Carrier controls: Verizon, T-Mobile and AT&T

Start with the account, not the app. All three big US carriers offer free account-level protections — a lock on the phone number, a lock on the SIM, and a block on purchases billed to the phone bill — that are set on the parent’s account and cannot be switched off from the child’s phone. The carriers’ parental-control apps (Verizon Family, T-Mobile FamilyMode, AT&T Secure Family) do filter the web over cellular data, but each one works through a VPN on the child’s phone, so it only holds while that VPN stays on.

Carrier protections come in two kinds

Home router and DNS filtering stops the moment a phone leaves Wi-Fi. The carrier is the obvious next layer, but carrier features fall into two groups that behave very differently:

• Account-level settings live on the carrier’s systems: Number Lock or Port Out Protection, SIM Protection, purchase blocks, and (on Verizon) call, text and data limits. A child cannot undo them by changing anything on the phone.
• App-based filters need a companion app and a VPN on the child’s device. Verizon states plainly that web and app monitoring stops if the Verizon Family VPN is disabled or the Companion app is uninstalled. T-Mobile says FamilyMode’s VPN must be enabled for parental controls to work, and that the VPN may stop operating when the child’s battery is low. AT&T’s Secure Family Companion app also relies on a VPN turned on during setup.

So the account settings below are worth doing for every child with a phone line. The filtering apps are optional, and they overlap with what the phone’s own controls — Screen Time or Family Link — already do on any network.

Why a teenager’s phone number needs a lock

Verizon describes the risk directly: a scammer with your personal information can move a mobile number to another carrier (an “unauthorized port out”) and then receive its calls and texts to take control of other accounts, such as banking and social media. A SIM swap does the same thing by moving the number onto a new SIM or eSIM. Teenagers are an easy target because their game, social and email accounts often use a text-message code as the second factor. The fix is free and takes a few minutes per line.

Account settings to set up first

1. Find out who holds the account. Several of these protections can only be changed by the account owner: on T-Mobile an Authorized User can add SIM Protection or Port Out Protection but only the Primary Account Holder can remove them; on AT&T, users with primary or secondary access can turn Wireless Account Lock on and off; on Verizon, only the Account Owner or an Account Manager can generate a Number Transfer PIN.
2. Lock the number against transfer. Verizon: turn on Number Lock by dialling *611, or in My Verizon go to the Number Lock section of the Security page and select On for the child’s number. T-Mobile: in T-Life, open Manage, then See Plans, then Manage add-ons, and tick Port Out Protection for each line. AT&T: in the AT&T app, tap the person icon and select Wireless account lock, which blocks transferring a number to or from another carrier.
3. Lock the SIM. Verizon notes that Number Lock does not stop SIM card or device changes, so also turn on SIM Protection, which sits below Number Lock in the same account settings. T-Mobile: in T-Life, open Manage, tap the gear icon, then Security, then SIM Protection, and switch it on for the account or for individual lines. AT&T’s Wireless Account Lock already covers SIM and eSIM swaps, device upgrades and IMEI changes.
4. Block purchases billed to the phone bill. Verizon: on the My Verizon Blocks page, block services to prevent in-app purchases. T-Mobile: add the free Content Blocking feature in T-Life or at T-Mobile.com; it blocks chargeable apps and in-app purchases from storefronts such as Google Play, text-to-give donations and premium subscriptions. AT&T: go to your wireless add-ons, choose the child’s line with Switch, and add Purchase Blocker; add it to each device separately.
5. Remove carrier billing from the child’s Google Play account. On a computer, open payment methods on Google Play, click Edit payment methods, and click Remove under the carrier billing entry. Then set purchase approvals for the child in your Google family group, so paid content has to come through you.
6. Keep the Number Transfer PIN to yourself. Verizon and AT&T issue a Number Transfer PIN only when a number is being moved to a new carrier, and Verizon’s expires after 7 days. Only the new carrier should ever see it; Verizon says it never asks for it.

Verizon Family

Verizon Smart Family is no longer available to add to accounts; Verizon Family is the service now offered. The free tier of Verizon Family includes location sharing and a view of the child’s Verizon call and text activity. The paid tier, Verizon Family Plus, adds usage restrictions, content blocking, screen time management and pausing the internet. Verizon lists Plus at $14.99 a month, or $10 a month with the myPlan perk, after a 30-day free trial that auto-enrols into the paid plan unless cancelled (as listed on 2026-09-29).

• Works without the Companion app: viewing Verizon call and text activity, time restrictions on calls, texts and data, data, text and call limits, and the phone’s network location. These are the Verizon controls a child cannot switch off from the phone.
• Needs the Companion app paired: content filters, web and app activity, pausing the internet, and time restrictions on Wi-Fi.
• Blocked contacts: up to 20 numbers, including international numbers, short codes, and incoming calls shown as Private, Restricted or Unavailable. You cannot block 911, numbers on your own Verizon account, or numbers on the trusted list.
• Trusted contacts: up to 20, who can always call and text, even during time restrictions. Calls from the child’s line to 911 or 988 are always allowed.
• Content filters work by category, and you can add specific websites. Verizon does not notify you when a child tries to open blocked content.

Limits Verizon states itself: blocked contacts are blocked only on calls and SMS/MMS texts, not through RCS messaging or iMessage. Activity from third-party messaging and calling apps is not included in call and text activity. If your home router also filters content, the router’s filters take priority where the two conflict. Apps that run offline do not show up in activity.

T-Mobile FamilyMode

FamilyMode is an app that filters, time-limits and pauses the internet on a child’s phone. One parent must be the T-Mobile Primary Account Holder to sign up, and the child’s phone needs iOS 13 or later, or Android 9 or later.

• Filter levels: High (kid-safe experiences such as the Education category), Medium (most general platforms, with mature and adult content filtered), Low (nearly everything, with explicit content filtered) and None. Individual apps and sites can then be set to Allowed, Not Allowed or Unmanaged.
• Time controls: Bedtime, Off Time and daily Time Limits by platform or category. Changes can take up to five minutes to reach the child’s phone.
• Pause: for the whole family, one member or one device. Pausing a whole Wi-Fi network needs the FamilyMode base station on the home network.
• Deletion protection: on iPhone, Advanced Parental Controls need the child to have their own Apple Account in your Family Sharing group; on Android, the FamilyMode service is switched on under Accessibility on the child’s phone.

Limits T-Mobile states itself: filters “may not block all content you consider objectionable & may not filter some secured (HTTPS) traffic.” Apps that do not need an internet connection, such as games, are not affected by a pause. FamilyMode is not compatible with DIGITS. T-Mobile’s support page does not state a price, so check the current cost before adding it.

AT&T Secure Family

Secure Family pairs a parent app with the AT&T Secure Family Companion app on the child’s phone, and the VPN must be turned on during setup. Filtering starts from one of three levels:

• High blocks content that may not be right for younger children and allows kid-safe content.
• Medium blocks mature or adult-oriented content and allows most general apps; AT&T calls it best for pre-teens.
• Low blocks explicit content and allows almost all apps; AT&T calls it best for teens.
• After choosing a level, each app, site or category can be set to Allow, Block or Always Allow. Always Allow gives access without tracking.
• Safe Search and YouTube Restricted Mode can be switched on from the same filter settings.

Limits AT&T states itself: apps that run on the phone without the internet may not be blocked, including standalone games and videos downloaded before the filters were turned on. AT&T’s filter article does not state a price, so check the current cost with AT&T.

Carrier settings by age

• First phone or watch, under 10: trusted contacts and blocked numbers matter most, along with a purchase block on the line. On Verizon, time restrictions on calls, texts and data work without any app on the child’s device. The first-phone guide covers the handover.
• Ages 10 to 12: add a purchase block and remove carrier billing from Google Play. If you want cellular filtering beyond the phone’s own controls, a carrier app on its High or Medium level is reasonable, provided the device controls stop the child deleting it.
• Ages 13 to 17: number lock and SIM protection are the priority, because account takeover is the teenage risk. Move their important accounts off text-message codes where possible (see two-factor authentication). A carrier filter on Low is a backstop at most; a teenager who wants to get round it can turn off the VPN.

What carrier controls do not do

• Carrier apps do not filter reliably once the VPN is off, the app is removed, or the battery runs low. Pair them with Screen Time or Family Link restrictions rather than relying on them alone.
• Blocked numbers do not cover iMessage, RCS, WhatsApp, Snapchat or any other app-based messaging. Contact rules for those live in each app.
• Purchase blocks do not cover a card saved on the child’s app store account, or checkout inside an app that uses its own billing.
• Number lock does not protect an account whose password has leaked. A password manager and app-based two-factor codes do that job.

For the home-network layer that carrier controls pick up from, see router and DNS filtering. For the wider teenage setup, see the ages 13–17 quick start.