[a13n]

Have them move all their account credentials to LastPass, and make sure every password is unique. Set up two factor auth on all bank, email, social, commerce accounts that allow it.