Who Gets the Six Digits? What Twenty UK Apps Still Don’t Understand About Caring

Caring for a parent or disabled relative is not a niche hobby. It is a second job made of meter readings, repeat prescriptions, bank transfers and the small administrative panic of finding out that the council tax login lives in an old email account nobody has opened since 2019. As of November 2026, most of us do this with a phone in one hand and somebody else’s date of birth in the other.

At 124apps, we wanted to test the everyday version of this, not the formal legal version. So we took twenty UK apps across banking, NHS services, energy, council tax, pharmacy and supermarket delivery, and put them through a carer’s audit. The question was not “can I get power of attorney?” It was simpler: can I help someone use their own account without becoming them?

The test: help, not takeover

We used two phones, one older relative, a notebook and a growing sense of dread. We looked for four things: trusted contacts that actually do something, read-only or scoped access, family or household sharing, and a clean handover if the cared-for person wants to switch help from one relative to another. We did not count a branch appointment as an app feature, though we noted when it was the only route.

The apps were a mix of the famous and the unavoidable: high-street and app-only banks, the NHS App, energy suppliers, a council tax portal, online pharmacy repeat ordering, and supermarket delivery accounts. We did not test formal attorney access, court orders or specialist disability software. This was the everyday stuff — the apps people already have on their phones when they ask a daughter, son or neighbour for help.

A trusted contact is not a trusted login

Banks talk a good game about trusted contacts. In practice, most of those features are for safeguarding or bereavement, not for helping someone pay a gas bill. One high-street banking app let us nominate a trusted contact, but the contact could not see balances, set up payments or do anything useful on a Tuesday afternoon. It was a phone number for the bank to ring if something looked wrong. Useful, yes. A carer’s login, no.

The better banking routes existed, but they were heavy. Attorney access or third-party mandates often meant paperwork, a branch visit or a phone call with a hold time long enough to rethink the whole family tree. Read-only access inside the consumer app was rare. In our twenty-app sample, only three gave us a genuinely scoped delegated route from inside the app. Five more offered a phone or branch process. The remaining twelve had no formal route at all.

The NHS App is the closest thing to a good model

The NHS App is not perfect, but it is the one place where the idea of linked profiles feels normal rather than bolted on. Where a GP practice has enabled proxy access, you can switch between profiles and see the right records for the right person. That is the model: separate identity, clear context, no shared password, and a visible trail of who is looking at what.

The catch is the setup. Proxy access for an adult relative depends on consent and on the GP practice actually switching it on. Sometimes it works smoothly. Sometimes you are told to ring the surgery, fill in a form, or wait for a letter. When it works, it is quietly excellent. When it does not, you are back to reading out a one-time code while your parent tries to find their glasses.

Energy, council and pharmacy: the password-sharing economy

This is where the audit got gloomy. Energy apps generally assume one account holder and one login. Some let you add another person, but often that means full access, not a careful “can view bills and submit readings” permission. Council tax portals are even more rigid: one account per property, one login, and a form buried somewhere if you want to authorise someone else. Pharmacy repeat-order apps are friendly until you realise that ordering for someone else usually means logging in as them. Supermarket delivery accounts are the same. There is no “household helper” switch.

In twelve of the twenty apps, there was no formal delegated access we could find in the app itself. In eight of those, the practical answer was to share the password and hope the two-factor code arrived on the right phone. That is not a feature. It is a small security incident waiting for a convenient moment.

The second-code problem

Two-factor authentication is good. Two-factor authentication pointed at somebody else’s phone is a daily obstacle course. If the code goes to your relative’s mobile and you are three counties away, you are stuck. If it goes to their email, you may also need their email password. If they use an authenticator app, moving it to your phone is either impossible or a bad idea. Recovery codes help, but they are easy to lose and awkward to store safely.

We tried the respectable workarounds: a password manager with emergency access, a shared note stored securely, a paper list kept in a drawer that we will not describe in detail. They work, but they are scaffolding around a product that was designed for a single person living a single, uninterrupted life.

What a carer’s login should look like

It should be boring. A scoped invitation, sent from the account holder, that lets a named helper view bills, order repeats, check appointments or download a statement — but not move money or change the account holder’s details. It should expire. It should be revocable. It should show up in an activity log. It should not require a branch visit, a fax, or a password written on the back of an envelope.

The NHS linked-profile model is close. Some banking attorney routes are close, but they are too formal for everyday help. Energy and council apps could copy the same idea tomorrow: helper access, read-only by default, with a clear audit trail.

The tally, and the point

Of the twenty apps we tested, three offered a genuinely scoped delegated route inside the app. Five offered a phone or branch process. Twelve had no formal route beyond sharing credentials. Read-only access was rare. Family sharing was mostly marketing language for “buy another subscription”. Clean handover — where another trusted person can take over without being told a password — was rarer still.

None of this is exotic. Britain is an ageing country, and plenty of disabled adults rely on relatives for admin. Apps that assume you live alone are not neutral; they push risk into the household. The fix is not a lecture about password hygiene. It is a proper helper mode, designed for the way people actually live. Until then, keep the phone charged, keep the recovery codes safe, and keep asking banks, councils and energy suppliers the only question that matters: who gets the six digits when I am not in the room?