Think about what lives on your phone: your bank app, your email, your photos, your two-factor codes and probably half your life. If someone gets in, they don’t just see a screen. They can reach your money and your identity.
The good news is that you don’t need to be a tech expert. A handful of simple settings blocks most everyday attacks. Here is an up-to-date checklist for 2026, for both iPhone and Android.
Quick Answer: The 10-Point Checklist
- Keep your phone and apps updated.
- Use a strong screen lock (a 6-digit or longer PIN, plus biometrics).
- Switch to passkeys where available, and turn on multi-factor authentication (MFA).
- Download apps only from official stores.
- Check app permissions.
- Think before you tap links, QR codes and attachments.
- Turn on theft protection and “find my phone”.
- Add a PIN to your SIM card.
- Be careful on public Wi-Fi.
- Back up your data regularly.
No single setting makes a phone unhackable, but layering these steps makes you a much harder target.
1. Keep Your Phone and Apps Updated
Updates fix security holes that attackers actively use. Turn on automatic updates for your operating system and for your apps. If your phone is so old that it no longer receives security updates, consider replacing it, especially if you use it for banking.
2. Use a Strong Screen Lock
Your lock screen is the front door.
- Choose a 6-digit or longer PIN, or a passphrase.
- Avoid birthdays and patterns like 123456 or 111111.
- Add fingerprint or face unlock for convenience, but keep a strong PIN as the backup.
- Set the screen to auto-lock after a short time.
3. Switch to Passkeys and Turn On MFA
Passwords get stolen, reused and phished. Passkeys replace the password with a secure key stored on your device and unlocked by your fingerprint, face or PIN. They are designed to resist phishing, and many major services now support them.
- iPhone: Passkeys sync through iCloud Keychain.
- Android: Passkeys are stored in Google Password Manager or a third-party password manager.
Where a site doesn’t offer passkeys, turn on MFA and prefer an authenticator app over SMS codes where possible. Use a password manager to create a unique password for every account.
4. Download Apps Only From Official Stores
Stick to the Apple App Store and Google Play Store. Fake and trojanised apps are a common way malware gets onto phones.
- Check the developer name, reviews and number of downloads.
- Be wary of apps that promise “free” versions of paid apps.
- On Android, avoid installing apps from unknown sources, and keep Google Play Protect switched on.
- Delete apps you no longer use.
5. Check App Permissions
Does a torch app need your contacts? Does a game need your microphone? Go to your privacy settings and review what each app can access.
- Allow location only while using the app, or not at all.
- Remove access to camera, microphone, contacts and photos where it isn’t needed.
- Review permissions every few months.
6. Think Before You Tap: Links, QR Codes and Messages
Most phone hacks begin with a person being tricked, not with advanced technology.
- Smishing: Fake text messages about parcels, tolls, bank alerts or prizes.
- Quishing: Malicious QR codes on posters, parking meters or emails.
- Impersonation: Messages that seem to come from a friend, boss or relative asking for money or codes.
- Fake login pages that copy your bank or email.
Don’t tap links in unexpected messages. Open the official app or type the website address yourself. Never share one-time codes (OTPs) or PINs with anyone, even someone claiming to be from your bank.
For more on this, read our guide to [15 Common Online Scams and How to Avoid Them].
7. Turn On Theft Protection and “Find My Phone”
A stolen, unlocked phone can be a gateway to your money.
- iPhone: Turn on Find My and Stolen Device Protection, which adds extra security checks when you are away from familiar places like home or work.
- Android: Turn on Find Hub (Find My Device) and Theft Protection features, such as remote lock and automatic locking if theft is detected, where your phone supports them.
- Note your phone’s IMEI number, and keep it somewhere safe.
8. Add a PIN to Your SIM Card
In a SIM swap attack, criminals trick a phone company into moving your number to their SIM so they can receive your verification codes.
- Set a SIM PIN on your phone.
- Ask your mobile provider about extra account security, such as a port-out or transfer PIN.
- Use app-based MFA or passkeys for banking and email, rather than SMS alone.
9. Be Careful on Public Wi-Fi
Free Wi-Fi in cafes, airports and hotels isn’t always safe.
- Avoid banking and shopping on public Wi-Fi. Use your mobile data instead.
- Turn off automatic Wi-Fi joining for open networks.
- Turn off Bluetooth and AirDrop-style sharing when you don’t need them.
- If you must use public Wi-Fi, a reputable VPN can add protection, but it doesn’t make a risky site safe.
10. Back Up Your Data
Backups protect you from loss, ransomware and a needed factory reset. Use the built-in iCloud or Google backup, or back up to a computer, and check that it actually runs.
11. Use Extra Protection If You Are at Higher Risk
- iPhone: Lockdown Mode is an optional extreme protection setting for people who may be targeted, such as journalists or activists. It limits some features to reduce the attack surface.
- Android: Newer versions offer an Advanced Protection mode and Google’s Advanced Protection Program for high-risk accounts.
Most people don’t need these, but they are worth knowing.
12. Protect Your Banking Apps
- Turn on transaction alerts for every payment.
- Set spending or transfer limits if your bank offers them.
- Use the bank’s official app, not links from messages.
- Lock the banking app with biometrics or a separate PIN, where available.
- Never share your banking screen with someone who calls you, and don’t install screen-sharing apps at a stranger’s request.
iPhone vs Android: Quick Comparison
| Feature | iPhone | Android |
|---|---|---|
| Updates | Delivered to all supported iPhones directly from Apple | Varies by brand. Pixel and Samsung are strong, others can be slower |
| Built-in malware protection | App sandboxing and app review | Google Play Protect |
| Passkeys | iCloud Keychain | Google Password Manager or third-party |
| Theft protection | Find My, Stolen Device Protection | Find Hub, Theft Protection |
| High-risk mode | Lockdown Mode | Advanced Protection (newer versions) |
| Sideloading apps | Limited (varies by region) | Possible, so take extra care |
Both platforms can be secure when kept updated and configured properly. The right habits matter more than the logo on the phone.
Signs Your Phone May Be Hacked
- Battery drains much faster than usual.
- Data use spikes with no clear reason.
- Apps you don’t recognise appear.
- Pop-ups and redirects appear constantly.
- Friends receive strange messages from your accounts.
- You see login alerts or password reset emails you didn’t request.
These can also be caused by normal faults, so don’t panic. Check the list above and act if several signs appear together.
What to Do If You Think Your Phone Is Compromised
- Contact your bank if money or banking accounts may be affected.
- Update your phone to the latest software.
- Delete apps you don’t recognise.
- Change your passwords (starting with email and banking) from a different, trusted device, and turn on MFA.
- Run a scan with Google Play Protect on Android.
- Back up essential files, then do a factory reset if problems continue.
- Report the incident to the relevant authority in your country, and to your mobile provider if your SIM was involved.
Do You Need Antivirus on Your Phone?
On iPhone, apps are sandboxed, so traditional antivirus apps have little to scan. On Android, Google Play Protect gives built-in scanning, and a third-party security app isn’t necessary for most people. If you do choose one, pick a reputable brand, and remember that no app replaces updates and careful habits.
Frequently Asked Questions
How do hackers get into smartphones? Most often through tricks such as phishing messages, fake apps, stolen passwords, SIM swaps, unsafe Wi-Fi or an unlocked, stolen device, rather than by breaking into the phone’s software directly.
Is iPhone safer than Android? Both have strong built-in protections. The safer phone is the one that is updated, locked with a strong PIN and used with careful habits.
Are passkeys safer than passwords? Passkeys are designed to resist phishing and password theft, so they are generally considered a stronger option where supported.
Should I use SMS codes for two-factor authentication? They are better than nothing, but app-based MFA or passkeys are stronger.
Can my phone be hacked just by clicking a link? A bad link can lead to a fake login page or a malicious download. Serious attacks that need no click do exist, but they are rare and mostly target high-risk individuals. Keeping your phone updated is your best defence.
Is a VPN necessary? Not for everyone. A VPN can help on public Wi-Fi, but it doesn’t protect you from phishing or malicious apps.
Final Thoughts
Protecting your smartphone comes down to a few repeatable habits: update, lock, verify, limit permissions and prepare for theft. Spend 15 minutes today going through the checklist, and you’ll be safer than most people. Then revisit it every few months, because both phones and scams keep changing.
Sources and Further Reading
- Apple Support: Security and privacy guides (support.apple.com)
- Google Android Help: Security and privacy (support.google.com/android)
- CISA (cisa.gov): mobile device security tips
- National Cyber Security Centre, UK (ncsc.gov.uk)
Disclaimer: This content is for general educational purposes only and does not constitute cybersecurity, legal or financial advice. Features vary by device and software version. If you believe you are a victim of fraud, contact your bank and local authorities immediately.