Most phone scams succeed not because the victim is careless, but because the device treats every caller the same way. On a default smartphone, an unknown number rings with exactly the same urgency as a son or daughter. Closing that gap is the single most effective thing a family member or caregiver can do in an afternoon — and it requires no special software, only a handful of settings buried in iOS and Android.
No configuration makes a phone invulnerable. What it can do is change the rules of engagement: unknown callers get screened, unknown texts get quarantined, banking alerts get amplified, and a trusted contact gets the power to restore access if an account is lost. Menu names shift between versions and manufacturers, so the paths below follow the official Apple and Google documentation; owners of other brands with custom dialers should look for the equivalent option in their own settings.
- Contacts first: Every filter works by comparing incoming numbers against the address book, so family, doctors, pharmacies and neighbours must be saved before anything else.
- Screen, don’t silence: Asking unknown callers to state their business preserves legitimate calls from new numbers while forcing scammers to identify themselves.
- Recovery matters: A designated recovery contact can generate a code to help someone back into their account without ever gaining access themselves.
Step one: build the contact list, then filter strangers
Everything downstream depends on the address book. Apple states explicitly that family, friends, schools and medical practices should be saved as contacts so their calls always come through, and Google’s call filter follows the same logic: if you don’t want a number filtered, save it as a contact.
On iPhone, the official route is Settings > Apps > Phone. Under the unknown-caller filtering section there are three choices: Never, which lets everything ring as normal; Ask Reason for Calling, which prompts the caller to explain themselves before the phone rings; and Silence, which sends unknown calls straight to voicemail. The same screen offers a junk-call filter and can route missed calls and voicemails from unknown numbers into a separate list.
For an older user, Ask Reason for Calling is usually the best balance: a clinic calling from a new number still gets through, but a fraudster has to identify themselves first. Apple notes two caveats — calls aren’t evaluated while roaming, and the screening is disabled for 24 hours after an emergency call.
On Android with Google’s Phone app, caller ID and spam protection are enabled by default. Under More options > Settings > Caller ID & spam, users can switch on Filter spam calls, which stops those calls from ringing or generating a notification while still logging them in the history. The trade-off is that the numbers of non-contacts are sent to Google for identification.
Two further features are limited to Pixel hardware. As of November 2026, Google’s call screening — where an assistant answers and asks who is calling — is available in Spain only in manual mode, requiring the user to tap “Screen call” when a call arrives. Scam Detection, which warns mid-call if a conversation follows a fraud pattern, works in Spain on Pixel 9 and later, excluding the Pixel 9a and 10a, with a Spanish SIM and while located in Spain. It ships disabled and must be enabled under Phone > Settings > Scam Detection; Google cautions that it is not fully accurate and that analysis happens on-device.
One scenario these filters handle poorly, precisely because they compare against the address book, is a call displaying a bank’s genuine number — especially if that bank is saved as a contact. That is the spoofing problem, and it is a legal as well as a technical one.
Step two: quarantine unknown texts and harden the bank
On iPhone, open Messages, tap the filters button and choose Manage Filtering. Enabling Filter Unknown Senders moves messages from unknown senders into a separate folder with no notification unless the user opts in. Notifications can still be allowed for specific categories such as verification codes. One useful detail: filtering does not apply to senders the user has replied to three or more times.
In Google Messages, spam and scam protection is on by default at the standard level and can be raised to enhanced protection via Messages settings > Protection and safety. Google explains that if a message contains a link, it is sent to its servers to verify that it is safe.
Banking has no single path, since every institution organises its app differently. What matters is reviewing three things together with the account holder, in the app or at a branch: notifications for every movement, including card charges, transfers and instant payments; daily limits on cards and transfers set to real spending rather than default maximums; and online purchases and foreign payments switched off unless actually needed.
One family rule costs nothing and doesn’t depend on any bank: agree a keyword that anyone must say before requesting money by phone. The same safeguard works against cloned-voice calls and against the “Hi Mum, this is my new number” WhatsApp scam.
Step three: designate someone who can restore access
A recovery contact is worth configuring today. Apple lets a user designate someone who, if the account password or device passcode is forgotten, can generate a recovery code to help them back in. That contact gains no access to the account — only the ability to supply the code. Both devices need iOS 15, iPadOS 15 or macOS Monterey 12 or later, and both people must be over 13, with the age varying by country.
Google has its own recovery contacts, added from the Google Account under Security and sign-in. The invited person receives an email request that expires after seven days. It is also worth reviewing the recovery phone number and email: Google warns that a change of number can take up to seven days to take effect, a delay it says protects the account if someone tries to use it without permission.
The most common mistake is configuring everything in secret over a single afternoon and handing the phone back with a casual “done”. If the person doesn’t know a folder for unknown senders exists, they will hunt for the hospital appointment there the day it fails to arrive. Every setting here works better explained than imposed — and a family keyword only protects someone who knows it exists.