"We set up parental controls, so he's fine."
It's the sentence you hear most often at the school gates in September, when the new back-to-school phones come out of pockets. It's reassuring, and largely untrue. Most consumer parental control solutions filter websites, limit screen time and monitor installed apps. Almost none of them touch the channel through which the first scam attempts arrive: text messages.
An 11-year-old who gets their first SIM card starts receiving unsolicited texts within weeks. Not because they did anything wrong: mobile numbers in France are allocated in blocks, and mass-messaging campaigns dial entire ranges of numbers without knowing who is at the other end. The first fake delivery text may well arrive before the first real text from a friend.
Here's what to set up the same day, what's pure theatre, and what happens somewhere other than in the settings menu.
What's different between an adult's phone and a child's phone
On paper, it's the same device, the same network, the same messages. In practice, three differences matter.
The child has no frame of reference. An adult who receives "Your parcel is being held pending customs fees" remembers whether they ordered anything. An 11-year-old doesn't know what a customs fee is, doesn't know whether their parents are expecting a parcel, and assumes that an official-looking message displayed on their phone is official. The absence of reference points amounts to credulity.
The child doesn't report, they delete. Faced with a strange message, the most common reflex is silent deletion. Not out of secrecy: simply because it never occurs to them that a text message might be an event worth mentioning. The result is that parents find out about an ongoing campaign three weeks too late.
The lever isn't money, it's the account. A child doesn't have a bank card. They have a gaming account, a school account, a username on a creative platform, sometimes an email account shared with a parent. That's what's targeted, and it's often resellable.
Cybermalveillance.gouv.fr and the official 33700 reporting platform have been documenting it for several years: smishing aimed at minors almost never goes after a bank transfer, it goes after a login or a one-time code.
The six settings to sort out in the first hour
Do them with the child, not for them. A setting that's explained sticks; a setting that's imposed gets switched off the moment the device changes hands.
1. Turn off message previews on the lock screen
This is the highest-value and most overlooked setting. As long as notifications display the full content, anyone on the bus or in the playground can read the conversations — and above all read the six-digit verification codes.
- On Android: Settings → Notifications → Notifications on lock screen → "Hide sensitive content".
- On iPhone: Settings → Notifications → Show Previews → "When Unlocked".
The message still arrives, you can see there is one, but you have to unlock the phone to read it.
2. Disable automatic link previews and image downloads
In Google Messages as in Apple's Messages app, certain settings generate rich previews of the links received. On a child's phone, a raw, ugly link that can't be clicked by accident is preferable to a nice card with a company logo that gives the fraudulent message the appearance of official communication. That's exactly what the scammer is after.
3. Turn on filtering for unknown senders
iOS offers "Filter Unknown Senders" (Settings → Apps → Messages). Android offers spam protection and, since the updates rolled out in France in 2026, enhanced detection of scam-type messages in Google Messages.
These filters work well against crude mass spam. They are regularly bypassed by carefully crafted campaigns, particularly those that spoof a legitimate sender name. Useful, but not a barrier.
4. Block premium-rate SMS purchases with the carrier
This is the setting almost nobody configures, and it's the one that prevents nasty surprises on the bill. All French carriers let you block SMS+ services and premium-rate numbers from your online account, free of charge. A call to customer service will do if you can't find the option in the interface.
Fake prize draws and "premium" subscriptions activated by a simple text reply then become ineffective. On a minor's line, this block should be the default.
5. Turn off SMS fallback for sensitive accounts
If the email account or the gaming account uses SMS as a second factor, a stolen phone or a simple glance over the shoulder is enough. Where the platform allows it, favour an authenticator app, or better still, for the genuinely important accounts of an older teenager, a physical FIDO2 security key that fits on a keyring and can't be copied.
6. Treat the child's number as data not to be shared
This isn't a setting in a menu, it's a decision. The number doesn't go into online game forms, doesn't appear on public profiles, isn't used to create an account on a non-essential platform. Every entry increases the likelihood that the number ends up in a database that gets resold.
What's useless (or nearly)
It needs saying plainly, because many families wear themselves out on measures that don't work.
| Measure | What parents believe | What it actually does |
|---|---|---|
| General-purpose parental control app | "It blocks scams" | Filters the web and apps, almost always ignores the content of text messages |
| Blocking a sender's number | "They won't be back" | Campaigns change number with every send, sometimes with every recipient |
| Replying STOP to a fraudulent text | "I'm unsubscribing" | Confirms the line is active and read; save it for genuine marketing campaigns |
| Reading your child's texts on the sly | "I'm keeping an eye out" | Destroys trust, and the child moves their conversations elsewhere |
| A "basic" phone with no internet | "No smartphone, no risk" | Smishing works perfectly well on a keypad phone |
That last point deserves some nuance. A simple phone with no browser does reduce the attack surface: the child can't open a fake banking form. Many families make that choice for the start of secondary school, with a basic keypad mobile phone, and it's a defensible decision. But it remains exposed to premium-rate numbers, fake prize draws and call-back scams. Blocking SMS+ with the carrier then becomes the main safeguard.
The three sentences to teach them
Settings last a season. Reflexes last years. Three phrasings are enough, provided they're repeated without dramatising.
"A code received by text is never shared with anyone. Ever. Not even with me."
This is the most important and the simplest rule. No legitimate service asks you to pass on a code received by text. No exceptions. By saying "not even with me", the parent removes any ambiguity and makes the rule easy to hold to when faced with a scammer posing as a trusted adult.
"If a message puts pressure on me, I wait ten minutes."
The whole mechanism of smishing rests on urgency: your account will be deleted, your parcel will be returned, your prize expires tonight. Ten minutes of waiting defuses virtually every case. Nothing legitimate is lost in ten minutes.
"If I clicked, I say so straight away, and nothing bad will happen."
This is the hardest parental promise to keep and the most useful. Shame is the number one fuel for these scams. A child who fears having their phone confiscated says nothing, and the delay turns a harmless incident into a lost account. The commitment has to be explicit: no punishment for a prompt confession.
The special case of class group chats
From the first year of secondary school onwards, most exchanges happen in a group chat. That's where the most dangerous links circulate, for a simple reason: a link sent by a classmate isn't perceived as a link from a stranger.
The pattern is almost always the same. One pupil has their account stolen. The scammer, or an automated script, forwards the booby-trapped link to their entire contact list. Recipients recognise the sender, click, and the chain continues. In a class of thirty, one weak link is enough.
A few points to explain to the child:
- A link sent by a friend may have been sent by someone who has taken over their account.
- A message that doesn't sound like the way that person usually writes is suspicious, even if it comes from the right number.
- When in doubt, ask them face to face the next day. Not by message.
- Warn the classmate involved: that's often how the victim finds out their account has been stolen.
The first phone as an object, not just a service
Two practical, physical considerations weigh on security, and they're often forgotten.
The first is loss. A child's phone gets lost, dropped, left in a changing room. It isn't the device that's expensive, it's the conversations and the accounts that remain accessible if the screen lights up without a passcode. A six-digit passcode, not an unlock pattern visible from three metres away, and device location turned on from day one. Some families add a Bluetooth keyring tracker to the bag, which at least makes it possible to know whether the phone was left at the gym.
The second is the battery. A dead phone receives neither parents' calls nor text messages, and a child panicking in front of a black screen at 6 p.m. makes bad decisions — borrowing a stranger's phone, for instance. A compact power bank at the bottom of the school bag solves a good share of the week's genuine emergencies.
Finally, for families who want to structure the conversation rather than improvise it, there are digital education guides for parents that offer conversation sequences by age bracket. It's less spectacular than a monitoring app, and considerably more effective over time.
What to do when the message has already arrived
A fraudulent text on your child's phone isn't an exceptional event, it's a statistic. The right response comes down to four steps.
- Don't reply, don't call back, don't click. Not even "just to see".
- Forward the message to 33700, the official platform for reporting spam and fraudulent messages, free of charge and operated under public authority with the support of Arcep. Forwarding takes ten seconds and feeds into the blocking of sender numbers.
- Delete the message once it's been reported, so it doesn't get reopened out of curiosity.
- Take stock if a link was opened: change the password for the account concerned, check the recovery email addresses, and keep an eye on the month's carrier bill.
If an account has been hijacked or money is at stake, Cybermalveillance.gouv.fr offers a free assistance pathway and points you towards filing a complaint. For content involving a minor (blackmail, image sharing), the entry point is the French Interior Ministry's PHAROS platform, or 3018, the national helpline dedicated to online violence affecting young people, available free of charge and anonymously.
Key takeaways
On the day a child gets their first phone, the essentials can be sorted in an hour: hide previews on the lock screen, turn on filtering for unknown senders, block premium-rate texts with the carrier, lock the device with a real passcode, and lay down the rule about the verification code that is shared with no one.
The rest isn't about settings. It's about a family habit: talking about odd messages the way you'd talk about a playground incident, without making it a drama or a punishable offence. The best-protected children aren't the ones with the most tightly locked-down parental controls. They're the ones who know they can show a dodgy text to an adult without consequences.
It's free, it doesn't get switched off by the next update, and it still works at 17.
