The Complete Smartphone Security Checklist

Your Phone Knows Everything About You

Think about what's on your smartphone right now: your bank and payment apps, your email, years of photos, your location history, your contacts, your messages. For most people, their phone is the single device that holds the most sensitive information about their lives.

Losing your phone — or having it compromised — is a major security event. Running through this checklist takes about 30 minutes and dramatically reduces your risk.

Screen Lock: Your First Line of Defense

A screen lock prevents physical access to your phone if it's lost or stolen. But not all screen locks are equal:

• Use a PIN of at least 6 digits or a strong alphanumeric passcode
• Avoid 4-digit PINs — they have only 10,000 combinations
• Avoid pattern locks — researchers have shown they can often be guessed from smudge marks on the screen
• Biometrics are convenient but have limits — face unlock and fingerprint are fast, but in some jurisdictions, law enforcement can legally compel biometric unlocking while a PIN/password is protected
• Set the screen to auto-lock within 30 seconds of inactivity

On iOS: Settings > Face ID & Passcode On Android: Settings > Security > Screen Lock

Keep Your OS and Apps Updated

Operating system updates contain critical security patches. Delaying them leaves known vulnerabilities open:

• Enable automatic updates for the OS
• Enable automatic app updates — or check the app store weekly
• Delete apps you no longer use — they're an attack surface even when idle

For iOS, updates are pushed directly from Apple. For Android, update availability depends on your device manufacturer and carrier, which is one reason older Android devices become security risks over time.

Review App Permissions

Apps frequently request more permissions than they need. An app's permissions define what it can access on your device:

• Location — Does a flashlight app need your location? Deny it.
• Contacts — Many apps harvest your contact list for marketing
• Microphone and Camera — Grant only to apps that have obvious need
• Background App Refresh — Lets apps run and collect data when you're not using them

On iOS: Settings > Privacy & Security — review each category On Android: Settings > Apps > [App Name] > Permissions

Revoke permissions that don't make sense. If an app stops working after you revoke unnecessary permissions, that tells you something about what it was doing with them.

Enable Full-Disk Encryption

Encryption protects your data if your device is physically accessed or stolen:

• iPhones are encrypted by default as long as you have a passcode set
• Modern Android devices (Android 10+) are encrypted by default
• If you have an older Android device, check: Settings > Security > Encryption

Encryption means that even if someone removes your phone's storage chip, they cannot read your data without your passcode.

Use Find My Device and Remote Wipe

If your phone is lost or stolen, you need the ability to locate it or wipe it remotely:

• iOS: Enable Find My iPhone in Settings > [Your Name] > Find My. Also enable "Send Last Location" so it reports before the battery dies.
• Android: Enable Find My Device in Settings > Security > Find My Device

Test that these work before you need them. Sign in to icloud.com or google.com/android/find from a computer to confirm your device is visible.

Secure Your SIM Card

A stolen phone with an unprotected SIM can be exploited to receive your SMS verification codes, enabling account takeovers:

• Set a SIM PIN — This requires a PIN code whenever the SIM is inserted into a device
  • iOS: Settings > Cellular > SIM PIN
  • Android: Settings > Security > SIM Card Lock
• Add a carrier account PIN — Call your carrier to set a PIN on your account, which helps prevent SIM swapping attacks

Manage Your Lock Screen Notifications

By default, message previews often appear on your lock screen — meaning anyone who picks up your phone can see your messages without unlocking it:

• iOS: Settings > Notifications > Show Previews > "When Unlocked" instead of Always
• Android: Settings > Notifications > Sensitive notifications — hide sensitive content on lock screen

Also consider hiding: SMS codes, banking notifications, and email previews from the lock screen.

Use Trusted Networks and a VPN

• Avoid connecting to unknown public Wi-Fi networks without a VPN
• When you must use public Wi-Fi, use a reputable VPN to encrypt your traffic
• Turn off Bluetooth and Wi-Fi when not in use — both can be exploited by nearby attackers
• Be cautious of USB charging ports in public places (hotels, airports) — use a USB data blocker or carry your own charger

Be Careful What You Install

• Only install apps from official app stores (App Store, Google Play)
• On Android, do not enable "Install from Unknown Sources" unless you know exactly what you're doing
• Read app reviews and check the developer's reputation before installing
• Be skeptical of apps that promise to dramatically improve battery life, speed up your phone, or provide free VPN services — many are adware or data harvesters

Back Up Your Phone Regularly

A backup protects you if your device is lost, stolen, or compromised:

• iOS: Enable iCloud Backup (Settings > [Your Name] > iCloud > iCloud Backup) or back up locally via Mac/PC
• Android: Enable Google One backup or back up locally
• Test your backup by verifying the last backup date is recent

If your phone is wiped remotely after a theft, a recent backup means you lose very little data.

Final Checklist

• Strong screen lock (6+ digit PIN or alphanumeric passcode)
• Auto-lock within 30 seconds
• OS and apps auto-update enabled
• App permissions reviewed and minimized
• Encryption enabled (verify on older Android)
• Find My Device enabled and tested
• SIM PIN set
• Lock screen notifications showing no sensitive previews
• Only official app store apps installed
• Regular backups configured and recent