Phone Privacy and Security Settings You Should Check

Your phone contains your email, banking apps, photos, messages, passwords, location history, and personal data. Most phones ship with reasonable default security settings, but several important protections are turned off by default or need manual configuration. This guide covers the security and privacy settings you should check on both iPhone and Android to protect your data.

Lock screen security

Your lock screen is the first barrier against unauthorized access:

• Use a 6-digit passcode or longer: A 4-digit PIN has 10,000 possible combinations. A 6-digit PIN has 1,000,000. An alphanumeric password is even stronger. On iPhone: Settings, Face ID and Passcode, Change Passcode, Passcode Options. On Android: Settings, Security, Screen Lock
• Enable biometrics: Face ID or fingerprint unlock is both more convenient and more secure than a PIN alone for daily use, because you actually use it every time (people with short PINs sometimes disable the lock screen entirely because entering it is annoying). Set up Face ID (Settings, Face ID and Passcode) or fingerprint (Settings, Touch ID and Passcode on iPhone; Settings, Security, Fingerprint on Android)
• Set a short auto-lock timeout: 30 seconds or 1 minute. A phone that stays unlocked for 5 minutes while sitting on a table is accessible to anyone who picks it up. iPhone: Settings, Display and Brightness, Auto-Lock. Android: Settings, Display, Screen Timeout
• Disable lock screen notifications preview: By default, message previews show on the lock screen — anyone who picks up your phone can read your texts and emails without unlocking it. iPhone: Settings, Notifications, Show Previews, set to When Unlocked. Android: Settings, Notifications, Lock Screen Notifications, set to Hide Sensitive Content

Two-factor authentication

Two-factor authentication (2FA) protects your accounts even if your password is stolen:

• Apple ID: If you are on a recent version of iOS, two-factor authentication may already be enabled. Check: Settings, your name at the top, Sign-In and Security. If it says Two-Factor Authentication: On, you are set. If not, enable it. This protects your iCloud data, Find My iPhone, Apple Pay, and App Store purchases
• Google Account: Go to myaccount.google.com, Security, 2-Step Verification. Enable it. This protects your Gmail, Google Drive, Google Photos, and all Google services. Use the Google Authenticator app or passkeys rather than SMS codes — SMS can be intercepted through SIM swap attacks
• Banking and financial apps: Enable 2FA on every financial app and website — your bank, payment apps (Venmo, PayPal, Cash App), cryptocurrency exchanges, and investment accounts. These are the highest-value targets for attackers
• Email accounts: Email is the master key to all your other accounts because password resets go through email. Secure your email with 2FA before anything else

Find My Phone

• iPhone: Settings, your name, Find My, Find My iPhone. Enable Find My iPhone, Find My Network (helps locate even when offline), and Send Last Location (sends location to Apple when battery is critically low). This lets you locate, lock, or erase your phone remotely if lost or stolen
• Android: Settings, Security, Find My Device (Google). Make sure it is on. You can locate your phone at android.com/find from any browser. Samsung phones also have Samsung Find: Settings, Biometrics and Security, Find My Mobile
• Test it: After enabling, verify it works by going to icloud.com/find (iPhone) or android.com/find (Android) from another device and confirming your phone shows on the map

App permissions

Apps request permissions to access your camera, microphone, location, contacts, photos, and more. Review what you have granted:

• iPhone: Settings, Privacy and Security. Tap each category (Location Services, Camera, Microphone, Photos, Contacts, etc.) to see which apps have access. Revoke access for any app that does not need it. A flashlight app has no reason to access your contacts. A calculator app has no reason to access your camera
• Android: Settings, Privacy, Permission Manager. Same concept — review each permission category and revoke access from apps that should not have it
• Location access: Location is the most sensitive permission. Set most apps to While Using The App rather than Always. Very few apps genuinely need your location when you are not actively using them. Weather apps, mapping apps, and ride-sharing apps need location while in use. Social media apps, games, and shopping apps rarely need it at all
• Microphone and camera: Review which apps can access your microphone and camera. Both iPhone and Android show an indicator when the camera or microphone is in use (green dot for camera, orange dot for microphone on iPhone; green dot on Android). If you see the indicator when no app should be using them, check your permissions

Automatic software updates

• Software updates patch security vulnerabilities. Running outdated software is one of the highest security risks
• iPhone: Settings, General, Software Update, Automatic Updates. Enable Download iOS Updates and Install iOS Updates. Security Response updates (rapid patches for critical vulnerabilities) should also be enabled: Settings, General, Software Update, Security Responses and System Files
• Android: Settings, System, System Update. Enable automatic updates. Also enable Google Play system updates: Settings, Security, Google Play System Update
• App updates: Enable automatic app updates as well. iPhone: Settings, App Store, App Updates. Android: Google Play Store, Settings, Network Preferences, Auto-update Apps

SIM lock and eSIM protection

• SIM PIN: A SIM PIN prevents someone from removing your SIM card and putting it in another phone to receive your calls and texts (including 2FA codes). iPhone: Settings, Cellular, SIM PIN, enable it (the default PIN is usually 1111 or 1234 — change it immediately after enabling). Android: Settings, Security, SIM Card Lock
• Carrier account PIN: Contact your carrier and set a PIN or password on your account. This prevents SIM swap attacks where an attacker calls your carrier, pretends to be you, and transfers your phone number to their SIM. AT&T, T-Mobile, and Verizon all offer account PINs

Encrypted backups

• iPhone (iCloud backup): iCloud backups are encrypted by Apple by default, but Apple holds the encryption key. For full end-to-end encryption where only you can access your backup, enable Advanced Data Protection: Settings, your name, iCloud, Advanced Data Protection. This encrypts almost all iCloud data with a key that only your devices hold
• iPhone (computer backup): If you back up to a Mac or PC via Finder or iTunes, check Encrypt Local Backup. Without this, the backup file contains your passwords, health data, and other sensitive information in a readable format
• Android (Google backup): Google backups are encrypted. Settings, System, Backup. Make sure backup is enabled. For additional security, use a device with a Titan security chip (Pixel phones) which provides hardware-backed encryption for the backup

Disable tracking and ad personalization

• iPhone: Settings, Privacy and Security, Tracking. Turn off Allow Apps to Request to Track. This prevents apps from tracking your activity across other apps and websites. Also: Settings, Privacy and Security, Apple Advertising, turn off Personalized Ads
• Android: Settings, Privacy, Ads, Delete Advertising ID. On older versions: reset your advertising ID and opt out of personalized ads. Also check Settings, Privacy, Activity Controls in your Google account settings to manage what data Google collects
• Location history: Both Apple and Google store your location history. iPhone: Settings, Privacy and Security, Location Services, System Services, Significant Locations — review and clear. Android: Google Maps, Settings, Personal Content, Location History — pause or delete

Secure your web browsing

• Use a browser that blocks trackers by default. Safari on iPhone blocks cross-site tracking automatically. On Android, Firefox or Brave block trackers. Chrome is improving but still less aggressive about tracker blocking
• Use a password manager (iCloud Keychain on iPhone, Google Password Manager on Android, or third-party managers like 1Password or Bitwarden) instead of reusing passwords across sites. A unique, strong password for every account eliminates the risk of credential stuffing attacks
• Check for compromised passwords: iPhone: Settings, Passwords, Security Recommendations. Android: passwords.google.com, Password Checkup. Both flag passwords that appeared in known data breaches and passwords that are reused or weak

Need help securing your phone?

If you are concerned about your phone security, need help configuring these settings, or suspect your phone may have been compromised, Marion Phone Repair can review your security settings, help you enable protections, and check for signs of unauthorized access or malicious software.