Perform a practical security review on an iPhone or Android phone.
A phone often combines identity, recovery, authentication, messages, location, finances, work, and private media. Security should cover the physical device, platform account, mobile carrier, apps, permissions, backups, lock-screen exposure, and a tested lost-device plan.
Identify what the phone can unlock
List platform account, primary email, password manager, financial apps, work profile, authenticator, SMS recovery, cloud photos, health data, home controls, and connected devices. The more the phone can reset, the stronger its lock, recovery, and carrier protection should be.
Harden the device and accounts
- Supported operating system and automatic security updates
- Strong passcode or password with biometrics as convenient unlock, not a shared secret
- Platform and primary email accounts protected with strong multi-factor methods
- Automatic lock, restrained lock-screen notifications, and safe USB or accessory behavior
- Encrypted backup or secure recovery method tested
- Remote locate, lock, erase, emergency contact, and carrier account PIN or port protection
Review app access by need
| Permission | Better default | Allow when |
|---|---|---|
| Location | Never, ask, or while using | The feature visibly needs it |
| Photos and contacts | Selected items where supported | Full library is necessary and trusted |
| Microphone and camera | Ask or while using | User initiates capture or call |
Run the security reset
- Update system and every trusted app.
- Strengthen screen and account access.
- Remove unused apps, profiles, keyboards, and device administrators.
- Review permissions, notifications, VPNs, and connected devices.
- Configure backup and remote recovery.
- Write a lost-phone action card accessible elsewhere.
Watch for quiet exposure
- One-time codes visible on a locked screen
- Carrier account protected by reused credentials
- Old work or school management profile installed
- Sideloaded app or accessibility service with broad control
Prepare the lost-phone plan
From a separate safe location, know how to locate or lock the device, contact the carrier, protect payment and primary accounts, revoke sessions, recover authentication, report theft, preserve device identifiers, restore a replacement, and decide when erasure is justified.
Continue with the next decision
Sources and further reading
Primary and contextual sources used to verify definitions or give readers a relevant next resource.
- CISA Secure Our World Official public guidance supporting timely updates, strong passwords, multi-factor authentication, and phishing resistance.