Phones and tablets

Turn on automatic updates

Turn on automatic updates so the phone fixes known problems by itself.

• iPhone or iPad: Settings > General > Software Update > Automatic Updates, then turn on Automatically Install.
• Android: Settings > System > Software updates, then install anything waiting.

Keep the software updated, automatically

Updates fix security flaws that attackers already know about. Let the phone install them for you.

• iPhone and iPad: Settings > General > Software Update > Automatic Updates. Turn on Automatically Install.
• Android: Settings > System > Software updates, and install anything waiting. To see the Android security update level, go to Settings > About phone > Android version.
• Update your apps too, through the App Store or Google Play.

Use a longer passcode

Your passcode protects everything on the phone, and on many phones it can also change account settings. A short PIN or a pattern is easier to guess or watch over your shoulder.

• iPhone and iPad: when you set or change the passcode, tap Passcode Options to choose a custom alphanumeric code instead of the default six-digit number.
• Android: choose a password, or a PIN of at least six digits, instead of a pattern.
• Keep Face ID, Touch ID or fingerprint unlock on for everyday use, so a long passcode isn't a chore.

Install apps only from the official store, and check permissions

Get apps from the App Store or Google Play, not from links in messages. Then check what each app can reach.

• iPhone and iPad: Settings > Privacy & Security. Tap a category, such as Location Services, Camera or Microphone, and turn off access for apps that don't need it. App Privacy Report on the same screen shows how apps use what you allowed.
• Android: Settings > Security & Privacy > Privacy > Permission manager. Choose 'Ask every time' or 'Don't allow' where an app doesn't need access.
• Android: Google Play Protect scans apps on the phone, including ones from outside Google Play. Leave it on.
• Delete apps you no longer use.

Hide message previews on the lock screen

Sign-in codes often arrive by text or email. If previews show on a locked screen, anyone holding the phone can read them.

• iPhone and iPad: Settings > Notifications > Show Previews. Choose When Unlocked or Never.
• Android: Settings > Notifications. Under the lock screen or privacy options, turn off sensitive content.
• Better still, move important accounts off text-message codes (see cyber security).

iPhone: turn on Stolen Device Protection

If someone steals your iPhone and knows your passcode, this adds a Face ID or Touch ID check for actions such as using saved passwords. Away from familiar places, changing your Apple Account password also requires a one-hour wait and a second check.

• Settings > Face ID & Passcode (or Touch ID & Passcode) > Stolen Device Protection. It requires iOS 17.3 or later.
• It needs two-factor authentication on your Apple Account, Find My turned on, and Significant Locations turned on.
• You can choose to require these checks everywhere, not only away from familiar places.

Android: turn on Theft protection

Settings > Google > All services > Theft protection. The options available depend on your phone and Android version.

• Theft Detection Lock locks the screen if the phone seems to be snatched and carried away.
• Offline Device Lock locks the screen if the phone is kept offline.
• Identity Check asks for your fingerprint or face before sensitive changes, such as changing the screen lock or your Google Account password, especially outside trusted places.
• Remote Lock lets you lock the phone at android.com/lock with your verified phone number. It needs the phone's SIM to be active, so use it before your carrier disables service.
• Google says Theft protection isn't supported on tablets, so use a strong screen lock and Find Hub there.

Turn on Find My or Find Hub

Turn this on today. If your phone is ever lost, you can see it on a map, lock it, or erase it from another device.

Turn on Find My or Find Hub

These let you see a missing phone or tablet on a map, lock it and, as a last resort, erase it.

• iPhone and iPad: make sure Find My is on. You can then use icloud.com/find from any browser, or a family member's Apple device.
• Android: make sure Find Hub is on. You can then use android.com/find from any browser.
• Write down where you would sign in from if your phone were gone, and keep your account password somewhere you can reach without it.

If your phone goes missing: lock it

If your phone goes missing, use Find My (Apple) or Find Hub (Android) from another device to lock it right away.

Mark it as lost

Lock the phone remotely first, so nobody can use it while you work through the rest.

• iPhone and iPad: in Find My or at icloud.com/find, mark the device as lost. Lost Mode locks it with your passcode and suspends Apple Pay cards, and can show a number to call.
• Android: at android.com/find, mark the device as lost. If Remote Lock is set up, android.com/lock also works.

Call your carrier

Then call your mobile carrier, report the phone lost or stolen, and ask them to stop service on it, so nobody else receives your texts and codes.

Call your carrier

Lock the phone first (Find My, Find Hub or Android Remote Lock); Remote Lock needs the phone's SIM to still be active. Then report the phone lost or stolen and ask the carrier to disable service on it, so your number and text-message codes don't keep arriving on a phone someone else holds. If you haven't already, ask about an account PIN and number-lock protection.

Secure your accounts

Start with the accounts that can reset others.

• Change your primary email password.
• From another trusted device, review your Apple Account or Google Account. If you see changes you didn't make, change that password.
• Google: open your Google Account's device list and sign out of the missing phone.
• Apple: review the devices signed in to your Apple Account and remove any you don't recognize. Apple advises keeping the missing iPhone in Find My, even after an erase, so Activation Lock stays on.
• Tell your bank and any financial apps that were on the phone.

Erase it if you won't get it back

Erasing can't be undone, and afterwards you usually can't locate the device. Apple suggests doing it only after you've tried everything else. File a police report as well; the police may ask for the serial number.

For people at higher risk

Both platforms offer a stricter mode. It trades some convenience for fewer ways in.

• Apple Lockdown Mode is designed for the very few people who might be personally targeted by sophisticated attacks. It blocks most message attachments and some web features. Settings > Privacy & Security > Lockdown Mode, on each device.
• Android Advanced Protection turns on Android's strongest security settings and keeps them from being switched off by accident or on purpose. Settings > Security & Privacy > Other settings > Advanced Protection, then turn on Device protection. A screen lock is required first.

Children's phones and tablets

Give a child their own account on their own device rather than sharing yours, so your email, banking and payment apps aren't one tap away.

• iPhone and iPad: set up Family Sharing, give the child their own Apple Account, then use Screen Time to manage apps, websites, contacts and hours.
• Android: use Family Link to supervise the child's Google Account, approve or block apps and set screen-time limits.
• Shared Android tablet: add a separate user for each person under Settings > System > Multiple users.