Protect Your Parents' Phone from Scams: Settings Checklist

To protect elderly parents from phone scams, change six things on their phone in one visit: screen calls from unknown numbers, filter texts from unknown senders, block app installs from outside the official store, set a SIM PIN, turn on theft protection, and add yourself as a recovery contact for their Apple or Google account. Each setting below has the iPhone (iOS 26) and Android path, and what your parent will notice afterwards.

That last part matters more than the settings. A protection that confuses them on Tuesday gets switched off by Thursday, usually by asking a neighbour or, worse, the caller.

What scammers actually need from the phone

Almost every scam that targets older people ends in one of four requests: read me the code you just got, install this app so I can help, click this link to pay, or send money to a "safe account". The settings below make the first three harder. Nothing in the phone stops the fourth, which is why the last section is a conversation, not a setting.

The one-visit table

Menu names move between versions and brands. If a path doesn't match, type the last item into the Settings search bar.

Calls: ask, don't silence

iOS 26 offers three choices for unknown numbers: Never, Ask Reason for Calling and Silence. Most anti-spam guides tell you to pick Silence. For a parent I'd pick Ask Reason for Calling. Silence sends every unknown number to voicemail, and that includes the clinic, the pharmacy and the courier, who don't leave messages. Then your parent calls back unknown numbers from the call log, which is exactly the habit scammers rely on.

With Ask Reason for Calling, the iPhone answers silently, asks the caller for their name and reason, and shows the answer as text. A robot dialer hangs up. A real person says "it's the surgery about Friday".

On Android, the Google Phone app marks suspected spam with a red screen and can filter it out. Pixel phones in supported regions also have Call Screen, which works the same way as Apple's. Samsung's own Phone app has a similar setting under Caller ID and spam protection.

Texts: a second inbox for strangers

Turn on Screen Unknown Senders on the iPhone (also reachable from Messages > Filters > Manage Filtering). Texts from numbers that aren't in contacts go to a separate Unknown Senders list instead of the main conversation list, and a real sender can be moved back with Mark as Known. Show your parent where that list is, or they'll think the courier never wrote.

In Google Messages, check that spam protection is on. Fake delivery and toll texts are the most common entry point, and a filtered list where they sit quietly beats a notification that says "Your parcel is held, pay £1.99".

App installs: the setting that matters most on Android

The "bank security team" script usually ends with "install this app so I can protect your account". The app is a remote-control tool or malware that reads SMS codes. iPhones can't install apps from outside the App Store in most countries, so this mainly concerns Android.

On Android 16, Advanced Protection blocks installs from unknown sources, keeps Google Play Protect on, blocks 2G, and adds theft locks. Google's own list of what you give up: no sideloaded apps, accessibility services limited to verified tools, the phone no longer opens itself near a paired smartwatch. For a parent who only installs from the Play Store, none of that is a loss. The exception is someone who relies on a third-party accessibility app (a screen reader or launcher for low vision); check it still works after you switch it on.

On a Samsung phone, Auto Blocker does the app part: it stops installs from outside Galaxy Store and Google Play and blocks commands over USB cables. Phones that shipped with One UI 6.1.1 or newer have it on by default; older phones that updated keep whatever setting they had, so check.

SIM PIN and the screen lock

A SIM PIN stops someone who takes the SIM out from putting it in another phone and receiving your parent's SMS codes. Apple's own instruction is blunt: don't guess the current PIN. A few wrong attempts lock the SIM and you need the PUK from the carrier. The starting PIN is in the plan documents or on the card holder the SIM came in; many carriers ship 0000 or 1234, which is why it has to be changed.

Pick a new 4 to 8 digit PIN with the PIN Generator. It runs entirely in your browser and nothing is sent anywhere, so the PIN stays on your screen. Write it on paper that lives at home, not in the phone case. Do the same for the screen lock: six random digits, never a birth year.

Then turn on Stolen Device Protection on the iPhone. Away from familiar places, it asks for Face ID before showing saved passwords and adds a one-hour delay before the Apple Account password can be changed. A thief who watched your parent type the passcode on a bus can't lock them out of their own account.

Make yourself the way back in

This is the step I'd never skip. When I've helped people recover a hijacked account, the problem was the same each time: they didn't know the password to their own email, and they had no two-step verification. Once the attacker changed the phone number, there was no path back.

Recovery contacts fix that without giving you access to anything:

• Apple: Settings > their name > Sign-In & Security > Recovery Contacts. You need an Apple device on iOS 15 or later and iMessage on. During recovery you read them a six-digit code; you never see their data. Up to five contacts.
• Google: Google Account > Security & sign-in > Recovery contacts. You confirm their identity by picking a matching number on your phone. The invite takes up to 7 days to accept and there's another 7-day wait before you can help, so set it up now, not during an emergency.

While you're in their Google or Apple account, add a passkey (a sign-in that uses the phone's screen lock instead of a password). A passkey only works on the real site, so a fake login page can't collect it. The Passkey Checker shows whether their phone and browser support one, and my passkeys guide explains what happens if the phone is lost. For the rest of their account settings, my Google Account and Apple ID guide goes through each screen.

The rule no setting replaces

Agree on two sentences and write them on a card by the phone:

1. Nobody real will ever ask you to read out a code from a text, install an app, or move money to a "safe account". Hang up, then call the number on your bank card.
2. If someone says they're me and in trouble, ask for the family word. (Pick a word together; voice-cloned calls are cheap now.)

If a scam got through anyway, the first-hour checklist for a hacked account covers what to do in order.

FAQ

Can I stop my parent from installing apps on an iPhone?

Yes. In Settings > Screen Time > Content & Privacy Restrictions, turn the restrictions on, open App Store purchases and set Installing Apps to Don't Allow, then protect Screen Time with a passcode only you know. It works, but every new app then needs you, so I'd only do it for someone who has already installed something a caller told them to.

My parent already read a code to a caller. What now?

Treat the account behind that code as taken. If it was a bank code, call the bank on the number printed on the card, not one from a text. If it was an email, WhatsApp or Telegram code, follow the first-hour recovery steps: secure the email, end unknown sessions, set a new password and turn on two-step verification.