My father-in-law keeps getting targeted, and I live an ocean away

Most people I know have had the same phone call. A parent mentions, a little too casually, the thing with the card, or the email from the bank, or the nice man who rang about the computer. By the time you hear about it the money is gone. If that has already happened in your family, the one useful thing left to do is report it.

Our parents are online and are being worked professionally, and their children, who mostly know exactly what to do, are on the other end of a phone describing where the Start button is.

My father-in-law is in that position. He mentioned he wanted to replace his six-year-old computer, and that was the opening: a new machine can be set up properly on day one, which an old one never can.

This is what I built, what it cost, and what it does not fix.

The two pieces that make it work

The first is Tailscale. It puts his computer and mine on the same private network without opening a single port on his router. No port forwarding, no fixed IP address, nothing sitting on the public internet waiting to be scanned. His machine carries an ACL tag that makes the trust one-way: I can reach his PC, his PC can reach nothing of mine. That matters more than it sounds. If his machine is ever taken over, it is not a route into my house.

The second is Claude Code. Once there is a network path and an SSH key, I point it at his machine and ask questions in plain language. It writes the small PowerShell scripts, runs them over that connection, reads the results back and tells me what it found. I am not typing commands at a computer I have never sat in front of. I am asking a question and getting an answer.

Start with something that changes nothing. This is the first thing I ran:

Connect to this Windows PC over SSH and give me a plain-language health report:
Windows Update status, which antivirus is actually active, whether the clock is
synced, how much disk space is left, and any device showing a driver error.
Change nothing. Tell me what you would fix and why, but do not fix it yet.

What this actually buys you

He told me the new webcam was not being recognised. Normally that is twenty minutes on the phone about which cable is in which socket, both of you getting quietly frustrated, and no way to tell a driver problem from an unplugged cable.

Instead I asked whether the machine had ever seen a Logitech device at all. Windows keeps a permanent record of every USB device ever attached, keyed by manufacturer, so that question has a factual answer rather than an opinion. It came back in seconds: never, not once. It was not plugged in. He plugged it in and it worked first time.

Has this PC ever had a Logitech USB device attached to it? Check the Windows USB
enumeration history by vendor ID, not just what is connected right now. Tell me
which vendors it has seen, so I know whether this is a cable problem or a driver
problem before I ask him to crawl under the desk.

The same week it found that his clock was a full day wrong, because a background time service had quietly stopped and nothing had ever noticed. And that his browser was holding 217 saved logins. That number sounds worse than it was: most were dormant accounts on sites he had not opened in years. The ones that mattered we had already moved into a password manager, which took him several sittings across several days.

The part that makes remote help sustainable is duller. Updates have to install themselves, and they must never restart his machine while he is mid-sentence on a video call with his grandchildren. One reboot at the wrong moment and he stops trusting the whole arrangement.

Set up Windows Update on this PC to download and install everything automatically,
including driver and firmware updates, but never restart the machine on its own.
Run it as a scheduled task under SYSTEM and write what it did to a log file I can
read later over SSH.

Once that is running, the recurring job is a monthly read. This is the whole maintenance routine:

Monthly check on this PC. Compare against last month: pending updates, antivirus
definition age, free disk space, failed scheduled tasks, new programs installed,
new browser extensions, and any new account created on the machine. Flag anything
that looks like it was installed by someone talking him through it on the phone.
One short paragraph first, then the details.

That last instruction is the one that earns its keep. Remote-access scams end with software the victim installed themselves, so a list of what is new is worth more than any scanner.

What I deliberately did not build

I cannot see his screen. I am not reading his mail or his documents, nothing runs a report on him behind his back, and there is no camera and no keylogger. He knows the arrangement exists, and on the rare occasion I need to see his screen I ask first and he approves it on his end.

That led to the standing rule we agreed: he never grants screen access to anyone except me or another family member, no matter who they say they are. Setting that rule was the moment I understood the real exposure. Screen sharing is one click, it sounds helpful, and a patient caller only needs to catch him tired or distracted once.

I have administrator access to a machine that holds his banking logins. That is a real concentration of trust. It works only because he asked for it, knows exactly what it covers, and can end it by uninstalling one program.

The part this does not fix

None of this stops a phone call. Everything above hardens the machine, and the attack that actually works never goes near the machine. It has a name, social engineering, and it goes at the person instead: patiently, using urgency and authority, and it works on people far younger and more suspicious than him.

The things that help are procedural rather than technical:

• No money moves on the same call. Anything urgent gets hung up on and called back on a number from a bank statement, never a number the caller supplies.
• A second person, always. Any payment to a new recipient gets mentioned to one family member first. The delay is the control, not the opinion.
• A credit freeze, which is free, and which blocks the accounts-opened-in-your-name version of this outright.
• A password manager, because a phishing page that looks perfect still fails when the manager refuses to autofill a domain it does not recognise.

Only the last of those is a technical control, and it is the only technical defence on the list. I do not have a better answer yet.

What it cost

A few hours spread over three days, most of it reading rather than typing. He did the physical work, which was the right split: he plugged things in, restarted the machine and read error messages out to me. That kept it his computer, rather than one I had quietly installed myself in.

If you are the person your family calls, the setup is no longer the hard part.

The stack

Everything used here, what each piece is for, and what it costs.