Lockwell

Lock down your phone

Protect what is on your phone if it is lost, stolen or picked up by someone else.

  • 45 min
  • 9 steps
  • Reviewed

Your phone holds your messages, photos, saved passwords and the codes that let you into your accounts. A strong screen lock and current updates protect most of it. The three Essential items take about twenty minutes. Menus differ between Android brands and versions: if you can't find a step, type the setting's name into the search box at the top of Settings.

Essential

The screen lock stops someone who picks up your phone from opening it. It also protects the encryption of your data: on an iPhone, setting a passcode is what turns that encryption on. A short or obvious code is easy to guess or to watch you type. Use at least six digits; a longer code, or a password with letters, is stronger. Avoid codes like 0000 or 1234.

Fingerprint or face unlock is fine for most people, as long as a strong code sits behind it. The phone still asks for the code after a restart. If someone could force you to unlock the phone with your face or finger, for example at a protest or a border, turn face and fingerprint unlock off beforehand, or switch the phone off.

iPhone

  1. Go to Settings → Face ID & Passcode. On an iPhone with Touch ID, it is Touch ID & Passcode.
  2. Tap Turn Passcode On, or Change Passcode if you already have one.
  3. Tap Passcode Options and choose Custom Numeric Code or Custom Alphanumeric Code. Apple calls these the most secure options.
  4. In Settings → Display & Brightness → Auto-Lock, choose a short time.

Android

  1. On a Pixel, open Settings → Security & privacy → Device unlock → Screen lock. On a Samsung, open Settings → Lock screen → Screen lock type. On other phones, search Settings for Screen lock.
  2. Choose PIN with six or more digits, or Password.
  3. Don't use Swipe or None: they give no protection.
Essential

Updates fix security holes that attackers already know about. Turn on automatic updates and install an update when your phone offers one. A phone that no longer gets security updates becomes less safe every month. Google promises seven years of updates for Pixel 8 and later, and Samsung up to seven years for selected models. Other makers may promise less, so check your phone maker's site. When yours stops getting updates, plan to replace it.

iPhone

  1. Go to Settings → General → Software Update → Automatic Updates and, under iOS Updates, turn on Automatically Install.
  2. If Settings → Privacy & Security shows Background Security Improvements, open it and turn on Automatically Install there too.
  3. In Settings → Apps → App Store, check that App Updates is on.

Android

  1. Open Settings → System → Software updates and install anything waiting. On a Samsung, it is Settings → Software update.
  2. On a Samsung, turn on Auto download over Wi-Fi on that screen. On older versions, tap the three dots, then Auto download → Using Wi-Fi only.
  3. In the Google Play app, tap your profile picture, then Settings → Network Preferences → Auto-update apps, and choose any option except Don't auto-update apps.
  4. To see how current your phone is, open Settings → About phone → Android version and look at the Android security update date. On a Samsung, it is under Settings → About phone → Software information. If it is many months old and no update is offered, your phone may no longer be supported.
Essential

If your phone is lost or stolen, these services show where it is and let you lock or erase it from another device. They only work if you turn them on before the phone goes missing. On an iPhone, Find My also adds Activation Lock: nobody can erase and reuse the phone without your Apple Account password.

iPhone

  1. Go to Settings, tap your name, then Find My → Find My iPhone, and turn on Find My iPhone.
  2. Turn on Find My network and Send Last Location, so the phone can be found even when it is offline or its battery is almost empty.
  3. If the phone goes missing, open icloud.com/find on any device, sign in with the Find Devices button, and choose Mark as Lost. You don't need a login code there.

Android

  1. Open Settings → Security → Find Hub and check that Allow device to be located is on. If you can't find it, search Settings for Find Hub. On a Samsung, also check Settings → Security and privacy → Lost device protection.
  2. If the phone goes missing, open android.com/find on another device and sign in with your Google Account.
  3. That sign-in may ask for a code from the very phone you lost. Keep your Google backup codes somewhere safe: see Make sure you can get back in.
Recommended

Notifications on the lock screen can show your messages and login codes to anyone holding your phone, even while it is locked. Show their content only after you unlock the phone. Some apps may still show more than you expect, so check what appears on your own lock screen.

iPhone

  1. Go to Settings → Notifications → Show Previews and choose When Unlocked. Previews still appear once Face ID or Touch ID recognises you.
  2. In Settings → Face ID & Passcode, look under Allow Access When Locked and turn off what you don't need before unlocking.

Android

  1. On a Pixel, open Settings → Notifications → Notifications on lock screen and turn off Show sensitive content. Older phones call it Sensitive notifications.
  2. On a Samsung, open Settings → Notifications → Hide content while locked and choose Hide when locked. On older Samsung phones, look under Notifications → Advanced settings or Additional settings.
Recommended

Apps ask for your location, camera, microphone, contacts and photos, and keep that access until you take it away. Start by deleting apps you no longer use. Then remove access an app doesn't need. If an app stops working, you can turn the access back on.

iPhone

  1. Go to Settings → Privacy & Security → Location Services and tap each app. Allow location only while you use the app, or never. Turn off Precise Location where an approximate area is enough, for example for weather.
  2. Go back to Privacy & Security and check Camera, Microphone and the other categories the same way.
  3. A green dot at the top of the screen means an app is using the camera; an orange dot means the microphone.

Android

  1. Open Settings → Security & privacy → Privacy → Permission manager. On some phones it is Settings → Apps, then an app, then Permissions.
  2. Tap Location, Camera or Microphone, and set apps that don't need it to Allow only while using the app, Ask every time or Don't allow.
  3. For location, turn off Use precise location where an approximate area is enough.
  4. A green indicator at the top right means the camera or microphone is in use. Swipe down and tap it to see which app.
Recommended

Apps from links, messages and unknown websites are a common way to get harmful software onto a phone. Scammers sometimes call or write and ask you to install an app from a link: don't, and see Hang up on calls that ask for money or codes. The official stores check apps, which reduces the risk but doesn't remove it. If you install only from the official store and keep the phone updated, you don't need an antivirus app.

iPhone

  1. Install apps only from the App Store.
  2. Don't jailbreak your iPhone. Apple says it bypasses the phone's security features.

Android

  1. Install apps only from Google Play or your phone maker's store, such as Galaxy Store.
  2. In Google Play, tap your profile picture, then Play Protect → Settings, and check that Scan apps with Play Protect is on.
  3. On a Samsung, open Settings → Security and privacy → Auto Blocker and turn it on. It blocks apps from other sources.
  4. If your phone asks whether to allow installing apps from another source, refuse.
Recommended

Someone who takes your SIM card can put it in another phone and receive your calls and SMS codes. A SIM PIN makes the card ask for a code each time the phone restarts or the card goes into another phone. It doesn't stop someone who talks your mobile operator into moving your number to a new SIM card; for that, use a login method other than SMS where you can (see two-step verification).

You need your SIM's current PIN first. It is in the papers that came with the card, or your mobile operator can tell you.

iPhone

  1. Go to Settings → Cellular → SIM PIN. Outside the US this may be called Mobile Service. With two SIMs, tap the number first.
  2. Turn on SIM PIN and enter the current PIN.
  3. If it is still the operator's default PIN, change it on the same screen to one only you know.

Android

  1. On a Pixel, open Settings → Security & privacy → More security settings → SIM lock and tap Lock SIM. On other phones, search Settings for SIM.
  2. Enter the current PIN.
  3. If it is still the operator's default PIN, change it to one only you know.
Advanced

Some thieves watch you type your code and then take the phone. These features ask for your face or fingerprint, and sometimes an hour's wait, before anyone can change your passwords or turn off Find My. The extra checks apply when you are away from places you often visit, or everywhere if you choose. They only buy time: mark the phone as lost as soon as you can. If your face or fingerprint is often not recognised, expect delays.

iPhone

  1. Go to Settings → Face ID & Passcode and enter your passcode.
  2. Tap Stolen Device Protection and turn it on. It may already be on. It needs Face ID or Touch ID, Find My, two-factor authentication for your Apple Account, and Significant Locations in Location Services.
  3. To have the delay apply everywhere, choose Always.

Android

  1. Open Settings → Google → All services → Theft protection. On a Samsung, open Settings → Security and privacy → Lost device protection → Theft protection.
  2. Turn on Theft Detection Lock and Offline Device Lock. They lock the screen when the phone is snatched or taken offline.
  3. Turn on Remote Lock and verify your phone number. You can then lock the phone at android.com/lock with your phone number.
  4. If Identity Check is listed, turn it on.
Advanced

A phone you pass on still holds your accounts and photos until you erase it. Before you erase, make sure you won't lock yourself out: back up, and move your login codes to your new phone. On an iPhone, erasing destroys the encryption keys, so the old data can no longer be read.

iPhone

  1. Back up the phone. Move your authenticator app and phone number to the new phone, and check that you can sign in there.
  2. Turn off Stolen Device Protection in Settings → Face ID & Passcode.
  3. Go to Settings, tap your name, scroll down and tap Sign Out.
  4. Go to Settings → General → Transfer or Reset iPhone → Erase All Content and Settings.

Android

  1. Back up the phone. Move your authenticator app and phone number to the new phone, and check that you can sign in there.
  2. On a Pixel, open Settings → System → Reset options → Erase all data (factory reset). On a Samsung, open Settings → General management → Reset → Factory data reset.
  3. Use the reset in Settings. After any other kind of reset, the phone asks the next owner for your Google Account.