and 12,444 people losing more than 100,000 dollars.

One category deserves separating out, because it is where the age skew is starkest and where the money is least recoverable. For cryptocurrency ATM and kiosk fraud, the report records 13,460 complaints and 389 million dollars in losses, up 58 percent in losses from the prior year — and the 60-and-over group filed 6,188 of those complaints while accounting for 257,466,130 dollars. That is under half the complaints and roughly two-thirds of the money. The FTC's 2024 data spotlight on these machines found the same shape in its own complaint base for the first half of that year: people 60 and over were more than three times as likely as younger adults to report a loss using one, and more than two of every three dollars reported lost to fraud using these machines was lost by an older adult.

A word on how to use these figures. They are useful for calibrating your own urgency and for explaining to a sceptical sibling why this is worth setting up properly. They are counterproductive in the conversation itself, where reciting statistics about your age group reads as exactly the thing the next section says it is not.

Checklist

  • IC3 2025: 181,565 crypto complaints, 11.366 billion dollars lost, 62,604 dollar average.
  • Aged 60 and over: 44,555 crypto complaints and 4,432,224,488 dollars — about 39 percent of losses.
  • Elder fraud overall: 201,266 complaints and 7.748 billion dollars, with losses up 59 percent and complaints up 37 percent.
  • Crypto kiosk fraud: 13,460 complaints, 389 million dollars, losses up 58 percent.
  • Aged 60 and over accounted for 257,466,130 of that kiosk total.
  • FTC: older adults were more than three times as likely to report a kiosk loss.
  • FTC: more than two of every three kiosk dollars lost were lost by an older adult.

Why the scripts work, and why being careful is the wrong frame

The most common family explanation for these losses is the least accurate one, and believing it is why most attempted conversations fail. These are not failures of intelligence or attention. They are the intended output of a script designed by people who run it thousands of times and keep what works.

The FBI's standing 2021 advisory on schemes that route payment through crypto kiosks lists the framings: impersonation schemes, in which the caller identifies as the government, law enforcement, a legal office or a utility company; romance schemes, in which an online relationship builds a false sense of intimacy and dependency; and lottery schemes, in which a supposed prize requires fees. The FTC's account of the kiosk pattern adds the sequence that does the work — an unexpected call or message about suspicious account activity, escalating warnings that money is at risk or linked to criminal activity, impersonation of a government agent or a company such as Microsoft or Apple, and then the claim that depositing cash into a crypto machine will protect your money or resolve the problem.

Notice what that script is actually engineering. It manufactures authority, so questioning it feels like non-compliance. It manufactures urgency, so the ordinary instinct to check with someone becomes a delay with a cost attached. And it manufactures secrecy, usually by telling the target that the investigation is confidential, that a family member is under suspicion, or that discussing it will compromise the case.

That third element is the one to focus on, because it is the only part of the script with no legitimate counterpart. Real institutions do not require you to keep a payment secret from your family. Isolation is not a side effect of these scams; it is the load-bearing component, and it is what turns a bad hour into a loss discovered weeks later.

This reframing is also the practical route into the conversation. Be careful puts the burden on vigilance, which fails against a professional script and implies that falling for it would be a personal failing. Nobody legitimate will ever ask you to keep a payment secret from me is a single, memorable, checkable rule that carries no insult — and it happens to be the rule the scripts cannot survive.

Checklist

  • FBI: kiosk-routed schemes commonly impersonate government, law enforcement, legal offices or utilities.
  • Romance and prize scripts build dependency or a fee obligation first.
  • FTC pattern: unexpected contact, escalating warning, impersonation, then a demand to deposit cash.
  • The script manufactures authority, urgency and secrecy together.
  • Secrecy is the load-bearing part — no legitimate institution requires it.
  • Be careful is weak advice against a rehearsed script and implies blame.
  • A single rule works better: no legitimate party asks you to hide a payment from family.

The safeguards that exist in brokerage and do not exist in crypto

Families often assume a backstop is present because one exists elsewhere in their financial life. It is worth knowing exactly what that backstop is, and where it stops.

In regulated brokerage there is a specific, deliberately narrow mechanism. FINRA Rule 4512 requires member firms to make reasonable efforts to obtain the name of and contact information for a trusted contact person age 18 or older, and authorises the firm to contact that person to address possible financial exploitation, to confirm the specifics of the customer's current contact information, health status, or the identity of any legal guardian, executor, trustee or holder of a power of attorney, or as otherwise permitted by Rule 2165.

The limits are as important as the power, and they are what make it worth proposing to a parent. FINRA's investor guidance is explicit that naming someone as a trusted contact does not give that person authority to make decisions about your account or execute transactions, and does not make them a power of attorney, legal guardian, trustee or executor. It is a phone number the firm may call if something looks wrong — so asking a parent to name you costs them nothing in control, and that is the honest way to ask.

Now the gap. That framework attaches to broker-dealers. It does not attach to a self-custody wallet, where there is no firm to call anyone, and it does not attach to a crypto kiosk, where the FBI's warning about these machines exists precisely because the rail has no hold period, no second look and no reversal. A cash deposit into a kiosk, converted and sent, is gone in a way a wire sometimes is not.

Two conclusions follow. Use the protection where it genuinely exists — if a parent holds crypto exposure inside a regulated brokerage account, naming a trusted contact is free and low-friction. And do not assume an equivalent on the crypto side: design the family arrangement on the assumption that no institution will call you, because on this side of the system nobody else is going to.

Checklist

  • FINRA 4512: firms must make reasonable efforts to obtain a trusted contact aged 18 or older.
  • The firm may contact them about possible financial exploitation, contact details, health status or a legal representative.
  • FINRA investor guidance: naming a trusted contact grants no authority to decide or transact, and makes nobody a power of attorney.
  • Asking a parent to name you therefore costs them no control.
  • The framework covers broker-dealers, not self-custody wallets or kiosks.
  • Kiosk payments have no hold period, no second look and no reversal.
  • Use the protection where it exists; build your own where it does not.

What to actually set up, before anything happens

The aim is a small number of arrangements agreed while nothing is wrong, because every one of them is unavailable in the moment the script is running.

Start with a named second person for large or unusual moves. Not a veto and not supervision — an agreement that anything above a threshold the two of you choose gets mentioned to one other person first. Frame it mutually and mean it: you agree to the same rule for your own accounts. A rule that applies to one person is a judgement about that person, and it will be resented; a household rule is just a rule.

Add a waiting period. Twenty-four hours before any transfer initiated because someone else contacted them. Urgency is the ingredient the script cannot do without, so a delay is not a precaution against loss so much as a direct contradiction of the pressure. Attach it to the trigger rather than the amount, because the amount grows once compliance begins.

Agree the verification habit in advance. Any call about an account, a warrant, a refund or a frozen payment ends with hanging up and calling the institution on the number from a statement, a card or the official website. The FBI's own guidance on this family of schemes makes the same point about impersonation — an entity claiming to be government, law enforcement or a utility that can only accept cryptocurrency is not behaving as those entities behave.

Name the kiosk rule explicitly, because it is the highest-value single instruction here. There is no legitimate reason for any institution, official or support agent to send anyone to a crypto machine with cash. The FBI states it plainly: do not follow instructions from someone you have never met to scan a QR code and send payment via a physical cryptocurrency ATM. Given that this rail carried 389 million dollars of reported loss in one year, two-thirds of it from older adults, one sentence covering it is the best return available.

Then do the unglamorous inventory, which is the thing families most often skip and most often need. Where are the holdings, on which platforms, and where is the recovery material physically kept? This is not about control and it is not the same conversation as scam prevention — but crypto held by someone whose family does not know it exists is lost by default, and the inventory is what makes any later help possible at all.

Checklist

  • Agree a named second person for moves above a chosen threshold — mutually, both ways.
  • Set a 24-hour delay on any transfer prompted by inbound contact.
  • Verify by hanging up and calling back on a number from a statement or official site.
  • FBI: an entity that can only accept cryptocurrency is not behaving like a real institution.
  • Name the kiosk rule: nobody legitimate sends you to a crypto machine with cash.
  • FBI: do not scan a QR code and pay at a crypto ATM on a stranger's instruction.
  • Record where holdings and recovery material live, separately from the scam conversation.

Having the conversation, and the first day if money already moved

The reason this conversation usually fails is that it is heard as a test of competence, and the reason it matters is that the scam depends on the target having nobody to check with. Those two facts point at the same tactic: make the subject about the scripts rather than about them.

Concretely, that means leading with the mechanism instead of the warning. Describing how the pressure and secrecy work is information; telling someone to be careful is an assessment. And a story about a scam that nearly caught you, if you have one, does more than any statistic, because it establishes that these operations target whoever answers rather than a category of person.

Leave the door open at the end, deliberately. The single most valuable sentence you can install is that there is nothing they could do that would make you angry rather than useful. Shame is what buys the scam its extra weeks, and weeks are what make recovery impossible.

If money has already moved, the first day matters and panic is the enemy. Write down the timeline while it is fresh: names used, numbers called, platforms involved, transaction hashes, kiosk locations and receipts. Contact the platforms immediately, because a transfer still sitting with an exchange is occasionally reachable in a way an on-chain transaction is not. File with the FBI's Internet Crime Complaint Center, and keep the report factual and complete — aggregate reporting is how programmes described in the same annual report, such as Operation Level Up, identify and notify victims.

Then brace for the second wave, which is now large enough to be its own industry. The 2025 report records 10,516 recovery scam complaints and 1.4 billion dollars in losses, noting an increase in complaints reporting impersonation of government officials and recovery firms, and the FBI has separately warned about fictitious law firms targeting cryptocurrency scam victims while offering to recover funds. Someone who has just lost money is a known, identified, motivated target, and the approach arrives quickly. The rule is short: nobody who contacts you first can recover your crypto, and anyone requiring an upfront fee to do it is the same crime a second time.

Checklist

  • Lead with how the scripts work rather than with a warning about them.
  • Share your own near-miss if you have one — it removes the implied judgement.
  • Ask for rules that bind you as well, making it a household practice.
  • Say explicitly that disclosure will never be met with anger — shame costs weeks.
  • If money moved: write the full timeline, hashes, receipts and kiosk locations.
  • Contact platforms immediately and file with IC3.
  • IC3 2025: 10,516 recovery scam complaints and 1.4 billion dollars in losses.
  • Nobody who contacts you first can recover crypto; an upfront fee is the second theft.

Authority sources used

Outbound links are included for verification and entity authority, not decoration.

FAQ

How do I raise this without my parent feeling patronised?

Change what the conversation is about. Most attempts fail because they are heard as a verdict on competence, and that reading is not unreasonable when the message is effectively be more careful. The alternative is to talk about the scripts rather than the person — how a caller manufactures authority by claiming to be law enforcement or a utility, how urgency is added so that checking with someone becomes a cost, and how the instruction to keep it confidential is the part that makes the whole thing work. That is information, not assessment, and it is genuinely interesting. Two things help further. Bring a near-miss of your own if you have one, because it establishes that these operations target whoever answers rather than a type of person. And propose rules that bind you too: a second pair of eyes on moves above a threshold, in both directions. A rule applied to one household member is a judgement about them and will be resented; the same rule applied to everyone is just how the household does things, and it is the version that survives contact with a real scam call.

Is there anything like a trusted contact for a crypto account?

Not reliably, and the gap is worth understanding precisely because families assume otherwise. In regulated brokerage, FINRA Rule 4512 requires firms to make reasonable efforts to obtain a trusted contact aged 18 or older and lets the firm contact that person to address possible financial exploitation, confirm current contact details or health status, or identify a legal guardian, executor, trustee or power of attorney holder. Its appeal is how limited it is: the trusted contact has no authority over the account, cannot make trading decisions and does not become a power of attorney, so naming someone costs the account holder nothing in control. That framework applies to broker-dealers. It does not apply to a self-custody wallet, where no firm exists to make the call, and it does not apply to a crypto kiosk. So the practical answer is to use it wherever a parent's crypto exposure sits inside a regulated brokerage account, and to assume no equivalent on the self-custody side — which is why the family-level arrangements, a named second person and a waiting period, are doing work that no institution will do for you.

My parent was told to keep the situation confidential. Is that ever legitimate?

No, and this is the most useful single test in the whole subject. Legitimate institutions have no need for you to hide a payment from your family, and the secrecy instruction appears in these scripts for a specific reason: it removes the one thing that reliably stops the loss, which is somebody outside the conversation hearing about it. It arrives in a handful of recognisable forms — an investigation described as confidential, a warning that a relative is a suspect, a claim that discussing it will compromise a case, or simply the suggestion that family would not understand a time-sensitive opportunity. Treat every one of them as the finding rather than a detail. The corresponding rule is short enough to remember under pressure and requires no expertise to apply: no real bank, agency, court, police force or support desk will ever ask you to keep a payment secret from your family, so an instruction to do so identifies the call as a scam regardless of how plausible everything around it sounds. It is also a rule that costs nothing if you are wrong, which is what makes it usable.

Why are crypto ATMs singled out so often?

Because the rail removes every point at which someone might intervene, and the loss data reflects that. The FBI issued a specific warning about schemes leveraging cryptocurrency ATMs and QR codes to facilitate payment, and the advice in it is unusually direct: do not follow instructions from someone you have never met to scan a QR code and send payment via a physical cryptocurrency ATM. The mechanics explain the emphasis. Cash goes in, a QR code supplies the destination, the funds convert and leave, and there is no hold period, no clearing window, no institution reviewing the transaction and no reversal. Compare that with a bank transfer, where staff sometimes ask a question and a payment can occasionally be recalled. The 2025 Internet Crime Report records 13,460 kiosk complaints and 389 million dollars of losses, up 58 percent in losses year over year, with people aged 60 and over accounting for 257,466,130 of that total; and the FTC's 2024 spotlight found older adults lost more than two of every three dollars reported lost through these machines. Which is why a single sentence covers it: no legitimate institution, official or support agent ever sends someone to a crypto machine with cash.

My parent has already sent money. What matters in the first day?

Documentation, speed and refusing the second approach. Write the timeline down while it is fresh, including the names and numbers used, the platforms involved, any transaction hashes, and for kiosk payments the machine location and receipts — memory degrades quickly and this record is what every subsequent step depends on. Contact the platforms immediately, because funds that have not yet left an exchange are occasionally reachable in a way an on-chain transfer is not, and that window is short. File a report with the FBI's Internet Crime Complaint Center even if recovery seems unlikely, since aggregate reporting is how the task forces described in the same annual report locate and contact victims. Then prepare for the follow-up, because it is close to certain: the 2025 report logs 10,516 recovery scam complaints with 1.4 billion dollars in losses and notes rising impersonation of government officials and recovery firms, and the FBI has warned specifically about fictitious law firms offering to recover funds for crypto scam victims. The rule that holds: anyone who contacts you offering recovery, and anyone asking for a fee upfront, is the same crime arriving a second time.

Should I just take over managing their crypto?

Rarely, and it is worth being clear about why the instinct misfires. Taking control removes autonomy from someone who has not lost the capacity to exercise it, and it tends to produce exactly the outcome you are trying to prevent: a parent who stops telling you things, because telling you now means losing more ground. Secrecy is the ingredient these scams depend on, and a family arrangement that punishes disclosure supplies it for free. The more effective posture is friction they agreed to in advance — a named second person for moves above a threshold, a 24-hour delay on anything prompted by an inbound call, and a call-back-on-the-official-number habit — all framed mutually so it reads as household practice rather than supervision. Separately, and not in the same conversation, make sure you know where holdings and recovery material physically live, because crypto whose existence the family is unaware of is lost by default. If genuine cognitive decline is in the picture, that is a different problem with different instruments, and the route is a proper legal arrangement discussed early, not an informal takeover.