The smartphone has become the centre of our digital lives: it holds email, chats, photos, the banking app, verification codes and often identity documents too. If someone unlocks it, they hold almost everything. The settings below apply, with slightly different names, to both Android and iPhone, and take only a few minutes.
The screen lock is the first defence
Choose a strong code
A four-digit PIN or a simple pattern is easy to guess, even just by looking at smudges on the screen or glancing over your shoulder. A PIN of at least six non-obvious digits, or an alphanumeric password, is better. Avoid birthdays, sequences like 123456 and repetitions.
Use biometrics sensibly
Fingerprint and face recognition are convenient and make a long code more bearable, because you type it rarely. Remember, though, that the code remains the real key: the phone asks for it after a restart or after several failed attempts.
Shorten the auto-lock time
Set the screen to turn off after thirty seconds or a minute. A phone left on a table and still unlocked is an invitation.
Lock-screen notifications
By default many phones show message previews even when locked. That means anyone holding the phone can read a verification code arriving by SMS or a private message. In the notification settings, choose to show content only when the phone is unlocked, at least for messages, email and banking apps.
App permissions
Every app asks for access to resources: location, camera, microphone, contacts, photos. Many permissions are granted in a hurry the first time an app opens and then forgotten. Every so often open the privacy and permissions section and check:
- which apps access your location, and whether they can do so always or only while in use;
- which apps have access to the microphone and camera;
- which apps can read contacts, SMS or photos;
- which apps hold accessibility permissions on Android: these are very powerful, because they allow reading the screen and acting on your behalf, and they are often abused by malicious apps.
A torch app doesn't need your contacts. A game doesn't need your text messages.
Install apps only from official sources
Official stores aren't perfect, but they apply checks. Apps downloaded from outside websites, links received in chats or pages promising free versions of paid apps are a frequent malware vector, especially on Android. Leave the option allowing installs from unknown sources turned off. Before installing a little-known app, look at the developer, recent reviews and the permissions it requests.
Turn on device location
Both Android and iPhone offer a feature to locate the phone, make it ring, lock it and erase it remotely. It must be turned on before you need it, and you should know which account controls it. On iPhone, also consider Stolen Device Protection, which requires biometrics for certain sensitive actions when you're away from familiar locations.
SIM PIN
The SIM card has its own PIN, separate from the phone's. If you enable it, a thief can't put your SIM into another device to receive your texts and calls. Change the default PIN printed on the operator's card and keep the PUK code somewhere safe.
Encryption and backup
Modern phones are encrypted by default once a lock code is set. This protects your data if the phone is lost. Also turn on automatic backup through the manufacturer's account, so that a theft doesn't mean losing photos and chats.
Bluetooth, NFC and sharing
There's no need to keep them off all the time, but it's worth limiting visibility: set quick file sharing (AirDrop or the Android equivalent) to "contacts only" or turn it on only when you need it. That way you avoid receiving files or requests from strangers in crowded places.
A realistic example
A phone is stolen from a café table. If the screen was unlocked and notifications show previews, the thief can read SMS codes and start resetting your email password. With a quick auto-lock, hidden notifications, a SIM PIN and location turned on, the phone becomes something to resell, not a key to your accounts. You then sign in from another device, lock it remotely and inform your mobile operator.
Periodic check
| Setting | What to check |
|---|---|
| Screen lock | Code of at least 6 digits, locks within 1 minute |
| Notifications | Content hidden when locked |
| Permissions | Location, microphone, accessibility |
| Installs | Official stores only |
| Device location | On and tied to a protected account |
| SIM PIN | On and changed from the default |
In short
- A strong lock code and a quick auto-lock are the foundation.
- Hide notification content while the phone is locked.
- Review permissions regularly, especially location, microphone and accessibility.
- Install apps only from official stores.
- Turn on remote location and the SIM PIN before you need them.