Your Phone Is the Master Key to Your Life: Lock It Down Right
Why your phone deserves more attention than your laptop
Most people spend more time worrying about their computer’s antivirus software than their phone’s security settings, but the math is backwards. Your phone is logged into your email, which can reset passwords for nearly every other account you own. It has your banking app. It has your authentication codes. It’s usually unlocked or nearby, and it’s the single device most likely to be lost, stolen, or grabbed off a table while you’re not looking.
Securing a phone properly takes maybe twenty minutes. Here’s what actually matters, broken down by what you can do right now.
Lock screen basics that most people skip
Use a real passcode, not a pattern or four digits
Android’s swipe patterns and short PINs are both easier to guess than people assume, especially if someone has watched you unlock your phone a few times or can see smudge marks on the screen. Switch to a six-digit PIN at minimum, or better, an alphanumeric passcode. On iOS, go to Settings > Face ID & Passcode and choose “Custom Alphanumeric Code.” On Android, it’s under Settings > Security > Screen Lock.
Turn on biometrics, but understand their limits
Face ID and fingerprint unlock are convenient and reasonably secure for everyday use, but they’re not foolproof. Fingerprints can sometimes be lifted, and face unlock can occasionally be fooled by a photo on cheaper Android implementations. Use biometrics for daily convenience, but make sure the fallback passcode is strong, because that’s what protects you if biometrics fail or get disabled.
Shorten your auto-lock time
A phone that stays unlocked for five minutes after you last touched it is a phone that’s vulnerable if you set it down. Set auto-lock to 30 seconds or a minute. It’s a small annoyance in exchange for closing a real window of exposure.
Settings that matter more than people think
Disable lock screen notification previews
By default, both iOS and Android will show the content of text messages and app notifications right on the lock screen, including one-time passcodes sent by your bank or email provider. That means anyone who glances at your phone while it’s locked can potentially read a 2FA code and use it before you do. Go into notification settings and turn off “show content” or “show previews” for sensitive apps at minimum, if not everywhere.
Turn on Find My iPhone or Find My Device
This is the single most useful feature for a lost or stolen phone, and it’s off by default on some Android devices depending on the manufacturer. On iPhone, check Settings > [your name] > Find My. On Android, check Settings > Security > Find My Device. Confirm it’s actually enabled now, before you need it, because you can’t turn it on remotely after the phone is gone.
Review app permissions once a year
Apps accumulate permissions over time, and a lot of them don’t need what they’ve been granted. Go through Settings > Privacy (iOS) or Settings > Privacy > Permission Manager (Android) and look specifically at which apps have access to your location, microphone, camera, and contacts. Revoke anything that doesn’t have an obvious reason for the access. A flashlight app doesn’t need your contacts.
Keep the OS updated
Security patches close real vulnerabilities that get discovered and exploited. Set your phone to update automatically overnight so you’re not putting it off. This matters more than almost any other single setting.
Banking app hygiene
Banking apps generally have decent built-in security, but the weak points are usually on your end, not theirs.
- Use a unique passcode or biometric login for the banking app itself if it offers a separate lock, rather than relying only on the phone’s unlock.
- Turn on transaction alerts for every charge, not just large ones. Small unfamiliar charges are often the first sign of a compromised card.
- Never do banking over public WiFi (more on that below), and be cautious about using banking apps on a phone that’s been jailbroken or rooted, since that voids a lot of the built-in security sandboxing.
- Log out of banking apps that don’t auto-lock, rather than just backgrounding them.
- Be suspicious of any text or email claiming to be from your bank asking you to click a link and log in. Banks don’t usually need you to “verify your account” urgently. Open the app directly instead of clicking the link.
Public WiFi: what’s actually risky and what isn’t
Public WiFi paranoia is often overstated for casual browsing, but there are real risk categories worth understanding.
Lower risk activities
Reading news, browsing, checking sports scores, or using apps that already encrypt their traffic (most modern apps do, via HTTPS) are relatively low risk on public WiFi. The connection between your phone and the app’s servers is typically encrypted regardless of the network you’re on.
Higher risk activities
Logging into accounts on websites (not apps) that don’t use HTTPS, entering payment information on unfamiliar sites, or accessing sensitive accounts on a network you don’t trust at all (an open network with no password, at an airport or cafe with a generic name like “Free Public WiFi”) carries more risk. On networks like that, someone else on the same network can sometimes intercept unencrypted traffic or set up a fake identical network to capture what you send.
A simple rule of thumb
If you wouldn’t do it standing at a public counter with a stranger looking over your shoulder, don’t do it on open public WiFi either. For banking specifically, just wait until you’re on cellular data or a trusted network. It’s rarely worth the tradeoff for the few minutes you’d save.
The lost-phone plan almost nobody has
Most people know their phone has a lock screen. Very few have actually thought through what happens if it’s lost or stolen, and that gap costs real time and stress when it happens.
Before you lose it
- Confirm Find My iPhone or Find My Device is on, and know how to access it from another device (a browser login, not just the app on the missing phone itself).
- Write down your phone’s IMEI number somewhere other than the phone. Dial *#06# to find it. Your carrier will ask for this if the phone is stolen.
- Know your carrier’s number for reporting a lost or stolen device and suspending service, and save it somewhere other than your phone’s contacts.
- Make sure your phone backs up automatically, so a wipe doesn’t mean losing your photos and data permanently.
The moment you realize it’s gone
- Use Find My from another device to locate it, put it in Lost Mode, and display a message with a callback number.
- If it’s confirmed stolen rather than misplaced, don’t chase it in person. Report it to the police for a record, since insurance and carriers often require this.
- Call your carrier to suspend the SIM immediately. This stops someone from receiving your texts, including 2FA codes.
- Change the passwords on your email and any financial accounts, ideally from a computer, starting with email since it’s the recovery path for everything else.
- If you can’t locate it within a reasonable window, remotely erase it through Find My. This is a hard call to make, but an unrecoverable phone is better than one sitting unlocked in a stranger’s pocket.
Having this plan written down before you need it is the difference between a calm ten-minute response and a panicked hour of trying to remember your carrier’s phone number while also trying to log into accounts from memory.
For the complete, structured playbook on this topic, see Phone & Mobile Security: iOS, Android, Banking Apps, Public WiFi, and the Lost-Phone Plan Most People Skip in our library. New here? Start with our free guide.