Nothing has happened yet, and I want to get my parents’ accounts ready.

Check what someone could move today with your phone and password

Open your own banking and ask yourself one question.

Write down your guess first. We think the real number is often larger. Look for:

• The chequing account.
• The savings account linked to it for transfers.
• The line of credit that tops the chequing account up on its own.
• The card whose limit went up years ago and never came down.

Doing your own accounts first means you ask your parents to do something you have already done.

Write down where the money is

List places, not balances. Asking for balances makes the afternoon feel like an inspection.

• Every institution. The bank, the credit union, the investment firm, the account somewhere nobody has logged into since 2004.
• Every account at each one, and one line on what it is for.
• What can move money out of it without anyone leaving the house. Transfers, bill payments, the debit card, a pre-authorized withdrawal somebody set up a decade ago and forgot.
• What cannot. Something that has to be sold first, a term deposit with a date on it, an institution with no online banking switched on at all.

Every later step works from the list of places.

Mark what could leave today

Split the list of places in two. Reachable today is anything that could move in one sitting, from a phone or a counter. It answers the step one question, this time for their accounts. Behind a step is anything with something in the way:

• A transfer between institutions that settles overnight.
• An account with no card attached.
• Anything that has to be sold before it is money.

Each later step takes more money out of reachable today, so moving it would need a call, a visit or a wait first. The money stays theirs, and they can still reach all of it; most of it just needs one more step first.

Putting money behind a step does not stop a scam from starting. It decides how much a scam could take if one did.

Lower the daily limits on their accounts

The same afternoon, ask each institution to lower the daily transfer, e‑transfer and card limits. It is a phone call or a few taps.

We think the default limit is far higher than an account that sends a couple of hundred dollars twice a month needs.

• What it does. Caps what one day can cost, whoever is at the keyboard and whatever they have been told.
• What it does not do. Limit what can leave at a branch counter. Cash, drafts and wires there have their own limits, in step eight.

Don’t leave everything behind one login

The same afternoon, look at how the money is split across logins. If all the money is at one institution, one password reaches all of it.

A split we suggest

• The next few months of ordinary spending where it is easy to reach.
• The rest behind a different login, a different institution, or a phone call.
• No account linked to another for instant transfer unless someone knows why. We think unlinking the rest does the most and costs the least.

Give the money accounts a password nothing else uses

Passwords taken when a shop or a forum is broken into get tried on other accounts, the bank’s included, so a password used twice is exposed however strong it is.

Which logins get a password of their own

• The email address the bank sends to. Whoever holds that one can reset most of the others.
• Each bank or investment login, separately.
• The phone or the computer itself, because it can reach every login saved on it.

We would let every other account keep a repeated password, because a rule about three accounts gets followed and a rule about forty does not.

Where the passwords live

• A password manager, if one is already in use and nobody finds it a nuisance.
• A notebook that stays in the house. We think a password written down at home is a smaller risk than the same password used on several websites.
• Not in the email account, and not in a file named passwords.

Then turn on a second check at sign-in wherever the bank offers it: a code by text or from an app, asked for after the password. Someone who has taken the password still needs the code.

Name a trusted contact person on the investment accounts

Call each investment firm, or ask at the next account review, and name a trusted contact person. That is someone the firm may call, with the account holder’s written consent, when something looks wrong to the firm.

• What it does. Gives the firm one call to make before it acts. Naming somebody takes a form.
• What it does not do. It is not power of attorney. That person cannot see a balance, move money or decide anything.

power of attorney a document that lets somebody else act on your money or your property

You sign it in advance, while you can still make the decision, and you choose how wide it is. What it covers and what it is called differ from one province to the next. It does not hand over ownership.

Since 31 December 2021, registered investment firms have had to take reasonable steps to ask each client for a trusted contact person, when they collect or update account information. Saying no does not stop the firm opening or keeping the account.

A firm may also place a temporary hold on a withdrawal or a trade where it reasonably believes a client is being financially exploited or cannot make decisions about money. It can do that whether or not a trusted contact person was named.

a hold the bank stops one payment while somebody asks a question

A bank or an investment firm can pause a single withdrawal, transfer or trade rather than let it go through. The institution places it, not you, and it is temporary. It does not close the account or touch the rest of the money.

To look up the adviser or firm yourself: Check an investment is registered.

Ask the branch for a call-back before large counter withdrawals

Go in together on an ordinary day and ask whether they will put a note on the file. With it, any withdrawal or draft over an amount you agree on gets a call-back first, to a number already on record.

Why the counter

Most of the money lost in these scams leaves in person, by our estimate rather than a measured Canadian figure: cash at a counter, a bank draft, a wire arranged by a teller.

A withdrawal at a counter has witnesses, and none of them has been on the telephone for the last two hours.

• What it does. Puts a person and a pause between the instruction and the money. A pause you agree in advance still works when there is no time to talk it over.
• What it does not do. Bind anybody. The note is a courtesy, not a legal instruction, and staff move on and branches merge. Ask again when the manager changes.

Turn on transaction alerts, and check again once a year

The same afternoon, turn on transaction alerts to their phone, over an amount they pick. Send the alerts to your phone as well only if they want that.

Then put a yearly check in the calendar, about twenty minutes by our estimate. Between checks:

• Limits go back up after a service call.
• Accounts get opened, sometimes linked to everything by default.
• A firm changes platforms and drops what was on the old file.
• A subscription becomes a pre-authorized debit nobody reads any more.

If the afternoon turns into an argument, stop for today

Pick another ordinary day. We think an argument usually means somebody heard a criticism you did not make.

For a version that asks for much less, read Every time I bring up scams with my parents, it turns into a fight. If money has already left, go to I think I have been scammed.