20 Minutes to Lock Down a Loved One's Phone and Accounts

You don’t need to be a tech expert to help protect someone you love from scammers. Most of the important protections take just a few minutes to set up — and once they’re in place, they work quietly in the background. This checklist is designed for one sitting, ideally with your family member beside you.

Grab a cup of coffee and a notepad. You can do this.

Step 1: Turn on spam and scam call filtering (2 minutes)

Both iPhones and Android phones have built-in tools that identify and silence likely spam calls before they even ring through.

On iPhone: Go to Settings > Phone > Silence Unknown Callers. This sends calls from numbers not in your contacts straight to voicemail. You can also enable call filtering through your carrier’s free app (most major carriers offer one).

On Android: Open the Phone app > Settings > Caller ID & Spam, and turn on “Filter spam calls.”

This won’t block every bad call, but it cuts down the volume significantly — and fewer scam calls means fewer chances for one to get through.

Step 2: Secure the email account first (5 minutes)

Email is the master key to everything else. If a scammer gets into someone’s email, they can reset passwords for the bank, social media, and every other account linked to that address.

Turn on two-factor authentication (2FA). This means that even if someone gets the password, they still can’t get in without a second code sent to the phone. Look for this in the email account’s security settings. It usually takes about two minutes to set up and makes an enormous difference.

Check for any “recovery email” or “recovery phone number” that’s outdated. An old address or disconnected phone number is a back door. Make sure the recovery options are current.

Set a strong, unique password for email. If your family member is using the same password for email that they use elsewhere, that needs to change. Which brings us to the next step.

Step 3: Set up a password manager (5 minutes to set up, lifetime of benefit)

Remembering a different strong password for every account is genuinely hard. That’s why most people reuse passwords — and that’s one of the things scammers count on. A password manager (referral link) solves this by generating and storing strong, unique passwords for every site, protected by one master password.

Your family member only needs to remember one thing. The password manager handles the rest.

Most password managers work across phones, tablets, and computers. Look for one with a simple interface if you’re setting this up for someone who isn’t very tech-comfortable. Many have free tiers that are more than adequate for personal use.

Once it’s set up, change the passwords for the most important accounts: email, bank, and any account linked to a credit card.

Step 4: Enable two-factor authentication on the bank account (3 minutes)

Log into the bank’s website or app, go to security settings, and turn on 2FA if it isn’t already on. Most banks offer this now, and many have it enabled by default.

While you’re there, set up transaction alerts. Most banks and credit card companies can text or email a notification for any transaction over a certain amount — say, $50 or $100. This makes it easy to catch unauthorized charges quickly rather than discovering them weeks later on a statement.

Step 5: Freeze credit at all three bureaus (5 minutes per bureau)

A credit freeze is one of the most powerful protections against identity theft. It locks your credit file so that no new credit accounts can be opened in your name — not by you, not by anyone else.

It’s free to freeze and free to unfreeze. You can temporarily lift it if you need to apply for credit.

You need to do this at all three credit bureaus separately:

• Equifax: equifax.com/personal/credit-report-services/
• Experian: experian.com/freeze/center.html
• TransUnion: transunion.com/credit-freeze

It takes about five minutes per bureau. Write down the PINs or confirmation numbers somewhere safe — you’ll need them to lift the freeze later.

Step 6: Consider identity and credit monitoring (ongoing)

Once the freeze is in place, identity & credit monitoring services watch for suspicious activity — new accounts being opened in your family member’s name, their personal information appearing in data breaches, changes to their credit report. Many offer alerts when something unusual happens.

This is a layer of early warning, not a replacement for the freeze. Think of the freeze as locking the door and monitoring as having a security camera that alerts you if anyone tries the handle.

If your family member travels frequently or uses public Wi-Fi, a trustworthy VPN is also worth considering. It encrypts internet traffic on open networks, which is where a lot of account information gets intercepted.

---

Red flags to watch for after you’ve set things up

Even with these protections in place, stay alert:

• Unexpected texts with login codes that your family member didn’t request (someone may be trying to get into an account)
• Emails about accounts being created that they didn’t create
• Unfamiliar charges on a bank or card statement, even small ones
• Mail about credit cards, loans, or accounts they didn’t apply for

What to do if something looks wrong

1. Don’t panic — catching it early is exactly what these protections are designed to do.
2. Contact the bank or company directly using a number from their official website, not from the suspicious email or message.
3. Change the password for the affected account immediately.
4. Check whether the same password was used anywhere else — change those too.
5. Report identity theft to the FTC at identitytheft.gov — they have a step-by-step recovery plan.
6. Check the credit report at annualcreditreport.com for any accounts you don’t recognize.

---

Being scammed or having your identity stolen is not a sign of carelessness or naivety. These are well-organized operations designed to defeat people who are busy, trusting, and human. The steps above make it much harder for any of that to happen — and that’s worth an afternoon.

Once you’re done, take our 2-minute Spot the Scam quiz together. It’s a low-stakes way to practice recognizing the tactics scammers use most. And if you notice anything suspicious in the process — a strange account, an unfamiliar charge, a weird email — report it here so we can help others stay protected too.