Passwords & Passkeys

Before You Change a Parent’s Passwords, Secure Their Email First

Updated May 18, 2026. Plain-English technology education for families.

If you are helping a parent or older relative with passwords, do not start by changing every password you can find. Start with email.

Email is usually the account that resets everything else: banking, pharmacy, insurance, shopping, phone provider, Apple ID, Google account, and medical portals. If the email account is weak, unknown, or already compromised, changing other passwords can create a false sense of safety.

Why email comes first

Most websites let someone reset a password by sending a link to email. That makes email the reset key for a parent’s digital life. A scammer who controls email may be able to reset passwords, hide alerts, read verification codes, and keep watching new messages even after one password is changed.

This does not mean the family should panic. It means the first job is smaller and clearer: make the email account stable before touching everything else.

Step 1: Find the email account that matters most

Many families discover that a parent has more than one email address. One may be used for banking, another for shopping, and another for old social accounts.

Start by identifying the email tied to these accounts:

• Banking and credit cards
• Phone provider
• Pharmacy
• Insurance or Medicare-related portals
• Apple ID, Google account, or Microsoft account
• Main shopping account
• Medical portal

If there are several email accounts, protect the one used for banking, phone, and recovery first.

Step 2: Check whether the password is reused

Ask calmly. The goal is not to embarrass anyone. A useful script is: “A lot of people reused passwords because every site kept asking for a new one. Let’s just check whether this email password is used anywhere else.”

If the email password is reused on shopping, social media, or another old site, change the email password first and store the new one in the family’s chosen password system.

Step 3: Confirm the recovery phone and recovery email

Before turning on new security settings, make sure the account recovery information still works. Look for old landlines, old work emails, unknown recovery addresses, or phone numbers the parent no longer controls.

Write down the recovery plan in a safe family note. The note should say which phone receives codes, which backup email is used, and who the trusted helper is. It does not need to expose the password in plain view.

Step 4: Turn on two-step verification carefully

Two-step verification can protect the account even if a password is stolen. But for older adults, the setup matters. Use a method the parent can actually manage on an ordinary day.

Good options may include:

• A trusted phone prompt when the parent uses that phone regularly
• A text code if that is the most realistic option
• An authenticator app only if someone can help maintain it
• Backup codes stored safely, not in email or text messages

If the parent often loses phones or struggles with unlock codes, slow down. Add recovery options before making sign-in harder.

Step 5: Review signed-in devices

Most email providers show devices that are signed in. Review the list together. Sign out old phones, unused tablets, public computers, and anything the family does not recognize.

This step is especially important if the parent had a previous scam scare, clicked a suspicious link, or had a password reused on another site.

Step 6: Check forwarding rules and filters

This is the step many families miss. In some account takeovers, a scammer adds a forwarding rule so copies of new emails keep going somewhere else. They may also create filters that hide bank alerts, password reset messages, or security warnings.

Look in email settings for forwarding, filters, rules, blocked addresses, delegated access, and connected apps. Remove anything unfamiliar. If you are not sure, take a screenshot and ask a trusted technical helper before deleting.

Step 7: Protect the phone provider account

The phone number often receives recovery codes. That makes the phone provider account part of the email safety plan. Make sure the phone account has its own strong password and recovery information.

If the provider offers an account PIN or port-out protection, consider turning it on. This helps reduce the risk of someone moving the number to another phone without permission.

Step 8: Create a family recovery note

The family recovery note should be simple enough to use during a stressful moment. Include:

• Main email address
• Trusted helper
• Recovery phone
• Recovery email
• Where backup codes are stored
• Where password manager emergency instructions are stored
• What to do if the phone is lost

Keep this note somewhere safe and agreed upon. Do not send the master password through text or email.

What not to do

• Do not take over a parent’s account without permission unless there is a true emergency and legal authority to act.
• Do not change every password in one sitting.
• Do not rely only on Face ID, fingerprint unlock, or passkeys without a recovery plan.
• Do not store passwords in text messages.
• Do not click password reset links that arrived unexpectedly. Go to the real website or app yourself.

Email-first checklist

1. Identify the main email used for banking, phone, pharmacy, insurance, and medical portals.
2. Check whether the email password is reused.
3. Change the email password if needed and store it safely.
4. Confirm recovery phone and recovery email.
5. Turn on two-step verification carefully.
6. Review signed-in devices.
7. Check forwarding rules, filters, and connected apps.
8. Secure the phone provider account.
9. Create a family recovery note.

Bottom line

The safest first move is usually not a new app or a long afternoon of password changes. It is protecting the email account that unlocks everything else. Once email is stable, the rest of the family password plan becomes calmer and safer.

FAQ

Should I change my parent’s email password first?

Change it first if the password is weak, reused, unknown, or possibly exposed. Before changing it, confirm recovery phone and recovery email so the family does not get locked out.

What if my parent has several email accounts?

Start with the email used for banking, phone provider, pharmacy, insurance, Apple, Google, or medical portals. That account usually creates the most risk if someone else gets access.

Should adult children know a parent’s email password?

That depends on the parent’s wishes, capacity, and family situation. A better default is a clear recovery plan, a trusted helper, and emergency instructions stored safely.