Yet all of this can be easily defeated with soft language. The basic check "what's the password/verification word" will defeat this every time. This is basically opsec that we taught my grandparents, who were in their 90s. Its doable.
Yes but that's more of a mitigation than prevention. It's an additional step, you have to remember to do it, and under the pressure of the situation you might easily forget to do it.
So they trick the kid out of the password first by calling them and pretending to be the parent.
Code words break down emotionally. Many seniors do not reliably trust their own memory during a frightening call