Cyber Hygiene for Seniors

Mansfeld-Südharz, Germany - November 27, 2025

Silver surfers wanted: how a Saxony-Anhalt county is teaching grandparents to out-phish the phishers without sounding like grandchildren

The first thing you notice when you walk into the Kornhaus auditorium on Karl-Liebknecht-Straße is the absence of keyboards. Instead, the long oak tables are covered with bakeware: muffin tins, silicone spatulas, a tiny flour dredger shaped like a hedgehog. Today’s lesson is not about baking—it is about passwords—but the instructor, sixty-eight-year-old Inge Hoffmann, begins by cracking two real eggs into a glass bowl. “If your password is your birthday,” she says, whisking the yolks until they ribbon, “that is like using raw egg in a mousse—one spoon of salmonella and the whole dessert collapses.” Half the room nods; they have lived through that particular food poisoning. The metaphor sticks, and no one has yet touched a mouse.

The workshop is called “Cyber-Hygiene für Senioren,” but the county advertising avoids both words. Flyers simply read: “Wednesday Morning: How to Keep the Scammers Away from Your Savings—and Your Photos of the Grandchildren.” It is the third cohort since September, and the waiting list now stretches to Bernburg. What makes the course unusual is not the curriculum—password managers, two-factor authentication, SIM-swap warnings—but the pedagogy: every technical concept is translated into a household ritual the participants have already mastered. Updating software becomes “changing the oil filter,” backing up photos is “putting summer clothes in the attic,” and multi-factor authentication is “the double lock on the garden gate.” The result is that seniors leave with muscle memory rather than checklists; they do not remember the steps, they remember the feeling of having done something ordinary.

Inge Hoffmann is not a professional trainer. She is a retired laboratory chemist who once calibrated pH meters for the old Buna factories. When the Cyber Resilience Alliance surveyed pension clubs last spring, they discovered that seniors trusted peers forty percent more than external experts, so the Alliance created a “train-the-trainer” stipend: 1 200 € for any county resident over sixty-five who could demonstrate five years of internet banking and pass a basic security screening. Hoffmann finished top of her class of twenty-two candidates, all locals, all volunteers. The training itself lasted six evenings inside the very same SOC that monitors the county’s schools at night. She learned to recognise phishing URLs by their suffixes, but she also learned how to speak slowly without sounding condescending—an art she practises by reading crime novels aloud to her husband who is hard of hearing. “If I can keep a detective plot clear, I can keep two-factor authentication clear,” she says.

The sessions are deliberately tactile. Participants bring their own devices, but they also bring analogue proxies: a padlock, a recipe card, a theatre ticket. When Hoffmann explains why public Wi-Fi is risky, she places an unplugged toaster on the table and passes around a slice of bread. “Anyone can drop in a slice,” she says, “but you have no idea whose crumbs are already inside.” The room laughs, and the next week half of them have disabled auto-join on their phones without being told. The same principle governs password creation. Instead of dictating complexity rules, Hoffmann hands out blank postcards and asks each person to write down the smell of their first kitchen after marriage: “fresh bread and coal smoke,” “onion and copper pans,” “coffee spilled on a wood stove.” Those sensory phrases become passphrases—long, memorable, emotionally charged and impossible to guess by dictionary attack. One participant, an eighty-one-year-old former tram driver, now unlocks his banking app with the sentence “Wolfgang pretending the rails were singing,” a memory no amount of social engineering can extract.

"If I can keep a detective plot clear, I can keep two-factor authentication clear."

Scam rehearsal is the most delicate module. Seniors are asked to role-play the attacker. In pairs, one person reads a prepared script—an “Amazon refund” call, a “grandchild in jail” plea—while the other must respond without giving any personal data. The rule is that the victim may only ask questions that begin with “how” or “why.” This flips the power dynamic and forces the scammer to reveal inconsistencies. After three rounds, the room sounds like a theatre of sceptical grandparents: “How did you get this number if my grandson never saved it?” “Why would the police ask for iTunes cards?” The exercise is filmed (with consent) and the footage is edited into ninety-second clips that are later aired on the county’s community television channel, turning graduates into local celebrities and reinforcing the social proof that resisting fraud is neither rude nor complicated.

The Alliance measures success by a single metric: reported losses. Police statistics for the county show that seniors over seventy who completed at least two workshops reported 47 % lower financial damage in the third quarter of 2025 compared to the same cohort in 2024. The figure is not inflated; it covers only those who signed a data-sharing consent form, and the absolute numbers are small—17 000 € avoided—but the downward curve is steady. More telling is the secondary effect: children of graduates are enrolling themselves, asking for “the course my mother keeps quoting at Sunday lunch.” The county has now approved a mobile unit: a refurbished library bus that will carry the same tactile kit to villages with fewer than two thousand residents, ensuring that geography does not dictate vulnerability. The bus itself is a rolling metaphor: shelves once filled with books now hold colour-coded routers, but the principle is unchanged—knowledge circulates best when it stops within walking distance of your kitchen.

The Cyber Resilience Alliance is a public-private partnership established 2025, led by CypSec, Validato and the County of Mansfeld-Südharz. The Alliance operates a sovereign private-cloud security stack, a shared SOC and an cyber academy, aiming to make Mansfeld-Südharz the reference site for rural cyber resilience by 2030.

Media Contact: Daria Fediay, Chief Executive Officer at CypSec - daria.fediay@cypsec.de.