Your Child’s First Phone or Tablet: Settings That Block Scams

The best time to set up a child’s first phone is the night before it is unwrapped. Three settings do most of the scam-blocking work: who can contact them, who approves purchases, and who approves new apps.

Scams aimed at children rarely look like scams. They look like a friendly stranger in Messages, a game asking for “just one quick purchase,” or an app that promises free skins or followers. You cannot screen every message, but you can make sure strangers have fewer ways in and that money and new apps need a parent’s tap.

The Federal Trade Commission’s April 2025 parental-controls alert makes two points that frame everything below: parental controls “need to be set up on all the devices your kid uses,” and “there’s really no substitute for talking with your kid.”

The three settings, on both platforms

Apple renamed several parental controls in its 2026 software. Its parental controls guide, updated October 26, 2026, describes the new controls for iOS 27 and iPadOS 27; older devices that cannot update keep the earlier Screen Time menus. Google’s controls live in the Family Link app.

1. Contacts: strangers are the main risk

On Apple devices, set Allowed Contacts to Contacts Only for a younger child, and add family, close friends and a school contact yourself. On Android, Google’s contacts guide lets you choose Only contacts I add, for up to 100 contacts. Google notes this works on Android 14 or later and applies to certain apps, including Google Messages, Samsung Messages and the Google Phone app. WhatsApp and other messaging apps are not covered, so block them separately or keep them off the device.

This one setting removes the “wrong number” opening that so many grooming and scam conversations start with. Our article on wrong-number texts that turn into friendships shows how that pattern develops in adults; children are no less polite to strangers.

2. Purchases: every payment needs a parent

Apple’s Ask to Buy page says it covers App Store apps, in-app purchases and redownloads of shared apps, and is on by default for children; Apple says it can’t be turned off for a child under 18, though the age varies by country or region. A request not answered within 24 hours has to be sent again, which is a useful brake. On Android, Google’s purchase approvals page says approval applies to purchases billed through Google Play; for paid items, the parent enters their own password on the child’s device.

Choose the strictest option at first (“All content” on Android). You can loosen it once you see how your child uses the device. The FTC’s November 2025 alert on kids’ devices suggests you “disable in-app purchases or require a password for all purchases.”

3. Apps: approval is the anti-scam filter

Many scams reach children through apps: fake versions of popular games, “free currency” generators and chat apps with no age checks. Requiring approval for every download means you see the app’s name, developer and ratings before it lands. When a request comes in, check:

• Is the developer the company you expect? Copycat apps use similar names and icons.
• Does it ask for permissions that make no sense, such as contacts for a drawing app?
• Does it include chat with strangers? If so, can chat be turned off inside the app?

Games and consoles have their own controls; our companion guide to locking down a new console or gaming account covers Roblox, Xbox, PlayStation and Nintendo.

Built-in protections worth knowing about

Apple’s Communication Safety is on by default for users under 18. Apple says it detects nudity in Messages, AirDrop, FaceTime and other places and “warns them, blurs the content, and provides helpful resources.” For children under 13, viewing flagged content requires the parent’s Screen Time passcode. Apple’s guide also says Limit Adult Websites is on by default for users under 18.

Google’s Family Link can show the location of an Android device. The FTC’s kids and cell phones page suggests children share their location “only with friends they trust and know in person.”

Set the passcode on your device, not theirs

Apple’s Screen Time guide says that with Family Sharing, the organizer or guardian sets the child’s Screen Time passcode on their own device, “not the child’s device.” Use a passcode your child has never seen you type. The FTC is realistic here: “Your kids may try to find ways to get around parental controls.” That is normal, and it is a reason to check settings every few months rather than a reason for alarm.

The conversation that makes settings work

Settings fail quietly; a child who knows what to do when something feels wrong does not. Before handing over the device, agree on a few house rules in plain words:

1. Nobody you haven’t met in person gets added as a contact.
2. If anyone asks for a code from your phone, a password or a photo, come and tell us. You won’t be in trouble.
3. Free money, free skins or free followers are always a trick.
4. If someone says to keep a secret from your parents, that is the moment to tell us.

A family code word for emergencies, described in our code-word setup guide, gives children a simple test for any call or message claiming to come from a relative in trouble.

Sources

• Apple: Set up parental controls on your child’s iPhone or iPad (October 26, 2026)
• Apple: Use Screen Time to manage your child’s iPhone or iPad
• Apple: Ask to Buy
• Apple: About Communication Safety
• Google Families Help: Set up your child’s contacts
• Google Families Help: Purchase approvals on Google Play
• FTC: How to use parental controls (April 22, 2025)
• FTC: Help kids protect their devices (November 24, 2025)
• FTC: Kids and cell phones