- in iOS -> Settings -> Messages, enable "Filter Unknown Senders." Go through recent SMSes/iMessages and create contacts for short codes and numbers that he has communicated with.
This option won't block the messages, but it'll make them harder to find and make their links much harder to click on (AFAIK it's impossible unless he copies and pastes the URL or creates a contact for the sender).
- install uBlock Origin, which makes it much harder to reach the phishing scam sites that back a lot of these campaigns. They're often hosted on sites that are on malware filter lists. In uBO, enable all optional malware filter lists.
On iOS, do the same using AdGuard.
- in addition to the malware detection mentioned by others, consider enabling Google "Enhanced Safe Browsing": https://support.google.com/accounts/answer/11577602?hl=en
- for phone calls, install his carrier's robocall/fraud detection and blocking app. For AT&T, it's "ActiveArmor" (https://www.att.com/security/). If he has a landline, pay for caller ID and consider a phone that speaks the caller's ID (example: AT&T TL96273).
- depending on how his bills are paid: only put a small amount of money (a month or two of expenses) in accounts that are accessible without physically visiting a bank branch. If an account has no online access, no checks (nothing to read the account number off of), and no debit card, at least the maximum possible damage from a scam is limited. Either visit a branch one a month to transfer money or use a credit card for expenses.