Allow list their phone number to only allow numbers they know to call/communicate with them.

Restrict websites to a few domains on the devices they use. Youtube, wsj, etc...

If they want a new one just tell them to ask you.

It sucks and has problems, but its the only real straightforward and viable option I've seen work.

Source: have grandparents who were regularly getting scammed or close to being scammed on a weekly basis.