In practice this will not work - assuming you only have a single email address for 'mom', it then will prompt you to unlock your phone, then show a confirmation

In practice this will not work - assuming you only have a single email address for 'mom', it then will prompt you to unlock your phone, then show a confirmation screen with a send button on it. There are way too many interaction steps required by the device owner to make this specific one a feasible attack.