For twenty years, families taught each other one reliable defense against scam messages: look closely. The misspelled bank name. The odd phrasing. The greeting that says “Dear Customer” because the sender has no idea who you are. If something felt off, it probably was, and knowing how to spot phishing was a skill worth teaching at the kitchen table.
That skill has quietly stopped working. Not because families got careless, but because the messages got better.
Can you still tell if an email is phishing?
Not reliably. Modern scam messages arrive correctly spelled, addressed to you by name, and can reference your actual bank, your recent activity, even the people in your life. The old tells are gone. Real protection now comes from credentials that cannot be phished and a family habit of verifying unusual requests.
What changed
Deception has been automated, and it has been personalized. A convincing message can now be produced cheaply, at scale, and tailored to the person receiving it. So can a convincing voice on the phone, and a patient, helpful “support agent” who keeps a conversation going as long as it takes. And the new browser assistants that offer to act for you belong in the same picture: eager, capable, and with no street smarts of their own. The details that make these approaches feel legitimate are not hard to come by: they are assembled from the personal information already circulating in data-broker files and old breaches.
There is a second change, just as important. Attackers increasingly do not bother guessing passwords at all. They work the recovery path instead: password reset flows, help desks, the phone number your accounts fall back on, and whoever answers when they call. The weak point is not the lock. It is the process for replacing a lost key, and the person operating it.
Squinting harder at your inbox does not help with any of this, because the things squinting used to catch are exactly the things that got fixed.
Two terms for new readers. The FIRM System (FIRM stands for Family Information Resource Management) is the organizational system at the heart of The Recoverable Family, and its job is making sure the right person can reach the right thing at the right time. The SAFE Framework organizes that work into four Areas of Focus: System, At-Home, Financial, and Estate. What follows is System work, home of the Passwords and Passkeys Module.
Structure beats scrutiny
The honest answer is not sharper vigilance. It is building things so that vigilance is not load-bearing. Two moves do most of the work.
Credentials with no secret to tell. A passkey, or a hardware security key, is not a password you type. It works by possession and cryptography: the key lives on your device, and it only works on the genuine site it was created for. There is nothing to type into a convincing fake, nothing to read to a caller, and no secret that a well-crafted message can talk out of you. A scam page asking for your passkey simply has nothing to collect. This is why the FIRM System points families toward passkeys as accounts offer them. When Jessica moved her primary accounts to passkeys, the change she noticed was not effort. It was that a whole category of decision, is this message real, stopped being her problem.
A verification habit decided in advance. Passkeys protect the credential. The habit protects everything else. The rule is simple enough for a family to actually keep: any unusual request involving money, codes, or access, even one that sounds exactly like your son, gets confirmed through a channel you already trust. You call back on the number your family already has written down, or you use the check your family agreed on ahead of time. No one has to make a judgment call under pressure, because the judgment was made in advance, calmly, together.
Notice what neither move requires: being suspicious of everyone, or being good at spotting fakes. The first removes the secret. The second removes the pressure.
The first step
Open your browser’s saved-passwords list and simply count what is in there. Most people find dozens of entries they had forgotten, each one a secret that can, in principle, be told to the wrong party. Then take one concrete step: turn on a passkey for your primary email account, the account that can reset nearly everything else, and record where its recovery lives in your password manager.
That is the whole assignment. One count, one passkey, one note.
Where this lives in the system
In the FIRM System, this is the territory of the Passwords and Passkeys Module. Your password manager is the key ring for the household’s digital life; the Vault holds the master credential that guards it; and the Family Guide tells the people you trust where the keys live without revealing a single one of them. The verification habit belongs there too, written down where everyone can find it, so the callback number is never in question.
The comfort in all of this is real: the durable fix asks less of your family than the old advice did. Nobody has to out-read a professionally built fake at the kitchen table. You set up the structure once, you write down the habit, and your family stops being the security system — the structure is.
If you want to know where your family actually stands, the Recoverability Assessment takes about ten minutes and tells you plainly.