A 30-minute setup to do together

They do the tapping. They’ll need to find these settings again without you.

Don’t sign in to their accounts from your own phone or laptop. A sign-in from a new device sends them a security alert, and if they learn to wave those off as “probably you,” they’ll wave off the real one.

If something is already wrong

Skip the setup for today.

• Someone is on the phone with them, or on their computer: Someone is on the line or on my screen right now
• Someone is pressuring them for money right now: Someone I love is being scammed right now
• Money already went: I paid or sent money
• They’re locked out, or someone got into an account: Someone got into my account

Before you sit down

Bring their phone and charger, the bank and credit cards from their wallet, a phone bill, an index card, and a pen. Each bank app and the phone company’s app needs a sign-in. If nobody knows a password, resetting it is today’s job and the rest waits. If they say no to a step, skip it. Stop at 30 minutes and pick a day for the rest.

What to say

• Can we sit down with your phone for half an hour this week? You do the tapping, I'll read the steps. If something takes too long, we'll stop and do it another day.

• If I ever ask you for a code that came to your phone, it isn't me. Call me on the number you have.

• I'd like text alerts for every card purchase and every transfer out of my accounts, and for any change to my phone number, email, or password.

• If anyone calls about your money, even someone who sounds like me, hang up and call a number on this card.

The 30 minutes

1. Bank and card alerts

Open each bank and card app. In the alert settings, turn on whatever it offers for:

• purchases and money leaving the account, at the lowest amount it allows
• sign-ins from a new device
• changes to the phone number, email, or password on the account
• someone new added to the people they pay (a new Zelle contact or bill payee)

They see a charge they didn’t make when it happens, not when the statement comes. No app? Call the number on the back of the card together, on speaker, and let them ask.

When an alert worries them, they open the app or call the number on the card. Not a number or link in the alert.

2. Lock their phone number

Whoever moves their number to another phone gets every code texted to it. AT&T, Verizon, and T-Mobile each have a lock you turn on in their app:

• AT&T: Wireless Account Lock
• Verizon: SIM Protection and Number Lock. Turn on both.
• T-Mobile: SIM Protection and Port Out Protection. Prepaid and Metro get Port Out Protection only.

Menu steps for each are on Lock down your accounts in 30 minutes. Other carriers: call the number on the bill and ask what blocks SIM changes and number transfers. On a family plan, the account owner may have to do it.

Set an account PIN too. It’s for calls they make to the carrier, never for calls that come to them. The lock can block their next phone upgrade until they switch it off. That’s normal.

3. Make yourself their recovery contact

If they forget a password or get locked out, you can help them back in. You don’t get into their account.

• iPhone: Settings, tap their name, Sign-In & Security, Recovery Contacts, Add Recovery Contact. Accept the invite in Messages on your phone. In their Family Sharing group, there’s no invite. You both need an Apple device with iMessage on; if you don’t have one, pick someone in the family who does. While you’re there, check that two-factor authentication is on.
• Gmail or Android: myaccount.google.com, Security & sign-in, Recovery contacts, Add recovery contact, if their account offers it. Accept the email Google sends within 7 days. Google then waits 7 more days before you can help. When they’re locked out, Google shows them a number. They call you with it, and you tap the same number on your phone.

On the same screen, check the recovery phone and email. Remove any they don’t recognize or no longer use.

Either way, hang up and call them back on their saved number before you read a code or tap a number.

4. Let the phone keep their passwords

• iPhone: the Passwords app (iOS 18 and later). In Settings, General, AutoFill & Passwords, turn on AutoFill Passwords and Passkeys.
• Android: Google Password Manager is built in.

Pick a site they sign in to, sign in together in the phone’s browser, and let the phone save the password. Next time, it fills it in, and only on the site it was saved for. If it doesn’t offer, look at the address before typing anything.

5. Screen calls from numbers they haven’t saved

iPhone (iOS 26 or later): Settings, Apps, Phone, then choose Ask Reason for Calling. A caller they haven’t saved has to say who they are and why before the phone rings. Android and carrier tools: Phone calls: how to handle a call you didn’t expect.

Save the doctor, pharmacy, bank, and family in Contacts so those calls ring straight through. A saved name on the screen only means the number matched. Caller ID can be faked, so a call about money still ends the same way: hang up and call the number on the card.

6. A family code word

Agree on it out loud. Don’t write it on the card or text it. How to pick one and ask for it without giving it away: Set up a family code word. Even if a caller says it, they still call the person back on the number they have before any money moves.

7. The card by the phone

On an index card, in big print:

• each bank and card company: the number from the back of the card
• the phone company: the number on the bill
• you, and one other family member
• AARP Fraud Watch Network Helpline: 877-908-3360
• National Elder Fraud Hotline, for anyone 60 or older: 833-372-8311

Across the top, two lines:

• “Calls about money: hang up and call a number on this card.”
• “A pop-up or caller says the computer has a problem: hold the power button until it turns off. Then call me.”

Put it on the fridge or next to the phone they use. Leave off the code word, passwords, PINs, and account numbers.

Next visit

Steps for the first three are on Lock down your accounts in 30 minutes.

A passkey for their email. It signs them in with their face, fingerprint, or screen lock. Unlike a password or a texted code, there’s nothing to read out to anyone.

A credit freeze at Equifax, Experian, and TransUnion. Nobody can open new credit in their name while it’s on. It’s free, doesn’t affect their score, and lasts until they lift it. That’s three separate sign-ups, so give it a visit of its own. Each bureau has them make a login for lifting the freeze later. Write them down and keep them with their papers. It won’t stop a scam where someone talks them into sending money.

Theft protection, Find My (iPhone) or Find Hub (Android), and automatic updates on their phone.

A trusted contact at their brokerage. Brokerage firms have to try to get one (FINRA Rule 4512). The firm can then call you about possible financial exploitation, or to confirm their contact details or health. It doesn’t give you any authority over the account. Ask their bank whether it has something similar.

What it looks like

Thursday, 7:10 p.m. You set up your mom's phone on Sunday.

Mom

Text Message
Today 7:10 PM

Just got this: G-507284 is your Google verification code. I didn't do anything. Do you need it for the setup?

What do you do?

• Text back that it's left over from Sunday and she can ignore it
• Tell her not to send codes to anyone, and to delete it
• Call her. Go through Google's Security Checkup together on her phone, and change her password

Show the answers

• Wrong move Text back that it's left over from Sunday and she can ignore it A code is only sent when someone asks Google for one. This one just arrived, so it isn't left over, and she says she didn't ask. Someone else did.
• Okay Tell her not to send codes to anyone, and to delete it That's Google's advice for a code you didn't ask for. It doesn't tell you whether someone already has her password.
• Best move Call her. Go through Google's Security Checkup together on her phone, and change her password Security Checkup shows the devices signed in to her account and her recent security activity. She can sign out any device she doesn't know. A new password shuts out anyone who has the old one.

A code nobody asked for means someone else tried to get in. Check her account together. A code sent to her phone goes to nobody, you included.

Saturday, 9:40 a.m. Last month your dad added you as his Apple Account recovery contact. Your phone rings and shows Dad.

Dad

Incoming call · 9:40 AM

1. Dad Hey, it's me. I'm locked out of my Apple account. I put the wrong password in too many times.
2. Dad It says my recovery contact can get me a code. That's you, right?
3. Dad Can you read it to me? I've got the screen up.

What do you do?

• Get the code on your phone and read it to him
• Say you'll call right back, hang up, and call his saved number. Then read him the code
• Tell him you can't. Codes never get read out to anyone

Show the answers

• Wrong move Get the code on your phone and read it to him His name on your screen means the call came from his number, or from someone faking it. A voice can be copied from a short clip. Apple says to give the code only to the person themselves, and not to anyone else who asks for it.
• Best move Say you'll call right back, hang up, and call his saved number. Then read him the code If it's him, he has the code a minute later. If it wasn't, the real Dad answers and you've given nothing away.
• Okay Tell him you can't. Codes never get read out to anyone Safe, but he stays locked out, and Apple's other way back in can take longer. Call him back on his saved number, then read it.

A recovery code goes only to the account's owner, after you've called them back on their saved number.