Keeping Your Phone Secure

Your phone knows your timetable, your location, your messages, your photos, your bank, your authenticator codes and your friends. It is also the thing most likely to be dropped, left on a bus or snatched from a table. Phone security is therefore less about exotic hacking and more about three ordinary things: stopping a thief from using it, keeping software patched and limiting what apps can see. This guide sets out a setup that takes about ten minutes and protects against the problems students actually meet.

Menu names differ between phone makers and versions, so look for the equivalent settings on your device. This guide names no products.

Lock the screen properly

• Use a strong passcode: at least six digits, preferably longer or alphanumeric. Avoid birthdays, repeated digits and patterns.
• Use biometrics for convenience (fingerprint or face recognition), while keeping a strong passcode as backup.
• Set a short auto-lock time, such as thirty seconds to a minute.
• Hide notification previews on the lock screen, since messages and codes can be read by anyone nearby.
• Limit lock-screen access to controls and wallet functions you do not want strangers using.
• Know the quick way to disable biometrics in an emergency, such as pressing and holding certain buttons.
• Do not share your passcode, even with friends or partners.

Shoulder surfing is common on public transport and in lectures, so cover your screen when entering your passcode.

Keep software updated

Updates patch security flaws that attackers actively use.

• Turn on automatic updates for the operating system and apps.
• Install updates promptly, especially security updates.
• Replace phones that no longer receive updates.
• Restart occasionally.
• Be wary of update prompts in text messages or pop-ups. Only update through settings and official stores.

Install apps carefully

• Use official app stores only. Avoid installing apps from links, messages or unofficial sites.
• Check the developer, reviews and number of downloads. Fake apps imitate popular ones.
• Read permissions before installing. A flashlight app does not need your contacts.
• Delete apps you no longer use.
• Be cautious with free tools that carry ads or ask for odd permissions.
• Avoid modified or pirated apps, which often contain malware.

Manage permissions and privacy

• Review app permissions for location, camera, microphone, contacts, photos, files and calls. Allow only what an app genuinely needs, and choose "while using" for location.
• Check which apps run in the background.
• Turn off ad tracking where available.
• Disable Bluetooth, Wi-Fi and location when you do not need them, or limit them.
• Review sharing and clipboard access.
• Check your accounts' connected apps and revoke access you no longer want.

Find my device and remote wipe

Turn on tracking features before you need them.

• Enable "find my device" or the equivalent on your phone.
• Register a lock-screen message with an alternative contact, if the feature exists.
• Know how to lock, locate or erase the phone remotely from another device or a web page.
• Keep your account password and two-factor methods accessible from a second device, so you can sign in if your phone is gone.
• Record your phone's identification number and keep it in a safe place. Police and insurers may ask for it.
• Test the feature once, so you know it works.

Back up your phone

Backups protect you from loss, damage and theft.

• Turn on automatic cloud backup for photos, contacts and settings.
• Consider a periodic local backup to a computer or drive.
• Back up your authenticator app or save recovery codes, so you can move your accounts to a new phone.
• Check that backups complete, and restore a test item once.
• Protect your cloud account with a strong password and two-factor authentication.

Protect your number and SIM

• Set a PIN on your SIM card if your phone supports it.
• Add a passcode or security question to your mobile account, to resist SIM-swap attacks where thieves convince providers to transfer your number.
• Use authenticator apps or keys instead of text messages for important accounts.
• Be careful with who has your number, and avoid posting it publicly.
• Watch for sudden loss of signal when you did not expect it, which could indicate a SIM swap. Contact your provider immediately.
• Check eSIM settings if you use them, and know how to transfer or disable them.

Be careful with messages, calls and links

• Treat unexpected texts as suspicious, especially those with links, codes or urgent demands.
• Do not share verification codes with anyone.
• Don't call back unknown numbers from missed calls in odd formats.
• Verify callers claiming to be from banks or authorities by hanging up and calling official numbers.
• Avoid scanning random QR codes.
• Use spam filters and report scam messages to your provider.
• Watch for voice or video scams.
• **Read

Public Wi-Fi, charging and Bluetooth

• Avoid sensitive tasks on open Wi-Fi, and use mobile data when practical. See our public Wi-Fi safety guide.
• Use your own cable and charger where possible. Public charging ports can be tampered with. If you must, use a power-only adapter or a portable battery.
• Turn off Bluetooth discoverability and unpair devices you do not use.
• Be careful with wireless earbuds and accessories from unknown sellers.
• Disable automatic connection to open networks.

Physical safety

• Keep your phone out of sight in crowded places and on tables near doors or windows.
• Use a bag with zippers and keep it in front of you.
• Be careful on public transport, especially at doors where phones can be snatched.
• Consider a wrist strap or case with a secure grip.
• Do not leave it unattended in libraries, gyms and lecture halls.
• Record where you keep it to avoid losing it.

If your phone is lost or stolen

1. Try to locate it, and lock it remotely.
2. Call your mobile provider to suspend the SIM and request a replacement. Ask about blocking the device.
3. Change passwords for key accounts: email, cloud, banking, social media and university. Sign out of sessions.
4. Move two-factor authentication to a new device using backup codes.
5. Tell your bank, and freeze cards linked to payment apps if needed.
6. Report the theft to the police, and to campus security if on campus. Keep the reference number.
7. Wipe the phone remotely if recovery is unlikely.
8. Tell your university if it held university credentials.
9. Contact insurers, if you have cover.
10. Be alert for scam messages pretending to be from the finder or from "recovery services."

Personal safety comes first. Do not confront a thief.

Selling, trading in or recycling

• Back up everything.
• Sign out of cloud accounts and turn off tracking and activation locks.
• Remove the SIM and memory card.
• Erase the phone and restore factory settings.
• Check that it is no longer linked to your account.
• Sell through reputable channels, and beware of buyers who propose unusual payment methods.
• Recycle responsibly if it has no resale value.

A ten-minute setup checklist

1. Set a strong passcode and auto-lock.
2. Hide notification previews.
3. Turn on automatic updates.
4. Enable find my device and remote wipe.
5. Turn on cloud backup.
6. Review app permissions.
7. Set a SIM PIN and mobile account passcode.
8. Turn on two-factor authentication for your email and cloud accounts.
9. Record your phone's identification number.
10. Save your recovery codes somewhere safe.

One more habit: treat your phone as a key

Your phone now opens bank accounts, doors, bikes, buildings and your identity. If someone steals it while unlocked, they can do far more damage than if they steal a wallet. Get into the habit of locking it whenever you put it down, and of keeping it in a front pocket or inside a zipped bag in busy places. Avoid unlocking it where others can watch your passcode. These small habits cost nothing and block the most common ways phones are abused.

Common mistakes

• Using a weak or shared passcode.
• Postponing updates.
• Installing apps from unofficial sources.
• Giving every app every permission.
• Skipping backups.
• Forgetting about SIM protection.
• Clicking links in texts.

A quick checklist

• Is my phone locked with a strong passcode?
• Are updates automatic?
• Is tracking and remote wipe enabled?
• Do I have backups and recovery codes?
• Have I reviewed app permissions?
• Do I know what to do if it is lost?

Final thoughts

Phone security is mostly setup and habit. Lock it with a strong passcode, keep it updated, install apps carefully and limit permissions. Turn on tracking, back up regularly and protect your number. If it disappears, act quickly through your provider and accounts. A few minutes now can save a great deal of trouble later.