My mom called me last month, a little embarrassed: "Is this real?"

It was a text saying her bank account would be locked in 24 hours - right logo, her name, a link one letter off from the real domain. She almost tapped it.

She's not careless. Phishing has gotten genuinely good, and it hits the people we love the most - parents, grandparents, anyone who isn't online all day. The old advice ("just look for typos") doesn't work anymore.