Five Phone Settings That Stop Most Scam Calls Before They Start

Five settings already built into iPhone and Android phones stop most scam calls and texts: screening unknown callers, filtering texts from unknown senders, automatic updates, two-factor authentication, and blocking app installs from outside the official store. They are free, take about fifteen minutes, and most phones leave several of them off. Each one closes a different door, and a scammer only needs one left open.

Why these settings matter

• Texts overtook other contact methods. In testimony to Congress in March 2026, the FTC said a text message was the top reported way scams first reached people in 2025.
• The top text scams are predictable. The FTC's review of 2024 text scams ranked fake package delivery problems first, then fake job offers, fake fraud alerts, bogus toll notices and "wrong number" openers.
• Toll texts spiked. The FBI received more than 2,000 complaints about fake toll texts in a single month in March 2025.
• Blocking numbers one at a time does not work. Our analysis of 475,404 unwanted and scam call complaints found that 56% of reported numbers got only one complaint, so filtering everyone who is not in contacts does far more than blocking single numbers.

Before you start

Menu names change between phone brands and with almost every software update. Where a name has changed recently, both versions are given below. If you cannot find something, open Settings, use the search bar at the top and type the bolded word.

Do this on the phone itself, not over a remote connection. If anyone has ever asked to connect to that phone remotely, jump to setting five first, because that is a separate and more urgent problem.

Setting 1: Screen calls from numbers not in contacts

This change stops the most calls, and it is also the one people push back on hardest, so explain the logic before switching it on.

iPhone: go to Settings, then Apps, then Phone, and scroll to Screen Unknown Callers. Apple lists three options:

• Never: unknown numbers ring like any other call.
• Ask Reason for Calling: the caller has to say why they are calling before the phone rings.
• Silence: unknown numbers go straight to voicemail with no ring.

For a parent, Ask Reason for Calling is usually the better choice, because a real caller still gets through quickly instead of being stuck in voicemail. Calls are not screened while roaming, and screening switches off for 24 hours after a call to emergency services.

Samsung Galaxy: Samsung's steps are to open the Phone app, tap the three dots, tap Settings, then Caller ID and spam protection, turn it on, and switch on Block spam and scam calls. You can also go to Settings, then Block numbers, to block calls from unknown numbers. Phones on One UI 8.5 or later also offer Scam detection, which warns with a tone or vibration during a likely scam call. Turn it on if you see it.

Other Android phones: open the Phone app, tap the three dots, tap Settings, then Caller ID and spam, and turn on both Caller ID and spam and Filter spam calls. Filtered calls stay out of notifications but still appear in the call history.

What this does not stop: a scammer spoofing a number already saved in contacts, or texts. For calls, pair this with the free network blocking described in our guide to free scam call blocking on AT&T, Verizon and T-Mobile.

Setting 2: Filter texts from people not in contacts

Fake toll and fake delivery texts both count on someone tapping within seconds, before there is time to think.

iPhone: on iOS 26, go to Settings, then Apps, then Messages, scroll to Unknown Senders and turn on screening. Apple says it is off by default, though it stays on if you had Filter Unknown Senders switched on in iOS 18. Messages from anyone not in contacts move to a separate Unknown Senders list, and time sensitive messages such as login codes still notify you.

Android and newer Samsung phones: most now use Google Messages. Open Messages, tap the profile picture, tap Messages settings, then Protection & Safety, then Spam protection, and make sure it is on. Google says it is usually on by default, but it is worth checking.

Show them where the filtered list lives. Some real messages land there, mostly login codes from services they use, so they need to know to look there rather than assume something broke.

Setting 3: Turn on automatic software updates

This feels unrelated to scams until you see how a fake warning pop up works. It is usually not a virus. It is a web page exploiting an old bug that has already been fixed. On a phone that updates itself, most of these pages simply fail. On a phone two years behind, they work as designed, and the person ends up calling the number on screen.

iPhone: go to Settings, then General, then Software Update, then Automatic Updates, and turn on both Download iOS Updates and Install iOS Updates. On iOS 26.1 or later, also go to Settings, then Privacy & Security, then Background Security Improvements, and make sure Automatically Install is on. Apple uses this to deliver urgent security fixes between full updates.

Android: go to Settings, then System, then Software update, and turn on automatic download over Wi-Fi. On Samsung it sits under Settings, then Software update.

Do the same for apps. In the App Store or Play Store settings, turn on automatic app updates, because an outdated browser or messaging app is often the way in.

Setting 4: Turn on two-factor authentication

The first three settings reduce how many scam attempts get through. This one limits the damage if one does.

1. iPhone: go to Settings, tap the name at the top, then Sign-In & Security, and confirm Two-Factor Authentication is on.
2. Android: go to Settings, then Google, then Manage your Google Account, then Security, then 2-Step Verification.
3. Then the accounts that matter most: the banking app, the main email account, and anything holding a pension or investments. Email comes first, because whoever controls the inbox can reset almost every other password.

Say this part plainly: no bank, police department, fraud team or courier will ever ask for a two-factor code over the phone. A caller asking for that code is the scam, with no exceptions.

Setting 5: Block app installs from outside the official store

Nearly every tech support scam ends with the caller asking the person to install a screen sharing app. Once it is running, the caller can watch the banking session and move money while hiding the confirmation screens.

1. Android: go to Settings, then Apps, then Special app access, then Install unknown apps, and set every entry, especially the browser, messaging apps and file manager, to not allowed. On Samsung the path is Settings, then Security and privacy, then More security settings, then Install unknown apps.
2. iPhone: apps can only come from the App Store, so check Settings, then General, then VPN & Device Management instead. If a profile is listed that nobody recognizes, remove it.
3. Both: scroll through the installed apps for anything that allows remote screen control that nobody remembers installing. If you find one, remove it and check the linked bank and email accounts straight away.

Read how these calls usually unfold in our guide on Microsoft tech support scams.

All five settings at a glance

Two more things that are not settings but matter as much

• Agree on a family code word. A short word only the family knows, used to check that a distressed call is real. Voice cloning means the voice alone is no longer proof. See our guide to AI voice clone scams.
• Use a plain voicemail greeting. "Please leave a message" is enough. A greeting with a full name confirms to a stranger working through a list that they have reached a real, named person.

If they still have a landline

None of the settings above touch a landline, and many scam calls to older adults still arrive that way. Ask the provider, using the number on the bill, what free call screening or anonymous call rejection they offer, because it usually has to be requested. A plug in call blocking device between the wall jack and the phone works regardless of the provider.

What none of this stops

• A spoofed number that matches a saved contact.
• Scams that arrive by email, post or social media.
• Someone who searches for a support number and calls a fake ad.
• A person who has already been talked into cooperating mid call.

What these settings do is cut the volume sharply and take the urgency out of whatever still gets through, and that is what changes outcomes. If money has already moved, follow our step-by-step guide for what to do right now.

Frequently asked questions

How we researched this article

This guide is based on Apple's support pages on screening unknown callers, unknown senders in Messages on iOS 26 and Background Security Improvements, Samsung's Galaxy guide to caller ID, spam protection and Scam detection, Google's Messages help on spam protection, reporting on Google's 2026 scam detection features, the FTC's March 2026 testimony to the Joint Economic Committee, the FTC's April 2025 data spotlight on top text scams, FBI warnings on toll text scams reported in March 2025, and The Scam Exposed's own analysis of 475,404 unwanted and scam call complaints. Menu paths were checked against each company's support pages in October 2026 and can change with updates. The Scam Exposed is an independent educational platform and is not affiliated with Apple, Samsung or Google.