Examples of elder financial exploitation: one member's three weeks

Examples of elder financial exploitation usually describe a single act: a grandson who empties an account, a romance scammer who asks for a wire. In the account it looks different. Exploitation unfolds over days or weeks as a sequence of small changes, each authorised, each in a different system, until the large request comes. FinCEN describes the two main kinds as theft by someone the older person trusts and scams by strangers, and its 2022 advisory lists the behavioural and financial red flags that mark each. This page follows one older member's account over three weeks, day by day, and then sets out the other common patterns. The member is fictional: Eleanor Marsh, 81, of Norrell Federal Credit Union, in the sample case of Botminds' Elder Financial Exploitation Detection, software for fraud and BSA teams that shows who is new around an older customer's money and when they appeared, and leaves every hold and report to a person. The red flags and statistics are FinCEN's, the FBI's and the CFPB's, linked where they appear.

What does elder financial exploitation look like, day by day?

Like a run of ordinary changes that make sense only together. On Saturday 3 October a man the member calls a friend, Curtis Vane, is added as a joint owner of her account at the Westbrook branch, not Halvern, the branch she has visited about twice a month for years. On Monday her phone number of record is changed through the contact centre, so the one-time codes that protect her account now go to a new number. On Tuesday evening at 8:03, online banking is used for the first time in her life, from a new Android phone. On Friday that phone adds a payee, Ridgeline Restoration LLC.

FinCEN's 2022 advisory lists the first of these as a behavioural red flag in its own right: "An older customer's account shows sudden and unusual changes in contact information or new connections to emails, phone numbers, or accounts that may originate overseas." Each change on its own is something customers do every day. None breaks a fraud rule. In the sample case, the agents later scored the combination at 0.91, and the solution's own answer to the question "Why 0.91 and not lower?" is that any one of the signals alone would score under 0.60.

One person's record in Elder Financial Exploitation Detection: when he appeared and what he did

Days 1 to 10: a new person, a new phone, a new way in

The first ten days built access, not losses. A joint owner can transact; a changed phone number captures the one-time codes; a new device on online banking gives remote control; a new payee gives a destination. FinCEN's trend analysis found that perpetrators of both scams and theft "utilize methods of siphoning funds that avoid direct contact with depository institution or MSB personnel." Every step in these ten days avoided a teller.

The step not taken was a look at the account when an owner was added. In the sample, the joint owner was added at a branch the member did not normally use, on a Saturday. A policy that treats a new owner or agent on an older customer's account as a reason to revisit the trusted-contact consent, and to tell the specialist, would have put a person in front of these changes ten days before any money moved.

Days 11 to 14: the money starts to move

On Tuesday 13 October, $2,400 went to the new payee, described later to adult protective services as a "roof deposit". Over the next three days the member bought $3,100 in gift cards, something she had never done. FinCEN lists both kinds of signal: "An older customer purchases large numbers of gift cards or prepaid access cards", and "Uncharacteristic, sudden, abnormally frequent, or significant withdrawals of cash or transfers of assets from an older customer's account." By 22 October her outflows for the month had reached $7,400, against about $2,650 in every month from April to September.

The payments were authorised, in the narrow sense that they came from her account, by her or from a device signed in as her. That is the trap of elder exploitation for a fraud team: the customer, or someone she has let in, moves the money, so each payment looks like her own choice. What catches it is a person noticing that this month is unlike every other month of her life.

Day 20: the request at the window

On Thursday 22 October at 9:47 a.m., the member came to the Halvern branch with Curtis Vane and asked to close her 24-month certificate early: $42,000, with a $604 penalty, by official check payable to him. FinCEN's list of financial red flags includes exactly that: "Closing of CDs or accounts without regard to penalties." The teller, Jamal Whitcombe, saw what no system could.

"The friend answered every question. She was not sure what the money was for."

The teller's report, 9:52 a.m., in the fictional sample case

He pressed Report a concern. Six minutes later the agents had assembled everyone around her money, with the new joint owner, the phone change, the device, the payee and the gift cards in order. At 10:06 the branch manager spoke with her alone: the money was for a roof Curtis was arranging; she had seen no contract; he had told her the price would go up after this week. At 10:24 the specialist reached her niece, her trusted contact since 2023, who had never heard of Curtis and said the roof had been replaced in 2022. At 10:31 a five-business-day delay on the $42,000 was approved by a second person. The adult protective services report was approved at 11:02, and at 11:05 the case went to the BSA team as a confidential SAR referral.

When should a bank step in?

As early as the combination is visible, and at the latest while the customer is still in the branch. In the sample, everything needed to see the pattern existed by 9 October, when the new device added the payee. Whether a bank opens a case at that point is a threshold it sets: in the sample policy, a concern of 0.70 opens a proposed case for a specialist to review, 0.85 pages the specialist at once, and a member at a branch always pages. The agents never hold money or contact anyone on their own.

The CFPB's study of elder SARs explains why earlier matters. The suspicious activity reported in an elder SAR ran on average about four months, and the average loss to an older adult who lost money was $34,200; in 7 percent of SARs with a loss to the older adult, it exceeded $100,000. A pattern caught in its first fortnight is a pattern that never reaches those numbers. How a bank should divide the steps between software and people is in banks' elder fraud prevention.

The second member: the same phone, another account

Exploiters rarely stop at one person. While building the member's circle, the agents found that the phone number put on her account on 5 October had been another member's phone of record since 10 September, and that the same Android device had signed in to both members' online banking. Walter Brisbane, 84, had withdrawn $9,800 in cash in four visits to the Westbrook branch since then, each time with a companion noted by the teller.

A linked case in Elder Financial Exploitation Detection, found through a shared phone and device

FinCEN's advisory warns that "perpetrators of EFE schemes often do not stop after first exploiting their victims", and the same is true across victims. A shared phone or device is one of the few signs that connects them, and only the institution can see it.

What are common elder scams?

Government and bank impersonation, tech-support and refund scams, romance scams, investment scams, grandparent or person-in-need scams, and lottery and sweepstakes scams, in FinCEN's typology; the FBI's 2025 complaints from people 60 and over follow the same lines. When filers named a scam type in FinCEN's year of elder reports, they named tech-support scams and romance scams most often. The FBI's counts of complaints from older people show what reaches them most.

The descriptions in FinCEN's appendix are the ones bank staff should know by heart. A person-in-need scam, also called an emergency or grandparent scam, "is when a criminal will contact a victim pretending to be a family member or loved one in a dire emergency and in need of money." In a bank impersonation scam, the caller tells victims "their accounts are compromised, and they need to move their funds to a secure account". Tech-support scams start with a pop-up and end with remote access to the victim's computer and, through it, their finances.

Other examples from the same morning

The member's case was one of nine alerts waiting for the specialist that Thursday. Three others show how different the same problem can look, all on fictional sample data:

• A first wire. Harold Ng, 77, sent his first wire ever, $18,500 to an investment platform he had found through a text message, at 6:40 a.m.; the payments hub held it for an hour, and the proposed next step was a conversation with him that day.
• A son with a power of attorney. Margaret Oyelaran-Pratt, 88: her son, her agent, wrote four cheques to himself in October totalling $6,000, against about $300 a month before.
• A refund call. Dorothy Kessler, 72, called about a "refund" after letting a caller onto her computer; $4,900 left by ACH for an external account added the day before.

Nine overnight alerts, each with the member's circle and a proposed step

Real cases follow the same shapes at larger scale. FinCEN's 2022 advisory describes a scheme run from a call centre in Ahmedabad, India, that used robocalls and officers impersonating the FBI, the DEA and the Social Security Administration to frighten victims, many of them elderly, into shipping cash and wiring money; its operator was sentenced to 22 years in prison for defrauding thousands of victims of more than $10 million. It also describes a housekeeping business in Charlotte, North Carolina, whose owner and accomplices isolated a widow with dementia, fabricated a power of attorney and took her money until it was gone; the owner was sentenced to 97 months. Theft by people close to the victim is covered in elder financial abuse by family members.

How does an elder scam unfold?

Contact under a false identity, then trust or fear, then pressure, then a payment method that is hard to reverse. FinCEN's advisory describes the sequence. Scammers reach older adults by phone, text, email, post, dating sites or social media, impersonating officials, support staff, relatives or new friends. "Perpetrators often create high-pressure situations by appealing to their victims' emotions and taking advantage of their trust or by instilling fear to solicit payments and PII." They ask for wires and, increasingly, "prepaid access cards, gift cards, money orders, tracked delivery of cash", ATM deposits, cash pick-ups and cryptocurrency.

Then they come back. Victims "are often re-victimized", sometimes by the same people and sometimes by others who buy their details, and the FBI's 2025 figures include 2,529 recovery-scam complaints from people 60 and over, in which someone offers to get the lost money back for a fee. The sample member's three weeks fit the pattern at every step: a new friend met in August, access built quietly, small payments, urgency ("the price goes up after this week"), and a large payment that would have been almost impossible to recover once the check was cashed. The full case, screen by screen, is on the Elder Financial Exploitation Detection page; what the SAR file for it must show is in the elder exploitation SAR guide.

Questions people ask

What is an example of elder theft by a caregiver?

FinCEN's 2022 advisory describes housekeepers in North Carolina who isolated an elderly widow with dementia from her friends and family, fabricated a power of attorney, moved her between homes and took her money; the ringleader was sentenced to 97 months in prison. In FinCEN's 2024 review, professional caregivers were the most often named perpetrators of elder theft after adult children.

What is a grandparent scam?

A call or message from someone pretending to be a grandchild or other relative, or a lawyer or police officer acting for them, claiming an emergency such as an arrest or accident and asking for money at once. FinCEN calls it a person-in-need or emergency scam and notes it has become more sophisticated with artificial intelligence.

What are the warning signs of elder financial abuse in a bank account?

New people on the account, changed contact details, first-ever online banking or wires, new payees, gift card purchases, certificates closed despite penalties, and withdrawals unlike the customer's own history. At the counter, signs include a companion who answers for the customer or someone directing them by phone.

Do elder scams usually happen in one payment or several?

Often several, over weeks or months. In the CFPB's study of elder SARs, the suspicious activity lasted about four months on average; in nearly 30 percent of SARs it spanned 10 days or fewer and in 27 percent 100 days or more.

What should I do if I see these signs in a parent's account?

Tell the bank, report to adult protective services in their state, and if money has been taken, to the police; the Justice Department's National Elder Fraud Hotline, 833-372-8311, can help you report. If your parent agrees, ask the bank to record you, or someone else they trust, as a trusted contact.