The Top 10 List for Keeping Your Mobile Phone Secure

Your phone is not just a phone. It is your wallet, your office, your photo album and, increasingly, the key that unlocks every other account you own.

That makes it one of the most valuable things a criminal can get their hands on, physically or remotely. It is also where a lot of scams now start. The FTC reported that consumers lost $470 million in 2024 to scams that began with a text message, led by fake package-delivery alerts, bogus job offers, fake bank fraud alerts and phony unpaid-toll notices.

The good news is that modern iPhones and Android devices have excellent built-in protection. You just have to use it.

The checklist

Ten habits that make a real difference

• 1. Use a strong screen lock: A six-digit PIN or longer passcode, plus Face ID or fingerprint for convenience. Four digits and swipe patterns are too easy to guess or watch over your shoulder.
• 2. Install updates promptly: Security patches fix flaws that attackers actively exploit. Turn on automatic updates and restart when asked.
• 3. Only use official app stores: Sideloaded apps and third-party stores are a common source of malware.
• 4. Review app permissions: Does a flashlight app really need your contacts, location and microphone? Revoke what is not needed.
• 5. Turn on Find My / Find Hub: It lets you locate, lock or erase a lost or stolen phone remotely.
• 6. Protect your accounts with MFA: Prefer an authenticator app or passkeys over text-message codes where possible.
• 7. Add a carrier PIN: Ask your mobile carrier for a port-out or account PIN to prevent SIM-swap scams.
• 8. Be careful with links in texts: “Smishing” messages about packages, tolls and bank alerts are everywhere.
• 9. Avoid untrusted Wi-Fi and chargers: Use your cellular data or a trusted VPN, and your own charger and cable.
• 10. Back it up: iCloud or Google backup means a lost phone is an inconvenience, not a catastrophe.

The phone in your pocket is the master key to your digital life. Treat it like one.

Knock out the first five in ten minutes

On an iPhone: set a stronger code under Settings › Face ID & Passcode, turn on Settings › General › Software Update › Automatic Updates, review access under Settings › Privacy & Security (Location Services, Contacts, Microphone, Camera), and confirm Find My iPhone is on under Settings › your name › Find My.

On Android: the menus vary by manufacturer, but look for Security & privacy › Device unlock for the screen lock, System › Software updates for patches, Security & privacy › Privacy › Permission manager for app access, and Google › Find My Device (now part of Google’s Find Hub) to make sure remote locate and erase are on. Use the search bar at the top of Settings if a menu has moved.

That is ten minutes of effort that closes the most common ways a phone gets compromised or a lost phone becomes a data breach.

The SIM-swap problem

One threat deserves special attention. In a SIM-swap attack, a criminal convinces your carrier to move your phone number to a SIM card they control. Suddenly, every text-message login code comes to them, and so do password-reset messages for your email and bank.

Two moves shrink this risk sharply. First, set an account PIN or port-out PIN with your carrier, and turn on any extra number-lock protection it offers in its app. Second, move your most important accounts, starting with email and banking, from text-message codes to an authenticator app or passkeys, so a stolen phone number is not enough to get in.

If your phone suddenly loses service for no clear reason, especially right after odd emails or texts, contact your carrier immediately from another phone. It can be an early sign of a SIM swap.

How to spot a smishing text

• Urgency: An unpaid toll, a held package or a locked account that needs action “today.”
• A link or a reply request: Legitimate companies rarely need you to tap a link in a text to fix a problem.
• An odd sender: A random number, or an email address, instead of the company’s usual short code.
• A mismatched web address: The link does not match the real company’s domain.

The safe habit is the same one that works for email: do not tap. Open the company’s app or type its web address yourself. In the US you can forward spam texts to 7726 (SPAM) so your carrier can block the sender. The instincts are the same ones covered in how to spot a phishing email in under 30 seconds.

For business phones

If employees use phones for company email and files, consider mobile device management. It lets IT enforce a screen lock and encryption, separate work data from personal data and wipe company information from a lost device without touching personal photos.

If you allow personal phones, set a minimum bar anyway: a screen lock, a supported operating system version and MFA on every company app, plus a written process for what happens when a phone is lost or an employee leaves. And keep work passwords in a proper password manager; here is why you should not store passwords in your browser.