← All scam guides

KA-POW! "Update your account": real or scam?

Sometimes it's real, and that's what makes it tricky. The safe move is the same either way: never update anything from a link in a surprise message, and never read a code you were texted to someone who contacted you. Go to the app or website yourself.

What it looks like

Invented examples.

Your email storage is full. Update your account within 48 hours to keep receiving mail: mailbox-upgrade.example

💬 "Hi, this is support. We just sent you a 6-digit verification code. Please read it back to confirm you're the account owner."

Your password expires today. Keep your current password here: keep-my-password.example

💬 (a code you didn't ask for) "Your sign-in code is 482913. Don't share this code with anyone."

Red flags

• Anyone asking for a code that was texted to you. The code is the key to the account.
• A sign-in code you didn't ask for. Someone may be trying your password. Don't share it, and change the password from the real app.
• "Keep your password" or "verify your account" links.
• A deadline like 24 or 48 hours.

What to tell your parent

A lot of capable people keep a password notebook. They aren't careless; they're organized in a world that keeps moving the furniture.

"Keep the notebook. It's fine at home. Just two rules: never read a code to anyone who called or texted you, and never 'update' from a link. If something says update, open the app yourself or call me and we'll do it together."

Moral of the story: real updates happen in the app, not in a text.

Checklist: do this now

• Never read a texted code to anyone.
• Don't "update" or "verify" from a link.
• Open the app or site yourself.
• Stuck? Call family, then do it together.

If you don't know, now you KNOW... ⭐🌈

Practical ways to help (no tech degree needed)

• Keep the notebook somewhere sensible at home, not in a wallet. Or switch together to a password manager if they want one.
• Turn on two-factor authentication for email and banking. That's FTC advice after any password leak (FTC, 2026).
• Write down the real phone numbers for their bank and email provider, from statements or cards.
• Schedule a "tech hour" once a month, so updates pile up for you instead of for a stranger.

If they already shared a password or code

1. Change the password right away, and anywhere it's reused (FTC, 2026: https://consumer.ftc.gov/articles/what-do-if-you-were-scammed).
2. Turn on two-factor authentication (FTC, 2026).
3. Bank or card involved? Call the number on the card.
4. Gave computer access? Update the security software and run a scan (FTC, 2026).
5. Report it at ReportFraud.ftc.gov and ic3.gov. Forward scam texts to 7726.

The numbers

• Phishing and spoofing, the "click here to verify" family of scams, was the most-reported crime type among people 60+ who complained to the FBI in 2025: 48,064 complaints (FBI IC3, 2025 Internet Crime Report: https://www.ic3.gov/annualreport/reports/2025_ic3report.pdf).
• In 2025, many of the texts behind older adults' text-scam loss reports looked like account security alerts from well-known businesses (FTC, Protecting Older Consumers, 2026: https://www.ftc.gov/system/files/ftc_gov/pdf/2026-older-adults-report-10192026.pdf).

FAQ

Is a password notebook a bad idea? At home, kept somewhere sensible, it can be a reasonable choice for many people. The bigger risks are reading codes to strangers and "updating" from links.

I got a code I didn't ask for. What now? Don't share it. Open the app yourself, change the password, and turn on two-factor.

How do I know if an "update" is real? Ignore the message and open the app or website yourself. If an update is needed, it'll be waiting there.

Felt a Twinge? Text before you tap.

Twinge is a scam second opinion we're building. Forward the "update" message and get a plain answer. Twinge will never ask for your passwords, codes or money, ever. It's in a small free pilot, and forwarding isn't live yet. Join the waitlist at asktwinge.com.