I've convinced many of my loved ones to get two-factor authentication on at least their primary e-mail addresses and to treat everything as something that can b

I've convinced many of my loved ones to get two-factor authentication on at least their primary e-mail addresses and to treat everything as something that can be compromised e.g. don't make any of your bank accounts front facing that have any more money in them then you are willing to lose. Obviously this doesn't protect them against the complete set of problems but it is quick to implement and keeps me from being the personal security manager of those I care about. At the end of the day if someone is running a sophisticated phishing scam some savvy people are going to fall for it - I think the name of the game is damage mitigation not prevention. As long as you can mitigate people from losing a life changing amount of money I think you've won here.