Usually, cheat codes are like easter eggs. They are usually enabled when the user performs a series of unusual actions in a situation where the UI doesn't seem to expect any action from them. The typical examples from the console-area of games are:
- start screen
- loading screen
- when the game is paused
It is important to choose a situation where the user has no reason to perform any input, because otherwise they might enable the cheat-code by accident. In the context of a game where the only input is a touchscreen, you could have input elements which don't look like input elements (like decorative graphics or text labels) and have the user perform unusual actions on them (draw specific shapes, tab them in a specific order, etc.). You could also combine this with other input methods your game doesn't utilize in other ways. When your game runs on mobile phones equipped with accelerometers, and your game doesn't use them as an input method otherwise, you could for example enable a cheatcode by shaking the phone while holding a button (which doesn't look like a button).