Some advice:
1. Walang password yung phone, pero pwede mo i device lock yan kung google-supported yung OS ng phone.
2. Kung kabisado nya facebook password nya, napakadali na ilogout yan immediately, may session logout feature sa settings ng Facebook (same sa Google account)
And nakakapagtaka paano na-access yung GCash? kasi sa pagkakaalam ko may security pa before logging in (biometrics or pin). Wag naman sana 1234, 1111 o 0000 yung pin, use strong combinations.
Madalas sa elderly's hindi alam ang available security feature sa device, help them by orienting some authentication methods like 2FA or biometrics (face or fingerprint).
Spamming a stolen device' contact number is a big braindead move, pinepwersa mo yung magnanakaw na idetach yung SIM sa phone, report to authority immediately for tracing progress, sila makakatulong sayo/sainyo hindi kami dito sa community.