Three things worth telling your mum and dad.

This page isn't about Tell Me. There's nothing to buy on it.

It's here because I spend my evenings thinking about the questions we ask people's parents, and somewhere along the way I noticed something that's worth passing on whether you ever use my app or not.

If you read one thing, make it the first one.

1. The answers to their security questions are in their life story

Have a look at the questions a bank or a utility company uses to check somebody is who they say they are.

Mother's maiden name. First pet. First school. The street you grew up on. First car.

Now think about how easily a friendly stranger could get all five out of your mum in a ten-minute phone call, without her ever feeling like she'd told anyone anything. She'd just think she'd had a nice chat.

That's the problem with security questions. They're not secrets. They're the most tellable things about a person's whole life — the bits they'd happily share with anyone who asked.

What to do about it: the answers don't have to be true.

Your mum's first pet can be "Tuesday". Her first school can be "Rhubarb". Nobody is checking. A made-up answer is enormously safer than a real one, because it isn't sitting in her memory waiting to be charmed out of her, and it isn't in an old newspaper or on a family tree website either.

She'll need to write them down somewhere sensible — a notebook in a drawer is genuinely fine, far better than using her real life as her password.

It takes twenty minutes on a Sunday afternoon. It's probably the single most useful thing on this page.

2. The call that already knows something about them is the dangerous one

We're all told to watch out for the caller who knows nothing. In practice, it's the opposite.

The convincing ones open with something true. Your address. Where you bank. Your daughter's name. The name of the street you grew up on. And the moment somebody knows one real thing about you, your guard drops — because surely a stranger wouldn't know that.

They would. Quite a lot of it is findable, and the rest can be pieced together.

The rule that covers nearly everything: nobody legitimate will ever mind you hanging up and calling them back on a number you've looked up yourself.

Not your bank. Not the council. Not the police. Not your energy supplier. If someone objects to that, or tells you there isn't time, or says they'll stay on the line — that on its own is the answer.

If it's about money or a bank, there's a number for exactly this. Hang up and dial 159. It connects straight through to your own bank's fraud team, it works like 101 or 111, and 159 will never call you — so anybody claiming to be from 159 isn't. (159 is a UK number — if you're somewhere else, there's a section for you near the end of this page. The hanging up works everywhere.)

If you can, call back from a different phone. And if you can't, wait a few minutes first.

3. More is already public than they'd guess

Not to alarm anybody, but it's worth a look.

Old local newspaper archives. Family tree and genealogy sites, where somebody in the extended family has often uploaded the lot. Facebook profiles set to public. Funeral notices, which routinely list maiden names, home towns and the names of every child and grandchild.

Half an hour spent tightening the privacy settings on a Facebook account, and a quiet word about not posting the "your first pet plus the street you grew up on equals your superhero name" quizzes, is time well spent.

Those quizzes are, quite literally, security questions with a joke on top.

The people who actually do this for a living

I build a storytelling app. These organisations do fraud prevention properly, they're free, and they're far better at it than I am. They're the UK's, because that's where I live — if you're elsewhere, yours are a little further down.

Take Five to Stop Fraud — the national campaign, run by UK Finance. Clear, short, no jargon.

Friends Against Scams — free online training, about twenty minutes, designed to be done by anybody. Good to do alongside a parent.

Age UK — Avoiding Scams guide — a proper printable booklet, written for older readers. This is the one to put in the post.

Stop Scams UK — the 159 service — how it works and which banks are signed up.

If something's already happened

Contact the bank straight away — or dial 159 and it'll put you through.

Report it. In Scotland, fraud goes to Police Scotland on 101. In England, Wales and Northern Ireland it goes to Report Fraud at reportfraud.police.uk or 0300 123 2040. That difference catches people out constantly.

Scam texts can be forwarded free to 7726 — that one, as it happens, works in the US and Canada too.

And tell them it isn't their fault. This is the bit people skip. The shame is what stops older people reporting it, and the silence is exactly what the people doing it are relying on. It's an industry, staffed by professionals, and getting caught by it says nothing about anybody.

If you're not in the UK

Everything above about made-up answers, hanging up, and it not being their fault is true in every country. The phone numbers and organisations are British because I am. The equivalents I'd trust:

United States — scams are reported to the FTC at reportfraud.ftc.gov, and the AARP Fraud Watch Network runs a free helpline on 877-908-3360, staffed by trained fraud specialists — built for exactly the conversation this page is about.

Canada — the Canadian Anti-Fraud Centre, run by the RCMP, on 1-888-495-8501.

Australia — Scamwatch, run by the National Anti-Scam Centre.

Everywhere else — most countries have a national fraud reporting service; it's worth two minutes today to find out what yours is called, and to write it down next to the phone before anyone needs it. Wherever you live, the shape is always the same: the bank first, then the report — and no shame at any point.

If you're wondering what any of this has to do with a storytelling app, the honest answer is on Looking after your stories.