My dad recently fell for a scam, and I want to understand what risks we should still be worried about. It was frustrating as hell because this was such an obvious one, and I wasn't able to convince my dad or sibling at all that it was clearly illegitimate.
This happened today. He received repeated texts claiming there was a charge through Apple Pay, and he eventually called the number provided, thinking it was real support. During the call, the person told him he needed to buy gift cards to verify his account. I realized it was a scam because of that, as I was listening in from another room while doing my work. He didn't buy anything, mostly because the guy was too difficult to understand, but he was on the phone with him for hours. As soon as he said they needed to verify the authenticity of his account and prevent other people from using his bank account, and then required my dad to pay $2,000 in gift cards using the Apple Store to verify he was the real owner, I knew something was clearly off.
I tried to warn them during a disconnection issue before the permanent disconnection that it was a scam, but during that time my dad and sister believed it was legitimate and stayed focused on the call. My sister was trying to help him understand what the Indian-sounding guy was saying. They both thought it was legit because the gift cards were not being paid to the scammer, only to the Apple Store, to verify he was him. I wasn't able to figure out how to argue against that in the moment while they were focused on the call.
Fortunately, the call ended when the scammer's connection suddenly dropped. After that, we got him to change his credit card and passwords right away once he realized he did get scammed. However, before that, he had already shared his credit card information, our IP address, and also showed his phone contacts.
I want to know if there are still risks even after changing everything. Could they still use his information later or try to access other accounts? Is there any risk to people in his contacts? What about our IP? He did reset the router and everything, but reading online that it doesn't really change the IP made me worried about future issues. I am trying to understand what problems could still happen and what signs we should watch for so this does not happen again. The steps I took were ensuring he does not ever get the text again through his iPhone's filtering system, as well as giving him the official iPhone support number so he does not call those people again. I do not know what else to do to make sure anything does not target him though.