On Christmas Day, a woman picked up her 74-year-old mother’s phone and found messages from someone she didn’t recognize.
What she uncovered had been unfolding for nearly a year, cost her mom hundreds of thousands of dollars, and started with something millions of people do every day.
And to her mom, none of it felt suspicious.
That’s what can make scams like this so difficult to recognize, even for careful, intelligent people.
But other financial threats don’t require criminals to earn your trust at all.
In this episode, I’m sharing what her story can teach us about protecting our money.
I’m also sharing what you need to know about passkeys, a newer (and safer) way to sign in to your online accounts.
Here’s what you’ll learn:
- 4 simple habits that can make it harder for scammers to earn your trust
- How passkeys work, the 3 places to store them, and what happens if you lose your phone
- How criminals can sometimes access your accounts without needing your password, passkey, or verification code
The best protection is layered: stronger security on your accounts, a few simple habits, and someone you trust to call before you act.
Listen To This Episode On:
When You’re Ready, Here Are 3 Ways I Can Help You:
- Schedule a Free Retirement Strategy Session. Get your questions answered + learn how we can help you improve retirement success and lower taxes.
- Listen to the Stay Wealthy Retirement Show. An Apple Top 50 investing podcast.
- Join My Retirement Newsletter. Weekly retirement and investing tips (delivered to our inbox!)
+ Episode Resources
- AARP: How to Keep a Loved One With Cognitive Decline Safe From Scams (Christina Ianzito)
- FBI Internet Crime Complaint Center: 2025 Internet Crime Report (PDF)
- JAMA Internal Medicine: Financial Presentation of Alzheimer Disease and Related Dementias (Johns Hopkins study)
- Episode 256: 8 Red Flags You’re About to Get Scammed
- Episode 279: The 6-Digit Code That Can Drain Your Retirement Account (And How to Stop It)
- Episode 294: 5 Steps to Protect Your Aging Parents’ Money (Before It’s Too Late)
- Hive Systems: The 2026 Password Table (How Fast Can a Hacker Crack Your Password?)
- Password Managers:
- Credit Freeze:
- FIDO Alliance: What Are Passkeys?
- Apple: About the Security of Passkeys
- Yubico: YubiKey Physical Security Keys
- Fidelity: Passkeys and Extra Login Security
- FIDO Alliance: Passkey Directory (Websites That Support Passkeys)
- FIDO Alliance: Passkeys, the Journey to Prevent Phishing, Part 3 (Session Cookie Theft)
- Free Download: The Retirement Security Checklist
+ Episode Transcript
On Christmas Day, Jessica, a Massachusetts event planner, picked up her 74-year-old mother’s phone and discovered a string of messages from someone she didn’t recognize.
As she later told AARP, “My heart was racing. I had no idea what I was looking at.”
What she eventually learned was that her mother, Joyce, had spent most of the past year messaging with people she thought were country music star Vince Gill and members of his inner circle. And during that time, she’d sent them roughly $450,000.
But in Joyce’s mind, this was much more than a financial relationship. She and the person pretending to be Vince called each other husband and wife, and she’d even told friends she was planning to move to Nashville to be closer to him.
Now, it’s easy to hear a story like this and assume you’d recognize the warning signs. But to Joyce, none of this felt suspicious, and that’s what can make scams like this so hard to spot, even for careful, intelligent people.
So today, I’ll walk through how the scammers earned Joyce’s trust, and what her experience can teach us about protecting ourselves and the people we love. Then, thanks to some thoughtful questions from our wonderful client and longtime listener, Den, we’ll explore the world of passkeys, a newer and safer way to sign in to your online accounts.
I’ll explain how they work, where to keep them, and what happens if your phone is ever lost or stolen. We’ll also examine a security risk that often gets overlooked: how criminals can sometimes get into your accounts without ever needing your password, your passkey, or a verification code.
And if you’re a Stay Wealthy newsletter reader, I’m sharing my 12-page retirement security checklist in today’s email to prevent you from needing to take notes and help you take action after today’s episode.
If you’re not already a newsletter reader, you can grab the checklist by going to youstaywealthy.com/security or by following the link in the episode description in your podcast app.
Welcome to another episode of the Stay Wealthy Retirement Show. I’m your host, Taylor Schulte, and every week I cover the most important financial topics to help you “stay wealthy” in retirement. Ok, onto today’s episode.
The $450,000 Celebrity Scam (Plus Your Passkey Questions, Answered)
To understand how all of this happened, we need to go back to the fall of 2022, when Joyce left a simple comment on one of Vince Gill’s Instagram posts.
She’d been a fan of his for years, and all she did was leave a friendly message on his post saying, “I hope you come to Boston!”
That was it. The kind of comment millions of people leave on social media every day without giving it a second thought.
But shortly after, messages started pouring in from accounts claiming to be Vince Gill, his daughter, and his manager. And one by one, those accounts asked her to continue the conversation on private messaging apps like Telegram.
Christina Ianzito, who covers scams and fraud for AARP and reported Joyce’s story, actually tested this herself. She commented “love this!” on one of Gill’s Facebook posts, and she, too, received several requests from fake fan accounts asking her to chat privately.
In other words, Joyce wasn’t being singled out. These scammers regularly watch celebrity social media pages for people to contact, and something as simple as leaving a comment gives them an opening.
And it works often enough to be a big business. According to the FBI’s most recent Internet Crime Report, Americans lost more than $900 million to romance and confidence scams last year alone.
As the conversations with Joyce continued, the reasons she needed to send money became more elaborate. At one point, the person pretending to be Vince Gill told her he was going through a divorce from his wife, Amy Grant. He claimed Amy had frozen his bank accounts, and he needed Joyce’s help. Of course, none of it was true.
Now, whenever I share a story like this, here on the podcast or with friends and family, a common and understandable response is, “Seriously? How could anyone really believe that?”
As I shared in episode 256, 8 Red Flags You’re About to Get Scammed, falling for a con doesn’t mean you’re careless, stupid, or gullible. It means you’re human. You see, con artists don’t typically go looking for unintelligent people – they go looking for feeling people: people who are hopeful, people who are under pressure, and people who believe in fairness and goodwill. Or, as Kathy Stokes, who leads fraud prevention programs at AARP, put it, these criminals “have a playbook,” and that playbook can work regardless of someone’s age, education, or background.
Which is why one of the most dangerous beliefs you can have is that you’re immune – because confidence is exactly what scammers exploit. As Jonathan Walton, who lost nearly $100,000 to a scam, once described it, a con is essentially a “consensual hallucination” between someone telling a lie and someone who desperately wants to believe it.
Now, in Joyce’s case, there was another factor that may have made the lie even harder to see through. Jessica had already begun to notice changes in her mom’s memory and judgment prior to her scam, and in late 2024, a doctor officially diagnosed Joyce with Alzheimer’s disease. Naturally, Jessica believes her mom’s declining cognitive health played a role in making her more vulnerable to the scam.
But, ultimately, once Jessica understood what was happening, she and a social worker stepped in to protect her mom. Jessica took over Joyce’s finances, and Joyce now lives in an assisted living community near her daughter, outside Boston.
And while Joyce is doing well and receiving the care she needs, Jessica is still working through the financial damage today – she even sold her own car to help pay a large tax bill tied to her mom’s scam losses. In other words, the impact of a scam can reach well beyond the person who sends the money, and it can continue long after the payments stop.
Now, I wanted to begin with Joyce’s story because it shows how much damage a criminal can do simply by earning someone’s trust. And before we get into how to protect yourself in this increasingly complex world, I want to pull out two lessons from her experience that shape everything else we’ll cover today.
What This Story Can Teach Us
The first lesson is for anyone keeping an eye on a parent or loved one: which is that problems with money can show up well before cognitive decline is confirmed by a medical professional.
In fact, Johns Hopkins researchers studied more than 81,000 Medicare beneficiaries and found that people later diagnosed with dementia were more likely to miss payments and see their credit scores decline, up to six years before their diagnosis.
Of course, one missed payment doesn’t mean someone has dementia, but if someone who’s always been careful with money starts making unusual mistakes, it’s worth paying attention. They may need more support, including extra help and protection from people looking to take advantage of them.
The second lesson is that criminals can reach your money in two very different ways. Sometimes they persuade you to act, like what happened to Joyce. Other times, they steal your information and use it without your knowledge.
Ian Bednowitz, an executive at the company behind Norton and LifeLock, shared an example involving his late mother. In 2015, he discovered that her caregiver had stolen her Social Security number, along with balance-transfer checks from her mailbox. And when he pulled his mother’s credit report after learning this had happened, he found tens of thousands of dollars in loans and credit card balances in her name.
So, while Joyce was persuaded to send money, Ian’s mother had her information stolen and used without her permission. Both suffered serious financial harm, but protecting against those threats requires different steps.
So, before we get to the heart of today’s episode, let’s quickly review a few habits that help with each. I’ve covered some of these before, and I’ll link to past episodes in the show notes if you want to revisit them in more detail. But they’re worth running through again at a high level, especially if doing so finally prompts you to take action.
Habits That Make Persuasion Harder
Now, the challenge with combating persuasion is that, when implemented by an expert scammer, we don’t always recognize it when it’s happening. A request can seem perfectly reasonable in the moment, which is why having a few simple habits in place before someone contacts you can be more reliable than trying to recognize a scam when it’s happening.
With that in mind, habit #1 is to treat unsolicited contact with healthy suspicion. That includes calls, texts, emails, and especially social media messages from strangers, including someone claiming to be your favorite celebrity. Consider making your social media accounts private, declining requests from people you don’t know, and treating invitations to move a conversation to a private messaging app as a giant red flag.
Habit #2 is to choose someone you’ll check with before taking certain actions. Most people only ask for a second opinion when something feels suspicious. But to Joyce, nothing did. So, I would suggest making the trigger an action, not a feeling. Agree to call someone before sending money to a person you’ve never met, sharing a security code, or keeping a financial conversation secret.
You might also consider making it a mutual family agreement, and promise there won’t be judgment in the hopes that it will make it a little easier for someone to pick up the phone when they need to without feeling embarrassed.
Habit #3 is to add a trusted contact to your financial accounts, which most major banks and financial institutions allow. As a reminder, this doesn’t give the person access to your money or permission to make transactions. It simply allows the institution to reach out to them if they suspect fraud or financial exploitation, or if they’re having trouble getting in touch with you.
And finally, habit #4 is to turn on account alerts and create some financial visibility. Most financial institutions can send you a text, email, or app notification for large withdrawals and other unusual activity, and it’s generally a good idea to turn on most of the alerts they offer, both for yourself and for the loved ones you help. You can also bring a family member into the loop. For example, Sarah Lock, a senior leader at AARP, shared that when her father was experiencing cognitive decline, she arranged to have a second set of his financial statements sent to her each month just so she could watch for anything unusual.
None of these steps guarantees protection. But a trusted contact, an alert, or a second set of eyes might have brought Joyce’s situation to light before the losses reached nearly half a million dollars.
And if you’re helping an aging parent, I’ll link to episode 294 in today’s show notes for quick access, where I covered the legal side of stepping in, including common mistakes made with durable powers of attorney.
Locking the Doors
Now let’s turn to theft that doesn’t depend on a criminal winning your trust. I’ll keep these reminders brief, but the last one is especially important because it helps explain why passkeys are such a meaningful improvement over traditional passwords.
And then towards the end of the episode, we’ll zoom in on a security risk that even passkeys can’t eliminate, including how someone could gain access to an account you’re already signed in to without ever needing your password, passkey, or security code, and what you can do to help protect against it.
Without question, the very first step to mitigating theft of sensitive information is to protect your email account like you would your bank account. Most websites require you to reset a forgotten password through email, which means someone who gets into your inbox may also be able to get into other accounts, including financial ones.
So, if you’re deciding where to focus your energy first, I’d start with your primary email account.
Next, while likely obvious, remember to use a long, unique password for every account that still requires one. According to cybersecurity firm Hive Systems, an eight-letter lowercase password could be cracked in two weeks, compared with 21,000 years for one containing 12 lowercase letters. Add uppercase letters and symbols, and it climbs into the billions of years. And remember, reusing a password puts multiple accounts at risk when one company suffers a data breach.
A password manager can create and remember unique passwords for you. I’ve used Dashlane for years, but 1Password and Bitwarden, in addition to native apps from Apple or Google, are other options as well. Just remember that storing old passwords doesn’t make them stronger. Fortunately, most password managers can identify weak, reused, or compromised passwords and help you replace them. So start with your email and financial accounts, then gradually work through the rest.
Another step I’ve talked about quite a bit on the show is to freeze your credit with Equifax, Experian, and TransUnion. It’s free, doesn’t affect your credit score, and makes it much harder for someone to open new loans or credit cards in your name, like the incident with Ian’s mother. Just remember that a freeze doesn’t protect accounts you already have, so you’ll still want to regularly review your statements for anything you don’t recognize.
Finally, turn on multi-factor authentication wherever it’s available. That usually means confirming your identity with a 6-digit code after successfully entering your password. Texted codes are better than a password alone, but authenticator apps you download to your device generally offer even stronger protection.
Either way, a criminal can still trick you into sharing a code or entering it on a fake website. And that weakness is exactly what passkeys, a newer way to safely sign in to your online accounts, are designed to fix. With a passkey, there’s no password to type and, in many cases, no separate code that someone could talk you into sharing.
What Is a Passkey?
As I mentioned earlier, our wonderful client and long-time listener, Den, recently sent over a thoughtful list of questions about online security and passkeys, and I suspect they’re the same questions many of you have.
Rather than walk through them one by one, I’ve built the answers into the rest of today’s episode. So let’s start at the beginning: what is a passkey?
Put simply, a passkey is a digital key made for one specific online account. The digital key lives on your phone, your computer, or another storage device which we’ll talk about shortly.
So, when you go to sign into a website you’ve set up a passkey for, your device recognizes that it has the right key for that website, and it asks you to approve using it, usually with the same face scan, fingerprint, or PIN you already use to unlock your phone. Once you approve, you’re in.
That also means you won’t need to remember your passkey. In fact, you’ll never even see it. You also don’t need to go looking for it because your device will typically offer it when you visit a website where you’ve set one up.
Behind the scenes, a passkey is made up of two matching pieces. One piece stays protected on your device or with your passkey provider, and the other piece is kept by the website. When you attempt to sign into a website where you’ve set up a passkey, your device uses its half to create a one-time digital signature, and the website uses its half to confirm the signature is genuine.
That’s very different from a password. When you type in a password, you’re handing the website a copy of your secret, and anyone who intercepts that copy, or tricks you into giving it to them, can use it too. With a passkey, the secret itself never changes hands.
And to clear up one common misconception: your fingerprint, face scan, and PIN never leave your device, either. They simply give your device permission to use the passkey. The website never receives them, and that design protects you against the two most common ways criminals steal login information.
Why Passkeys Offer Stronger Protection
The first is a fake website. Imagine you get an email that appears to come from your bank, let’s say Wells Fargo. You click the link and land on a page that looks exactly like Wells Fargo’s sign-in screen. With a password, that convincing fake page is all a criminal needs. You type your password in, and now they have it. And as we just covered, a six-digit code can be captured the same way.
A passkey is different, because each one is tied to the real website’s address. If you created your passkey on wellsfargo.com, it only works on wellsfargo.com. So when you land on a look-alike page, your device has no passkey to offer. In other words, even if the fake webpage fools your eyes, it can’t fool your device.
The second common way criminals can get ahold of your login information is being talked into it. For example, a scammer might call or text you pretending to be your bank and convince you to share your login information. But with a passkey, there’s nothing to share. Since you never see the secret matching half of the key, you can’t read it to anyone.
And that’s why security experts describe passkeys as phishing-resistant. As a quick refresher, phishing is the term for fake emails, texts, calls, and websites designed to trick you into handing over your login information. In other words, your protection no longer depends on you spotting the fake, which matters more every year as AI makes impersonation more convincing.
This also gives you one of the most useful habits you can build. If you normally sign in to a website with a passkey, and one day the “enter your passkey prompt” doesn’t pop up on your screen, don’t assume it’s broken and type in your password instead – treat it as a warning sign that you may be on the wrong website. Close the page, type the website’s address in yourself or use a saved bookmark, and try again. Sometimes a passkey fails to appear for harmless reasons, but the safe and smart response is the same either way.
In case it’s not obvious, passkeys handle a couple of the habits we covered earlier automatically, making your to-do list after this episode a little shorter. For example, a passkey you set up is unique to one website, and because the website only keeps its half of the key, a data breach at that company doesn’t give a criminal what they need to sign in as you. Now, a breach can still expose other personal information, which is why credit monitoring and freezing your credit are still critical steps everyone needs to take.
A passkey also doesn’t protect every part of your account, including what happens after you’ve successfully signed in, which we’ll get to shortly.
Where Should You Keep Your Passkeys?
But first, let’s discuss an important decision you need to make before creating your first passkey: where you’ll save it.
With passwords, they were typically either in your head, a notebook, or a password manager. Passkeys are less obvious, and that explains one of the most common frustrations people run into. One day, you’re prompted to create a passkey on your phone, and later your computer tells you that you don’t have one for a particular website you’re trying to access. Usually, the passkey is there, it’s just saved somewhere your computer can’t see.
So the simplest rule is this: keep your passkeys in one place so that every device you use can access it. Doing that also gives you one place to see and manage all of them.
When choosing where to store your passkeys, there are three main options.
Option #1: The Password Manager Built Into Your Devices
For many people, the easiest place to start is the password manager that’s already built into your phone, computer, or browser.
For example, if all of your devices are Apple, passkeys saved in Apple’s Passwords app sync through iCloud to your other Apple devices, as long as syncing is turned on. Google Password Manager does the same thing across devices signed in to your Google Account.
Both Apple and Google protect synced passkeys with end-to-end encryption, which simply means that your passkeys are scrambled so that even the company storing them can’t read them.
Where most people tend to run into trouble is mixing brands. For example, let’s say you use an iPhone with Safari and a Windows computer with Chrome. Your iPhone saves passkeys to Apple Passwords, your computer saves them to the Google Password Manager, and the two won’t automatically share. One simple fix is to use Chrome on both devices, so they share Google Password Manager. Another is to create a separate passkey on each device. If those options aren’t ideal, you can consider using the second option.
Option #2: A Separate Password Manager
The second option is a dedicated password manager, like the ones I mentioned earlier: Dashlane, 1Password, or Bitwarden. Because these work across Apple, Android, and Windows, they’re often the simplest choice if your devices don’t all come from the same company or you like to mix and match applications that don’t natively talk to each other.
Just keep in mind that choosing this option means your password manager now holds the keys to almost everything, so you’ll want to protect it with a strong, unique password as well as two-factor authentication if available.
Option #3: A Physical Security Key
Lastly, the third option to consider is a physical security key, like YubiKey, which is one of the more popular solutions. In short, it’s a small device you plug into your computer or use with a compatible phone, and it stores your passkeys directly on the device rather than syncing them through the cloud.
This, of course, gives you more direct control, but it also comes with an important trade-off. If you lose the physical key, you can’t recover the passkeys stored on it or transfer them to a replacement. That’s why it’s recommended that you register a second, backup key with each account and keep it somewhere safe.
And this brings me to a message you may have encountered when signing in to an account. Sometimes, your computer will ask you to “insert your passkey” or “insert your security key,” which can be confusing if you’ve never used one of these devices, and especially confusing if you don’t even know what passkeys are.
In most cases, the prompt is simply offering you the option to use a physical security key, like Yubikey. If you don’t own and use one, you can typically cancel the prompt and choose another way to sign in, such as a passkey saved on your phone or in your password manager.
While physical security keys are a great option for anyone to consider, they tend to be used most frequently by those who face a higher risk of targeted cyber attacks, like journalists, celebrities, or public officials. For most households, a syncing password manager is likely a more convenient place to start.
How to Create Your First Passkey
Now, once you’ve decided where your passkeys will be stored, creating one is fairly simple.
First, the website or app needs to support them. Many major services you use every day already do, and finally, as of a couple of weeks ago, Fidelity.com has indicated that they now support passkeys as well.
To check if passkeys are supported on a particular website, look in your account settings under “Security” or “Sign-in options,” or keep an eye out for a prompt after signing in. The FIDO Alliance also maintains a searchable directory of websites that support passkeys, which I’ll link to in today’s show notes if you want to save it as a resource.
When you’re ready to create your first passkey, you’ll simply start by opening the official app or typing the website address directly into your browser. Sign in on a trusted device, find the passkey setting, and before approving anything, confirm that the passkey will be saved with the provider you chose (Apple, Google, third-party password manager, etc.). Then, follow the prompts to select and approve your biometric identifier like your fingerprint, but before signing out, make sure you still have a backup way into the account, like a traditional password coupled with two-factor authentication. Lastly, I always test my new passkey before moving on by signing out and signing back in to confirm everything is working and stored properly.
One last thing worth knowing. If your passkey is stored on your phone and you want to sign in on a computer that doesn’t have it, many websites will let you scan a QR code with your phone and approve the sign-in there. Just make sure it’s a sign-in you initiated yourself.
What If You Lose Your Phone?
And that brings us to an important question: what happens if you lose your phone or replace your computer?
In short, it depends on where your passkeys are stored. If you’re using a provider that syncs them, your passkeys may already be available on another device, or you can recover them through the provider’s account recovery process. But if a passkey is stored on just one device or a physical security key, you won’t have that same automatic backup.
That’s why it’s worth taking a few minutes to review your recovery options. Make sure the email address and phone number on your important accounts are current, and that you have a backup way to sign in if your primary device is lost. That might be another device, a second passkey, or recovery codes stored somewhere safe and accessible.
You should also understand what your provider requires to recover your account, and at the same time, be careful not to create a recovery plan that depends on itself. For example, if you use a password manager like 1Password, you don’t want the only information needed to recover it stored inside that same application.
Finally, consider how someone you trust could access your accounts in an emergency. That might mean documenting where your logins are stored and what steps a spouse or family member would need to take. Some providers, like the password managers I mentioned earlier, even offer emergency-access features for this purpose, making it a natural addition to the estate-planning conversation we covered back in episode 294 on how to protect your aging parents’ money.
Where Passkeys Still Fall Short
Now, if all of this is starting to sound like another technology project to add to your to-do list, I get it. Security fatigue is real, and while passkeys can eventually make signing in easier, the transition is still uneven.
For starters, many financial institutions have been slower to roll them out, although with Fidelity’s recent adoption, I wouldn’t be surprised if we see more of them announce their support in the coming months.
But even where passkeys are available, the experience can vary. For example, different devices often show different prompts, some sites ask for extra verification while others don’t, and it’s easy to lose track of where you saved a particular passkey. Moving your passkeys from one provider to another is getting easier, but it isn’t seamless yet, so choosing one consistent home for your passkeys can save you a lot of confusion.
And finally, adding a passkey doesn’t necessarily remove the other ways into an account. On many websites, your old password and verification code stay on as a backup. So if that backup password is weak, or the website’s recovery process is easy to fool, the account may still be vulnerable. That’s why strong, unique passwords and two-factor authentication still matter, both on accounts without passkeys and on any password backup that remains turned on.
What a Passkey Can’t Protect
Before we wrap up, there’s one important limitation of passkeys worth understanding. A passkey makes it much harder for someone to break into your account, but it doesn’t necessarily protect what happens after you’ve signed in.
Here’s what I mean. When you log in to a website, your browser typically receives something called a session cookie. A cookie is a small piece of information that tells the website you’ve already signed in, so you don’t have to prove your identity every time you visit another page. Think of it like the wristband you get at a concert. Once your ticket is checked at the entrance, the wristband lets you move around freely without needing to show your ticket again. But if a criminal gets hold of that wristband, they may be able to impersonate you.
Similarly, if malicious software steals your session cookie, a criminal may be able to access your account without needing your password, passkey, or verification code. This is commonly referred to as session hijacking.
And there’s another limitation we’ve already seen in Joyce’s story. A passkey can’t stop someone from persuading you to send money. Joyce was signing in to her own accounts and sending money to someone she believed was her husband. Even the strongest sign-in protection wouldn’t have prevented that.
Now, while websites bear much of the responsibility for preventing session hijacking, there are steps you can take to reduce your risk. As a starting point, keep your operating system, apps, and software updated, avoid suspicious downloads, and hopefully it goes without saying, be especially cautious if someone asks you to install a program that gives them remote access to your computer.
As one step further, for highly sensitive accounts, I would suggest setting a shorter automatic sign-out period, so you are automatically logged out if you step away from your device and forget to end your session.
It’s also worth periodically checking which devices are signed in to your sensitive accounts. To check which devices are signed in, open the sensitive website or app, go to your account settings, and look under Security for something like “Your Devices” or “Active Sessions.” From there, review the list and sign out of any devices you no longer use or don’t recognize. Keep in mind that your phone, computer, and even different browsers on the same device may appear as separate entries, so seeing several isn’t necessarily a red flag. But if you spot activity that clearly isn’t yours, sign out of that session immediately and follow the account’s instructions to secure it, including changing your password if applicable.
And really quick, one quick clarification. Those “accept cookies” banners you see on websites are generally about advertising and privacy preferences, not the session cookies that keep you signed in.
The Bottom Line
At the end of the day, no single tool is going to make you scam-proof.
Passkeys can make it much harder for someone to break into your accounts, but as Joyce’s story shows, some of the most costly scams don’t involve breaking in at all. They involve convincing a kind, trusting person to open the door themselves.
So the protection that matters most is layered: strong locks on your accounts, and a few habits and people around you that slow things down when something doesn’t feel right.
To wrap this up, here are a few questions worth sitting with this week. Is your email account protected as carefully as your bank account? Is there at least one person in your life who knows you’ll call them before acting on anything unexpected? Have you named a trusted contact on your financial accounts? And if you’re helping an aging parent, would you notice if their money started moving differently?
In Christina’s article, Ian said he wishes he’d known about the steps that may have helped prevent what happened to his mom. My hope is that today’s episode gives you and your family a head start.
And to help you put all of this into action, don’t forget to grab my 12-page Retirement Security Checklist, which starts with five simple steps that take about 60 minutes and close some of the biggest gaps we covered today. It also includes a one-page set of family rules along with a step-by-step plan for the first hour if something ever does go wrong. Newsletter readers will find it in today’s email, and if you’re not on the list yet, you can grab it at youstaywealthy.com/email.
Thank you, as always, for listening, and once again, to view the articles and resources referenced in today’s episode, just head over to youstaywealthy.com/307.
Disclaimer
This podcast is for informational and entertainment purposes only, and should not be relied upon as a basis for investment decisions. This podcast is not engaged in rendering legal, financial, or other professional services.




