TrustLine
Protecting older adults from phone scams — by putting the people they already trust inside the phone with them.
- Client
- TrustLine
- Role
- Product Design + Prototyping
- Platform
- iOS · SwiftUI
- Year
- 2025
The problem
Everyday,olderadultsansweracallfromsomeoneclaimingtobetheirbank,theirgovernment,theirinsurer.Thescamworksbecausetrustisthedefaultresponse—andbythetimefamilyfindsout,themoneyisalreadygone.
The approach
A call or message arrives wearing a trusted name — a bank's fraud team, a government office, a familiar-sounding company.
The pressure
Urgency does the work. An account at risk, a fine to settle, a window closing. There's no time to check with anyone.
The loss
Details are handed over willingly. Nothing looks like an attack, so nothing gets questioned — and no one else ever sees it happen.
Understanding older adults
What we learnedabout our users.
Before we designed anything, we needed to understand the people who would use it. The short version: being polite and trusting is exactly what scammers count on.
They were raised to be polite
Hanging up on someone who sounds official feels rude. So they stay on the call far longer than a younger person would, and the scammer gets all the time they need.
Big savings, little confidence
Their life savings sit behind apps nobody ever taught them to use. When they aren't sure what to do, they go along with whoever sounds most confident.
Accessibility isn't optional here
Weaker eyesight, shaky hands and slower reading are normal in this group, not edge cases. Every screen has to work for that from day one.
They don't want to be babysat
Anything that feels like being watched or managed gets switched off. Protection has to work without making someone feel treated like a child.
Family is who they ask
They already check with a daughter, a son or a nephew when something feels off. The problem is that person usually isn't around at the moment it matters.
Nobody talks about it afterwards
People are embarrassed to admit they were tricked, so they tell no one. That silence is why the same scam works on them a second and third time.
So we checked every feature against one question: does this make someone feel less capable?
User research
What we learned by watchingpeople struggle.
Interviews
Older adults and the family members who look out for them.
Accessibility audit
The existing build measured against WCAG and Apple's HIG.
Scam-pattern review
How real impersonation attempts open, escalate and close.
Competitive teardown
Why existing safety apps get installed, then abandoned.
Guided walkthroughs
Watching people attempt core tasks, unassisted.
What it told us
- 01
People couldn't tell a real contact from a convincing impostor.
So weIdentity became visual instead of textual — a large photo and a relationship, never a number to interpret.
- 02
Nobody wanted to be monitored.
So weOversight was reframed as a conversation with family, not a dashboard pointed at them.
- 03
Typing was the single biggest point of abandonment.
So weAnything can be spoken instead — transcribed on device, then sent as an ordinary message.
- 04
The moment of doubt had nowhere to go.
So weDoubt got a one-tap destination: a trusted person, reachable inside the same chat.
Design goals
Four rules we refusedto break.
Written before any interface existed, so that later trade-offs had something to be measured against.
Make safety invisible
Protection that announces itself creates anxiety. Every safeguard had to work quietly in the background and only surface when it genuinely helps.
Protect independence
No screen may imply that someone is being managed. The user stays the one taking action; family sits alongside, never above.
One decision per screen
Confusion is the attack surface. Strip each screen to a single obvious action, in plain language, with nothing to learn.
Give doubt a destination
The instinct to check with someone is the strongest defence there is. It had to be one tap away, at the exact moment it's felt.
UX strategy
Hide the system behinda conversation.
Five moves that turned a set of safety features into something that behaves like an ordinary phone.
- 01
Make the conversation the spine
Rather than menus, settings and dashboards, everything happens in a chat — the one interface this audience already trusts and never has to learn.
- 02
Put the trusted circle in the phone
Family aren't a setting buried three levels down. They're the first thing on the home screen, as faces and relationships, ready before anything goes wrong.
- 03
Let oversight happen in the open
Trusted contacts can see call and message activity — but the user sees exactly what they see. Transparency in both directions is what stops it feeling like surveillance.
- 04
Escalate gently, never alarm
Suspicion is handled as a quiet check-in, then an offer to loop someone in. No red warnings, no fraud jargon, no implication that a mistake was made.
- 05
Prototype before building
Static frames can't tell you whether a flow feels calm. We built interactive prototypes to walk the journeys and tune the motion before a line of SwiftUI was written.
User journey
A permission system nobodyhas to understand.
Adding a contact or a website is a guarded action. The user never sees an approval flow — only a conversation with a status.
One plain choice per row.
A new number, a new website, an unfamiliar app. Instead of a block screen or a warning, the user gets an ordinary set of options in a familiar sheet — each one a full-width tap target, each one worded as a request rather than a permission.
Ask in plain words
No permissions language, no risk score. A short native form, one field at a time, phrased the way a person would actually ask.
Family takes a look
The request appears back in chat as a status card — “Caleb is having a look.” The wait is legible, so nothing feels broken or ignored.
Approved, right inline
Confirmation lands in the same thread. The whole review loop happened without the user ever leaving the conversation, or meeting an approval system.
- Ask in plain words
- Family takes a look
- Approved, right inline
The full loop, end to end
Ask in plain words
Family takes a look
Approved, right inline
UI showcase
Small moves, bigdifference.
Four interface decisions where the goals stopped being abstract.
Faces, not phone numbers.
The home screen leads with large circular photos and a relationship — “Andrew · Husband” — instead of a name and a number to interpret. Recognising a face costs nothing, and the oversized tiles double as generous tap targets.
Identity is the first line of defence. Make it visual and it stops being a decision.
Speak instead of type.
Typing is a genuine barrier for unsteady hands and tired eyes, and it was the biggest drop-off we saw. Any message can now be spoken, transcribed on device, and sent as ordinary text — with Chat, Voice, Audio and Video kept as four equal, oversized choices.
The fastest accessibility win was removing the keyboard from the critical path.
A gentle check on how things feel.
Occasionally, mid-conversation, the app quietly asks how a chat is making the user feel — five plain emoji, no scoring, no jargon. If something feels wrong, it offers to let a trusted contact know: a dignified hand-off rather than an alert.
This is where doubt gets its destination. One tap, no accusation, no report.
Unmistakably iOS.
Calls, sheets and navigation follow Apple's patterns to the letter, so nothing feels foreign or bolted on. Big controls, strong contrast, destructive actions reserved for red — a phone that behaves exactly the way its user already expects it to.
Familiarity is a safety feature. Novelty is where hesitation comes from.
Design system
Consistency you feelmore than notice.
Accessibility-first
Oversized tap targets, AA-plus contrast and a generous type scale — set for reduced vision, dexterity and cognitive load by default, not as an option.
Native iOS patterns
SF Symbols, system sheets with grab handles, Cancel/Done bars and standard navigation, so it reads as part of the phone rather than an app on top of it.
A calm visual system
One soft blue, plenty of white space, friendly rounded forms, and red reserved strictly for destructive actions. Reassuring, never alarming.
One consistent kit
A single chat component, one big-avatar pattern and shared sheets — reused across the user, support and caregiver surfaces so nothing has to be relearned.
Colour
- Paper#FFFFFF
- Ink#1A1A1A
- TrustLine blue#0284C7
- Deep blue · text#0369A1
- Destructive#DC2626
Type scale
- DisplayAndrew
- TitleTrusted contacts
- Body · 17pt minHow does this chat make you feel?
- Label · monoHUSBAND
Non-negotiables
- Minimum tap target
- 56 × 56 pt
- Body text floor
- 17 pt
- Contrast target
- AA+ (4.5:1 body)
- Primary actions per screen
- One
The same kit, across every surface
Contact info and shared groups
In-app camera
AI speech-to-text composer
Splash screen
The final experience
Three surfaces.One conversation.
Messaging, support and family oversight all resolve into the same interface — so the product only ever asks its user to do one thing they already know how to do.
Texting the people you love.
Trusted contacts, plain message bubbles, a big microphone button. Exactly the messaging everyone already knows — nothing new to learn, nothing to get wrong.
Help in the same thread.
Need a hand? Support lives inside the very same chat. No help centre, no tickets, no hunting through settings — you just ask, the way you'd ask a person.
Family, one message away.
Approvals, nudges and check-ins from a trusted relative all arrive as familiar chat cards. The protective machinery stays completely behind the conversation.
The outcome
From static frames to a feelingpeople can trust.
TrustLine became a coherent, accessible, unmistakably-iOS system — one where complex safety quietly disappears behind a conversation. Designed, prototyped interactively, and handed off ready to build.
0
Core screens designed
Every state of the user, support and caregiver experience, specified and exported for build.
0
Surfaces unified
User, support and family oversight collapsed into a single chat pattern with one shared component kit.
0
Pattern carrying the product
The conversation. Everything else — requests, approvals, check-ins, help — resolves into it.
AA+
Contrast, throughout
Type scale, tap targets and colour all set against accessibility floors rather than aesthetics first.
What we took away
Protecting someone and respecting them are the same design problem.
Every safeguard that felt like supervision got rejected in testing — and every one that felt like a conversation got used. Designing for vulnerable users isn't about adding guardrails; it's about making the safest path also the most obvious and the least demeaning one.