She gave her name, email, birthday, phone number, address, and last four of her social (only her last four, she swore up and down) to a scammer pretending to be PayPal.

I told her to alert her banks/credit cards, and I showed her some warning signs for the next time someone tries to scam email/call/text/whatever.

Anything else I should do? Or have her do?

https://www.consumer.ftc.gov/articles/0275-place-fraud-alert

"Ask 1 of the 3 credit reporting companies to put a fraud alert on your credit report. They must tell the other 2 companies. An initial fraud alert can make it harder for an identity thief to open more accounts in your name. The alert lasts 90 days but you can renew it."

Not too sure what could be opened with just the last four of ssn, but if this is a free service, couldn't hurt.

https://krebsonsecurity.com/2015/06/how-i-learned-to-stop-worrying-and-embrace-the-security-freeze/

In short, he’s saying you should freeze your credit accounts with the four major credit bureaus to prevent fraudulent lines of credit being opened instead of using credit monitoring services that just alert you once you’ve been compromised. this won’t affect your established credit accounts, only freezes new inquiries from being made. Some of the bureaus will charge you a fee to place a freeze and lift a freeze (to obtain new credit) but in the end the fees you pay to do this will still be cheaper than paying for credit fraud monitoring and having to resolve the issue after the fact.

file a complaint with ic3.gov and maybe contact ftc's id theft dept 1-800-438-4338 or online identitytheft.gov