Securing Your Smartphone: Plain-English Safety Steps

Your phone holds the keys to almost everything you do online, so a lost, stolen or poorly set up phone can cost you money, privacy and access to your accounts. It receives the codes your bank sends, it stays signed in to your email, and it often stores saved passwords and payment cards. This guide walks you through the settings that matter most on iPhone and Android, in plain English, with no technical background needed. It is written for individuals, families, older people and very small businesses where staff use their own phones. Menus change between phone models and software versions, so if a setting is not exactly where we say, search for its name in your phone's Settings app.

Key takeaways

A strong screen lock comes first. Use a passcode of at least six digits, plus your face or fingerprint for convenience, so a found or stolen phone cannot simply be opened.
Updates fix security holes. Turn on automatic updates and replace a phone once the maker stops sending security updates for it.
Set up theft protection before you need it. Apple's Stolen Device Protection and Android's theft protection features only help if they were switched on before the phone went missing.
Only install apps from the official store. Apps from links in texts or emails are a common way scammers get harmful software onto phones.
Know your emergency steps. If your phone is lost or stolen, lock it remotely, change your main account passwords and call your bank and mobile network quickly.

Why your phone is worth protecting

Most people think of a stolen phone as a lost gadget. The bigger risk is what a thief or scammer can do with it while it is unlocked or once they know your passcode. From one phone they can often:

Read your messages: including the one-time codes that banks and shops send by text to confirm it is you.
Get into your email: and from there reset the passwords for your other accounts. See the Securing Your Email Account Guide.
Use saved passwords and cards: if your phone remembers them and does not ask for your face or fingerprint first.
Lock you out: by changing your Apple Account or Google Account password, which also stops you tracking the phone.

Set it up in 15 minutes

Work through these steps in order. Do them at home, on Wi-Fi, with the phone charging, because an update may start part way through.

Set a passcode of at least six digits. The US Federal Trade Commission (FTC) recommends at least a 6-digit passcode. Avoid birthdays, 123456 or repeated numbers. A longer passcode, or one with letters, is stronger still. On iPhone this is under Face ID & Passcode (or Touch ID & Passcode). On Android look under Security or Screen lock.
Add your face or fingerprint. Some theft protection features need it.
Set the screen to lock quickly. A short auto-lock time (one or two minutes) means a phone left on a café table locks itself.
Turn on automatic updates. The UK National Cyber Security Centre (NCSC) advises installing updates as soon as they arrive and switching on automatic updates so you do not have to remember. On iPhone this is in Settings > General > Software Update. On Android it is usually under Settings > System or Software update, depending on the maker.
Turn on the "find my phone" feature. On iPhone open Settings, tap your name, tap Find My and turn it on. Apple also suggests turning on the Find My network, so the phone can be found when it is offline, and Send Last Location, which reports where it was when the battery ran low. On Android the equivalent is Google's Find Hub.
Switch on theft protection (see the next section).
Secure your main account. Turn on two-step verification for your Apple Account or Google Account. Apple's Stolen Device Protection requires it. See the Two-Factor Authentication for Everyone Guide and the Securing Your Apple ID and Google Account Guide.
Turn on backups. The FTC advises backing up regularly to the cloud or a computer, so your photos and contacts survive if the phone does not. See the Backing Up Personal Data Guide.

Theft protection: switch it on before you need it

Phone thieves sometimes watch you type your passcode, then snatch the phone. Both Apple and Google have added features aimed at exactly this. They must be turned on before the phone is taken.

iPhone: Stolen Device Protection

Stolen Device Protection is available on iOS 17.3 or later. When your iPhone is away from familiar places such as home or work, it asks for your face or fingerprint (with no passcode fallback) before sensitive actions. For the most damaging changes it also adds a security delay of about an hour, followed by a second face or fingerprint check. That gives you time to mark the phone as lost and secure your account.

To turn it on: open Settings, tap Face ID & Passcode (or Touch ID & Passcode), enter your passcode, then tap Stolen Device Protection and switch it on. Apple says you need two-factor authentication on your Apple Account, a passcode, Face ID or Touch ID, Significant Locations turned on in Location Services, and Find My turned on. If you want the extra checks everywhere, not only away from familiar places, set Require Security Delay to Always.

Android: theft protection

On many Android phones you will find these under Settings > Google > All services > Theft protection. Google says support varies by model, and the features are not available on Android Go phones or tablets. You need a screen lock set first.

Theft Detection Lock: uses the phone's motion sensors to spot a grab-and-run snatch and locks the screen automatically. If the setting is greyed out, your phone does not support it.
Offline Device Lock: locks the screen if the phone is taken offline and used for a short time, a common thief trick to stop it being tracked.
Remote Lock: lets you lock a lost phone from android.com/lock using just your verified phone number, which helps if you cannot remember your Google password in a panic. You can add a security question for extra protection.

What you want	iPhone setting	Android setting
Strong screen lock	Face ID & Passcode (or Touch ID & Passcode)	Security or Screen lock
Automatic updates	General > Software Update	System or Software update (varies by maker)
Find, lock or erase a lost phone	Find My (plus Find My network and Send Last Location)	Find Hub, and Remote Lock at android.com/lock
Protection if a thief knows your passcode	Stolen Device Protection	Theft Detection Lock and Offline Device Lock
Harmful app scanning	Built in to the App Store review process	Google Play Protect: Scan apps with Play Protect

Apps, links and messages

Many phone scams arrive as a text message, a WhatsApp message or a social media post asking you to tap a link or install an app. A few simple habits stop most of them.

Use the official app store: the App Store on iPhone, Google Play on Android. Do not install apps from links in messages, even if the message seems to come from your bank, a parcel company or a family member.
Keep Google Play Protect on: it checks apps for harmful behaviour and can warn you about, disable or remove them. Google says it is on by default. To check, open the Play Store, tap your profile picture, tap Play Protect, then Settings, and make sure Scan apps with Play Protect is on.
Check app permissions: a torch app does not need your contacts or your location. If an app asks for something it does not need, say no or delete the app. Android can remove permissions from apps you have not used for a while.
Be wary of urgent messages: "your parcel is held", "your account is locked" and "Mum, I've lost my phone, can you send money" are all common. Contact the organisation or person another way before you act. See the How to Spot a Phishing Email Guide.
Never share a code: no genuine bank, mobile network or tech company will ask you to read out a code sent to your phone. If someone does, it is a scam.

Keep it up to date, and know when to replace it

Updates are the single easiest thing you can do. They fix security holes that criminals already know about. The NCSC also warns that once a manufacturer stops providing updates for a model, it no longer gets security fixes and becomes less secure.

Check before you buy: the NCSC advises checking whether a phone will still be supported before buying it, especially second-hand or older models.
Replace an unsupported phone: if your phone says no updates are available but you know newer versions exist, it may have reached end of support. Consider replacing it, or at least do not use it for banking.
Update apps too: turn on automatic app updates in the App Store or Play Store.

Signs something is wrong

Most phones are never hacked, but these signs are worth checking:

Your phone suddenly shows "No service" in an area where it normally works. This can be a sign someone has moved your number to their own SIM card. Call your mobile network from another phone straight away. See the SIM Swap Fraud Guide.
You get messages about password changes, new sign-ins or new devices you did not make.
Apps appear that you did not install, or your phone asks for permissions you did not expect.
Friends say they received strange messages from you.
Your bank reports payments you did not make.

What to do if your phone is lost or stolen

Act quickly and in this order. Do as much as you can from a computer or a borrowed phone.

Locate, lock and mark it as lost: sign in to Find My (iPhone) or Find Hub (Android) from another device. On Android you can also lock it at android.com/lock with your phone number. Lost Mode on iPhone locks the phone and lets you show a contact number on the screen.
Call your mobile network: ask them to block your SIM so nobody can receive your texts or make calls on your account.
Call your bank: especially if you use banking apps or have cards in your phone wallet.
Change your main passwords: start with your Apple Account or Google Account, then your email. Sign out of all devices where the service offers it.
Erase it if you will not get it back: both Find My and Find Hub can erase a phone remotely. Only do this once you are sure, because you may lose the ability to track it.
Report it: report the theft to the police and get a crime reference number for your insurer.

Common failure patterns

Typing your passcode in public: thieves watch over shoulders on buses and in bars, then take the phone. Use face or fingerprint unlock in public and cover the screen when you must type the code.
Turning on theft protection too late: Stolen Device Protection and Android theft protection cannot be switched on once the phone has gone.
Using an old phone that no longer gets updates: it may still work fine but is open to security holes that will never be fixed.
Installing an app because a message said so: fake delivery, banking and "security" apps are a common scam route.
No backup: people lose years of photos because the phone was the only copy.
Same password everywhere: if your phone's main account uses a password you also use elsewhere, one leak can open everything. See the Password Managers Explained for Everyone Guide.

Where to get help

UK, report fraud or cyber crime: Report Fraud covers England, Wales and Northern Ireland, phone 0300 123 2040. In Scotland, call Police Scotland on 101.
UK, practical advice: the NCSC's guidance on software updates, part of its top tips for staying secure online.
US: the FTC's advice on protecting your phone.
Your phone maker: Apple Support and Google's Android Help have current steps for your model.

For organisations managing staff phones, see the Mobile Device Security Guide.

Practitioner checklist

Set a passcode of at least six digits and add face or fingerprint unlock.
Set the screen to lock after one or two minutes.
Turn on automatic updates for the phone and for apps.
Turn on Find My (iPhone) or Find Hub (Android).
Turn on Stolen Device Protection (iPhone) or Theft Detection Lock, Offline Device Lock and Remote Lock (Android).
Turn on two-step verification for your Apple Account or Google Account.
Check Google Play Protect is on (Android) and only install apps from the official store.
Turn on backups and check one has actually completed.
Write down your mobile network's and bank's phone numbers somewhere other than your phone.
Check once a year whether your phone still gets security updates.

Securing Your Smartphone Guide: Plain-English Steps to Stay Safe