The Family Fraud Fire Drill: What Everyone Should Decide Before the Scam Call Comes

A family fraud fire drill is a 20-minute conversation that decides what everyone will do before a scammer creates panic. The goal is simple: no money, login reset, remote access, or account change happens from the first call, first text, or first email. Pause, hang up, and verify through a known path.

That one rule is more useful than another lecture about being careful.

The FTC's guidance on emergency scams says scammers create urgency and pressure people to send money quickly. Its broader scam guidance gives the same practical answer in plain language: slow down, check it out, and do not let pressure make the decision for you.

Sources: FTC: Scammers Use Fake Emergencies To Steal Your Money, FTC: How To Avoid a Scam

This is the family version of incident response. It is not technical. It is a decision process for the moment when emotion is high and judgment is under pressure.

Why families need a drill, not another warning

Most scam advice assumes the victim will recognize the scam while the scam is happening.

That is a bad assumption.

Scammers do not win because their story is perfect. They win because they create urgency, authority, secrecy, or embarrassment. A fake bank alert, a "grandchild in trouble" call, a tech-support popup, or a romance scam all push the same emotional buttons:

• Act now
• Do not tell anyone
• Move money
• Fix the account
• Prove you care
• Avoid embarrassment

The fraud fire drill moves the decision out of that moment. The family decides the rule while calm, then follows it when pressure hits.

If the concern is specifically an aging parent, the live guide on protecting aging parents from online scams is the foundation. This article gives the drill itself.

The 20-minute family fraud fire drill

Set a timer. Keep it practical. Do not turn this into a family security seminar.

Minute 1-3: Name the risky moments

Ask: "Which situations would make us panic?"

Common answers:

• Someone says a child or grandchild is in trouble
• The bank says money must be moved to protect it
• Microsoft or Apple says the device is infected
• A text says an account will be locked
• Someone asks for a gift card, wire, crypto, payment app, or urgent transfer
• A loved one appears to call from a strange number

The point is not to predict every scam. The point is to name the moments where the family is most likely to act too fast.

Minute 4-7: Pick the callback rule

Write this down:

We do not act from the first contact. We hang up or stop replying, then call back through a number we already know.

That means:

• Not the number in the text
• Not the number in the popup
• Not the number the caller gives you
• Not a link in the email

Use a saved contact, bank card number, official app opened directly, or a number already written down before the event.

Minute 8-10: Pick the second-check person

Every person should know who they call before moving money or granting access.

For an older parent, that may be:

• Adult child
• Sibling
• Spouse
• Trusted neighbor
• Financial advisor
• Caregiver

The second-check person does not need to be technical. They need to slow the moment down.

Minute 11-13: Create the safe phrase

A safe phrase is useful for family-emergency and voice-cloning scams.

Make it:

• Easy to remember
• Not public
• Not a pet name or birthday
• Not something visible on social media
• Changeable if it is ever exposed

Example format:

"What did we name the old blue suitcase?"

Do not rely only on the phrase. A strong plan also requires the callback rule and second-check person.

The FTC warns that emergency scammers may impersonate loved ones and pressure people to send money quickly. AI voice cloning makes the "it sounded like them" test weaker than it used to be.

Source: FTC: Scammers Use Fake Emergencies To Steal Your Money

Minute 14-16: Decide the no-go payment methods

Agree that nobody in the family sends emergency money through:

• Gift cards
• Cryptocurrency
• Wire transfer
• Payment apps
• Cash pickup
• Courier pickup

There may be legitimate reasons to use some of those tools in ordinary life. They are not acceptable under urgent pressure from a caller, texter, popup, or email.

FTC scam guidance repeatedly warns that scammers prefer payment methods that are hard to reverse.

Source: FTC: How To Avoid a Scam

Minute 17-20: Practice the script

Give everyone one sentence:

"I do not handle urgent requests on the first call. I am hanging up and calling back through a number I already know."

That sentence matters. Under pressure, people need words, not theory.

Practice it once. It will feel awkward for 10 seconds. That is fine. The first real use will feel less awkward because the family has already said it out loud.

The four household rules

Put these somewhere visible or easy to find:

1. No urgent money request gets handled on the first call.
2. No remote access from a popup, text, or unsolicited call.
3. No account reset from a link in an email or text.
4. No secrecy. If someone says not to tell family, we tell family first.

These four rules cover most of the dangerous moments without requiring anyone to memorize every scam type.

What to do after a near miss

If someone almost fell for a scam, do not turn the conversation into a trial.

Ask:

• What did they say?
• What did they ask you to do?
• Did you click anything?
• Did you share any codes?
• Did you share remote access?
• Did money move?

Then thank the person for saying something.

That part is not soft. It is operational. If people expect shame, they report late. If they expect help, they report early.

For a remote-access cleanup path, see what to do if your parent let a scammer remote into their computer.

Who should be in the plan

Include anyone who can either receive pressure or help slow it down:

• Aging parents
• Adult children
• Spouses
• Caregivers
• Household members with shared accounts
• Anyone helping with bills or devices

If someone helps with finances, they need the rule. If someone answers the phone for an older relative, they need the rule. If someone has access to the recovery email or bank account, they need the rule.

How often to review it

Review the plan twice a year and any time something changes:

• New phone
• New bank
• New caregiver
• New address
• New password manager
• Death or illness in the family
• Travel
• A near-miss scam
• A new person helping with finances

This is a small habit, not a one-time setup.

CISA's Secure Our World guidance focuses on simple behaviors like strong passwords, MFA, phishing recognition, and software updates. The family fraud drill is the behavior layer around those controls.

Source: CISA: Secure Yourself and Your Family

Where Obsidian Ridge fits

Obsidian Ridge helps families turn this kind of plan into actual setup: secure the recovery email, turn on MFA, clean up devices, simplify passwords, and create a calm process for suspicious calls and messages.

If the family needs hands-on help, start with the individuals and families page. If the worry is a business owner or practice owner, Talk with us instead.

The first win is not perfection. The first win is a household that pauses before money or access moves.

FAQ

What is a family fraud fire drill?

It is a short conversation where the family decides how to handle urgent money requests, account alerts, remote-access requests, and suspicious calls before a scammer creates panic.

Is a safe word enough?

No. A safe word helps, but it should be paired with a callback rule, second-check person, and no-rushed-payment policy.

What is the best scam-call rule?

No money, login reset, remote access, or account change happens from the first call, first text, or first email. Pause and verify through a known path.

What if my parent resists the conversation?

Frame it as a family rule for everyone, not supervision of one person. The goal is to make pressure easier to handle, not to take away independence.

What should we do if someone already clicked or paid?

Move into cleanup immediately: secure email, change passwords from a clean device, contact the bank or payment provider, report the fraud, and preserve messages or transaction records.

Sources and references

• FTC: Scammers Use Fake Emergencies To Steal Your Money
• FTC: How To Avoid a Scam
• CISA: Secure Yourself and Your Family
• FBI IC3 Annual Reports