Your phone holds your email, your bank app, your photos, and the codes that reset every other password you own. Most people know they should “secure it” and never do, because the advice online is either vague or written for IT departments. This is the version you can actually finish, in about twenty minutes, on the phone in your hand.
Quick answer
Four things block the overwhelming majority of real-world attacks: a proper screen lock, two-factor authentication on your main accounts, installing updates when they appear, and only installing apps from the official store.
Everything else in this guide is worth doing, but if you only have ten minutes, do those four and stop.
Is this you?
You just lost your phone, or nearly did, and realised how much is on it.
You got a “suspicious sign-in” email and you are not sure whether to worry.
Someone told you to secure your phone and you do not know where to start.
On this page
Start with the four settings that stop most attacks
Phone security sounds like it should be complicated. In practice, the same small handful of gaps show up again and again, and closing them takes minutes. Here is the whole set before we go through it, so you know how short the list is.
1. Lock screen
Stops physical access
2. Two-factor
Stops remote access
3. Updates
Closes known holes
4. Official store
Keeps bad apps out
Set a real screen lock
A PIN, password, or biometric unlock. Add a short auto-lock time, because a lock that only engages after five minutes protects nothing when your phone is sitting on a table.
Turn on two-factor authentication
Start with the account your phone is built around, your Apple Account or Google Account, then your email and your bank. This is the step that makes a stolen password useless on its own.
Install updates when they appear
Security updates exist because a specific hole was found and fixed. Delaying them leaves a hole that is now publicly documented. Turn on automatic updates and stop thinking about it.
Lock your SIM
The one people miss. Without a SIM PIN, somebody can move your number to another phone and start receiving your verification codes.
Those four take care of the phone itself. The next part is where most people are actually exposed.
Your accounts are the real target, not your phone
It is tempting to think of security as protecting a device. Attackers rarely want your device. They want the accounts it signs into, and those accounts live on servers you do not control. Someone who learns your email password does not need your phone at all.
Protecting the phone but reusing one password everywhere is locking the door and leaving the key under the mat.
The fix is unglamorous: a different password for every account that matters, long enough to be awkward, stored in a password manager rather than your memory. You do not need to invent them yourself, and you do not need to remember them.
Tip: You do not have to think one up. Every major password manager has a built in generator, so let it create the password and save it in the same step. That way you never have to type it or remember it.
Change the important ones first: email, then banking, then anything holding payment details. Your email is the master key, because almost every other account resets through it.
Where you install apps from matters more than which antivirus you pick
Most phone malware arrives the same way: the person installed it themselves, usually from outside the official store, often because something promised a paid app for free.
Do
Install from the official App Store or Play Store, check who the developer is, and glance at when it was last updated.
Don’t
Sideload APK files from download sites, or install a “modded” or “cracked” version of a paid app. That is the single most common route to a compromised phone.
Being in an official store is not a guarantee, so it is worth a periodic look at what your installed apps are actually allowed to do. A torch app asking for your contacts and microphone is telling you something.
Not sure if a permission is normal? Run the app through our free App Permission Risk Checker, which explains in plain language whether a request is expected or a red flag.
What about antivirus apps?
This is where older advice, including the earlier version of this guide, has aged badly. The honest position in 2026 is narrower than “install a good antivirus”.
Note: On iPhone, apps cannot scan other apps, so an iOS “antivirus” cannot do what the name implies. On Android, Google Play Protect already scans apps on the device and is built in. Many third-party “security” or “cleaner” apps in the stores are low value, and some are harmful. If you install one, prefer a mobile version of a security company you already use, and treat unfamiliar names with suspicion.
Public WiFi: what actually goes wrong
Cafe WiFi has a scarier reputation than it deserves, but the caution is not baseless. Most traffic today is encrypted between you and the site, so someone on the same network cannot simply read your banking session. What they can do is see which services you connect to, and set up a lookalike network hoping you join it and type something into a fake page.
Do you actually need a VPN?
If you use public WiFi occasionally: probably not. Avoid networks you cannot verify, and do sensitive things on mobile data instead.
If you are on hotel and airport WiFi constantly: a reputable paid VPN is reasonable, mostly for privacy from the network operator.
Either way: avoid free VPN apps. You are handing all your traffic to a company whose business model you cannot see. If you want a starting point, we looked at one paid option in our FastestVPN review.
Back up now, not after something happens
Every other step here is about keeping people out. Backups are about what happens when something goes wrong anyway: the phone is stolen, dropped, or locked by someone else. Without a backup, that is not an inconvenience, it is losing your photos permanently.
A backup you can rely on
✓ Turn on the built-in cloud backup (iCloud or Google), and check it says it ran recently.
✓ Confirm photos are included, since that is what people miss most.
✓ If you back up to a computer, use the encrypted option so the backup itself is protected.
✓ Know how to wipe the phone remotely, and make sure that feature is switched on.
Four habits that quietly make your phone less safe
These are not dramatic mistakes. They are ordinary decisions that remove protections you were relying on without noticing.
Rooting or jailbreaking. It deliberately removes the boundaries the operating system uses to keep apps apart. Unless you know exactly why you need it, the trade is bad.
Leaving Bluetooth discoverable. Pairing mode is for pairing. Leaving it advertising to every device nearby serves no purpose once your headphones are connected.
Reusing one password everywhere. One breach at one forgotten service then unlocks your email. This is how most account takeovers actually begin.
Handing over an unlocked phone. Most real monitoring starts with a few minutes of physical access, not clever hacking. Be deliberate about who holds your unlocked phone and for how long.
Android and iPhone: what is different
Most of this guide applies to both, but the two platforms fail in different places, so the emphasis changes.
Already think someone has access?
Everything above is prevention, which is a different job from finding out whether somebody is already reading your messages. If that is your actual worry, this guide is the wrong one, and there are specific places to look rather than general habits to adopt.
Start here instead
Our guide on how to tell if someone is monitoring your phone or WhatsApp walks through linked devices, admin and accessibility access, and account sessions, and covers what to do safely if you find something.
One more area worth a thought once the basics are done: the apps and services you hand data to on purpose. If you use AI tools, it is worth understanding what those tools do with what you type into them, because no amount of phone security covers information you volunteered.
The bottom line
You do not need to become a security expert, and you do not need to buy anything. A real screen lock, two-factor authentication on your main accounts, prompt updates, official-store apps only, and a working backup will put you ahead of almost everyone. Do those, then stop worrying about it.
Do one thing before you close this page
Turn on two-factor authentication for your main email account. It is the single highest-value five minutes in this guide, because your email resets everything else.
Sources and references
Settings and menu names change between versions and phone brands. These are the official pages to confirm current steps on your own device.
- Set screen lock on an Android device (Android Help)
- Turn on 2-Step Verification (Google Account Help)
- Use Google Play Protect (Google Play Help)
- Two-factor authentication for Apple Account (Apple Support)
- About encrypted backups on iPhone (Apple Support)
- Device security guidance (UK National Cyber Security Centre)
What is the single most important thing to do first?
Turn on two-factor authentication for your main email account. Email is the master key, because nearly every other account can be reset through it. A screen lock is a close second, since it is what protects you if the phone is physically taken.
Do I need to install an antivirus app on my phone?
For most people, no. On iPhone, apps cannot scan other apps, so an iOS antivirus cannot do what the name suggests. On Android, Google Play Protect is built in and already scans apps on the device. Many third-party security and cleaner apps add little, and some are harmful.
Is public WiFi actually dangerous?
Less than its reputation suggests, because most traffic is encrypted between you and the site. The realistic risks are a lookalike network set up to capture what you type, and the network operator seeing which services you connect to. Avoid networks you cannot verify, and use mobile data for anything sensitive.
Why should I lock my SIM card?
Without a SIM PIN, somebody who takes your phone can move your number into another device and start receiving your verification codes. That undermines any two-factor setup that sends codes by text, which is why it is worth the one minute it takes.
Are free VPN apps safe to use?
Treat them with caution. A VPN routes all your traffic through the provider, so you are trusting that company completely. If a free app has no visible way of making money from subscriptions, it is reasonable to ask how it is funded instead.
How often should I redo these checks?
The one-off settings, such as the screen lock, SIM PIN, and two-factor authentication, stay done. Worth revisiting every few months: which apps hold sensitive permissions, which devices are signed into your account, and whether your backup actually ran recently.
