Your phone is no longer primarily a telephone. It is the device that receives your password-reset links, approves your bank logins, stores your photos and knows where you sleep. That concentration is convenient, and it is why the same handset is the single most rewarding target most Americans carry. An attacker who controls your phone number can reset many of your accounts; an attacker who holds your unlocked phone can do much more.
This guide draws on guidance from CISA, the FBI, NIST, Apple, Google and the Electronic Frontier Foundation. It describes documented features and published recommendations rather than hands-on testing of every handset. Menus and defaults differ between models and software versions, so treat the exact setting names below as starting points and check your own device.
Security and privacy are related problems, not the same one
Security is about keeping unauthorized people out: the thief who steals your handset, the criminal who hijacks your phone number, the malicious app that reads your messages. Privacy is about what authorized parties can do with your information: the advertiser that follows you between apps, the data broker that buys your location history, the app developer whose analytics SDK reports more than the app needs.
A phone can be secure and not private — fully patched, locked and encrypted, yet reporting your movements to a dozen companies. It can also be private-ish and insecure, with every tracker disabled but an unpatched browser. The steps below address both, separately, because a single switch that claims to cover everything usually covers neither.
Start with the threats that actually hit Americans
It is easy to spend effort on exotic risks while ignoring common ones. For most people in the US, the realistic list is short: phishing and smishing (fraudulent texts impersonating banks, delivery firms or the IRS), SIM swapping, phone theft, malicious or over-reaching apps, account takeover through reused passwords, and commercial data collection that is legal but unwanted.
SIM swapping deserves special attention because it defeats protections people believe they have. The FBI's Internet Crime Complaint Center warned in 2022 that it received 320 SIM-swapping complaints with adjusted losses of about $12 million across 2018 to 2020 combined — and then 1,611 complaints with losses of about $68 million in 2021 alone. In a SIM swap, a criminal convinces or bribes a carrier into moving your number to their SIM, then uses your incoming calls and texts — including many two-factor codes — to reset your accounts.
FBI IC3 — Criminals Increase SIM Swapping Schemes (PSA, 2022)
The lock screen is the foundation; make it boring and strong
Everything else sits on top of the passcode. Use at least six digits, and prefer a longer numeric or alphanumeric code if you can tolerate it — a four-digit PIN has 10,000 possibilities and is routinely observed over shoulders. Biometrics (Face ID, fingerprint) are a convenience layer over the passcode, not a replacement: after a restart, a timeout or several failed attempts, the phone demands the passcode, which is exactly what you want if someone is compelling you to unlock it.
Modern iPhones and Android phones encrypt stored data by default, and Apple's platform documentation describes how that encryption is tied to the passcode and dedicated hardware. The practical consequence: a strong passcode on an updated phone makes data extraction from a seized or stolen device genuinely hard for anyone, while a weak one makes the encryption largely decorative.
Also reduce what the lock screen shows. Hide notification previews and consider disabling wallet access, smart-home controls and reply-from-lock-screen. Each visible preview is data available to whoever is holding the phone.
Updates are a security feature; so is the support window
Turn on automatic system and app updates and let them install. Security patches fix vulnerabilities that are often already being exploited; the gap between a patch's release and your installing it is your exposure window. Restart the phone occasionally so pending updates finish applying.
The harder decision is at purchase time. A phone that no longer receives security updates is a phone with a permanently growing list of known, unpatched holes. Apple and Google both now publish multi-year support commitments on flagship lines, but budget and older models vary widely. Before buying, check the manufacturer's stated update policy rather than assuming; when your current phone falls out of support, replacing it is a security decision, not a fashion one.
Protect the accounts the phone answers to
Your Apple Account or Google Account can locate, lock and erase your phone — which also means whoever controls that account controls your phone. Give it a unique password stored in a password manager, and turn on multifactor authentication. Then protect the email account used for recovery with the same care, because the reset chain is only as strong as its weakest link.
Choose stronger second factors where offered. NIST's digital identity guidelines treat SMS as a restricted channel: text messages can be intercepted, redirected through SIM swaps and phished. Authenticator apps are better; passkeys and hardware security keys are phishing-resistant and better still. Google offers an Advanced Protection Program for high-risk users that requires hardware keys and tightens account access; it is free and worth considering if you are a journalist, activist, executive or anyone whose account is a specific target.
Defend the phone number itself
Because SIM swapping attacks the carrier rather than the handset, the defenses live with the carrier too. Every major US carrier offers some form of account PIN, port-out lock or number-transfer freeze — the names differ (Verizon's Number Lock, AT&T's Wireless Account Lock and passcode, T-Mobile's Account Takeover Protection), but the function is the same: no number transfer without an additional credential. Enable it on every line on your account, and use a PIN that is not your birthday or the last four of your Social Security number.
CISA's mobile communications guidance, published after US government officials' telecom traffic was compromised, makes two further recommendations worth adopting: use end-to-end encrypted messaging such as Signal instead of SMS for sensitive conversations, and prefer phishing-resistant authentication over codes sent by text. Standard SMS is unencrypted and readable by carriers and anyone who has compromised them; encrypted apps protect content even when the network does not.
One caveat: carrier locks protect against unauthorized transfers, not against every account-takeover path, and an attacker who has already phished your carrier credentials may still cause damage. The lock raises the cost of the attack; it does not abolish it.
Turn on the anti-theft features before you need them
Apple's Stolen Device Protection, introduced for iPhones, requires biometric authentication for sensitive actions — changing the account password, disabling Find My, viewing stored payment details — and imposes a delay on the most critical changes when the phone is away from familiar locations. It exists because thieves were observed watching victims type passcodes in bars, then stealing the phone and locking the owner out of their own Apple Account within minutes. If you have an iPhone, check that it is enabled.
Google announced a parallel set of Android features in 2024: Theft Detection Lock, which uses on-device motion sensing to lock the screen when a grab-and-run pattern is detected; Offline Device Lock, which locks a phone that a thief takes offline; and Remote Lock, which lets you lock the handset from a browser using your phone number. These features roll out by model and software version, so verify which ones your phone actually has rather than assuming the announcement covers your device.
In both ecosystems, know the recovery basics before a theft: how to mark the device lost, where to erase it remotely, and what erasing does to your ability to track it. A phone stolen in the next hour is not the moment to learn the interface.
Treat the app store as your perimeter
Install apps from the Apple App Store or Google Play, and avoid sideloading or third-party stores unless you have a specific, understood reason. Google's Play Protect scans apps for known malicious behavior and is on by default for Play Store devices; check that it has not been disabled. Store review is imperfect — malicious apps do slip through — but it is a filter, and bypassing it removes the filter entirely.
Audit permissions periodically, not just at install time. Android's permission manager and iOS's privacy settings both let you review which apps hold location, microphone, camera, contacts and photo access. Ask of each grant: does this app need this to do the thing I installed it for? A flashlight does not need your contacts. Where offered, choose 'only while using the app' over 'always' for location, and approximate over precise location.
Delete apps you no longer use. Every installed app is code that can request updates, permissions and network access; an abandoned app from an acquired or neglected developer is an avoidable risk. Fewer apps is not just tidier — it is a smaller attack surface.
Privacy: decide what the ad economy gets
Legitimate tracking dwarfs criminal tracking by volume. Apps share identifiers and behavior with advertising and analytics partners, brokers aggregate location data, and the result is a profile that exists regardless of your security settings. On iPhone, App Tracking Transparency forces apps to ask before tracking you across other companies' apps and websites; declining is a reasonable default. On Android, you can delete or reset your advertising ID and limit ad personalization in settings.
Location deserves its own pass. Review which apps hold always-on location, turn off location-history features you do not actively want, and remember that photos carry location metadata unless you strip it — both major platforms let you remove location when sharing an image. For broader context on the connected devices around your phone, see our guide to protecting your privacy when using smart devices.
DailyTech — How to protect your privacy when using smart devices
If you are a specific target, the advice changes
Most readers face opportunistic crime. Journalists, dissidents, executives, public officials and abuse survivors can face targeted ones, and the trade-offs shift. Apple's Lockdown Mode sharply restricts message attachments, link previews, some web technologies and wired connections to shrink the attack surface used by commercial spyware; it makes the phone less capable and that is the point. Google's Advanced Protection Program does comparable work on the account side.
If you believe you are targeted by a well-resourced adversary, generic checklists are not enough. The EFF's Surveillance Self-Defense project walks through building a security plan from your own threat model — who might want your data, what they can do, and what you can realistically change. That planning step matters more than any individual setting, because the right answer depends on who 'they' are.
A realistic one-evening checklist
In order of impact: turn on automatic updates; set a six-digit-or-better passcode; put a unique password and multifactor authentication on your Apple or Google account and your primary email; enable your carrier's port-out or SIM lock; switch second factors from SMS to an authenticator app or passkeys where offered; turn on Stolen Device Protection or Android's theft features; run a permission audit and delete unused apps; decline cross-app tracking and review location access.
That list is deliberately short. Each item addresses a documented attack or collection path, and each can be checked off in minutes. A second evening can cover the deeper work: encrypted messaging for sensitive conversations, lock-screen notification hygiene, and the high-risk measures above if they apply to you.
The honest limits of phone security
No configuration makes a smartphone invulnerable. Zero-day exploits exist against fully patched iPhones and Android phones, and commercial spyware has repeatedly defeated default defenses, which is why Lockdown Mode exists. Carrier locks depend on carrier employees following procedure. Encryption protects data at rest on the device; it does nothing about data you have already shared with apps, brokers and services, which sits on other people's servers under other people's policies.
There is also a genuine usability cost. Longer passcodes are slower. Phishing-resistant authentication is less flexible when you change phones. Lockdown Mode breaks features. The goal is not maximum security at any price — it is a considered trade: strong enough that opportunistic attackers move on, private enough that routine collection is reduced to what you knowingly allow, and convenient enough that you actually keep the settings on.