Android security: updates, screen lock and app access controls

A well-configured Android phone already does much of the security work for you. You do not need a stack of extra “antivirus” apps or an unknown hardening file. What actually makes a difference is this: the phone still receives updates, you use a real screen lock every day, apps only have the access they need, and the Google account on the device is treated like a master key.

Menu names vary by manufacturer. The paths below follow Android 15 and 16 and stock-like interfaces such as Pixel. If you have a Samsung phone on One UI 7 or 8, the differences are noted where they matter. Xiaomi, Huawei and others sometimes rename the same screens. If you cannot find an item, open the search field at the top of Settings and type the name.

Updates: the operating system, security patches, Play system updates and apps

An update is not only a new look. Each month the manufacturer and Google ship security patches that close holes later reused in malicious apps. A phone that has not been patched for months is missing that layer even if it still looks fine. You should know three separate things: the Android version itself, the manufacturer’s security patch, and Google Play system updates, which arrive independently of the manufacturer. Apps are a fourth layer.

Before a large update, connect to Wi-Fi and charge the phone to at least about 75 percent. Do not install an update file that arrived in a chat, a channel or a link someone sent you.

How to see the version and patch date

1. Open the Settings app.
2. Go to About phone. On some devices this is About device or About tablet.
3. Tap Android version.
4. Look at Android version, Android security update, Google Play system update and Build number.

The “Android security update” date is the patch level the manufacturer built for this model. If that date is many months old and a check for updates finds nothing, support for the model has probably ended or the manufacturer is very late.

On a Samsung phone: go to Settings > About phone > Software information. There you will see the Android version and the Android security patch level. Installing the update itself usually happens on a separate screen, described below.

Operating-system and security-patch updates

Most phones notify you when an update is ready. If you dismissed the notification or you were offline at the time, you can check yourself.

1. Open the Settings app.
2. Go to System > Software updates. If you do not see “System”, search Settings for “update”.
3. Read the status and, if you see Check for updates or Download and install, tap it.
4. Follow the on-screen steps. Some phones finish installation after a restart.

On Pixel phones, downloaded updates often install in the background and become active after you restart. On many other phones the device restarts by itself to finish the install.

On a Samsung phone:

1. Go to Settings > Software update.
2. Tap Download and install.
3. Install anything waiting for you. You can also leave Auto download on so the file is fetched while you are on Wi-Fi.

When an update arrives depends on the model, the manufacturer and sometimes the carrier. Pixel devices usually receive updates first; others can lag by weeks or months. Factor that delay into the next phone you buy. Some manufacturers now promise several years of system updates and several years of security patches; read that promise on the official page for the exact model, not only in a shop advert.

Google Play system updates

Even after a manufacturer stops shipping new Android versions, Google still updates parts of the system through Play. This layer does not replace kernel and firmware patches from the manufacturer, but it keeps many security components and core services current. It is worth checking on its own.

1. Open the Settings app.
2. Go to Security & privacy.
3. Open System & updates or a similar Updates section.
4. Tap Google Play system update.
5. If there is a button to check or install, use it and wait until you see that the device is up to date or that the install finished.

You can also see the same status under Settings > About phone > Android version > Google Play system update. A fresh date there next to an old “Android security update” means Google’s layer is still moving and the manufacturer’s layer is not.

App updates

Your browser, messenger, banking app and store need updates too. Most phone compromise starts with an outdated or fake app, not with a mysterious attack on the radio.

1. Open the Google Play Store app.
2. Tap your profile icon.
3. Go to Manage apps & device.
4. If you see Updates available, tap Update all or update apps one by one.
5. In the same area or in Play Store settings, turn on automatic updates over Wi-Fi so you do less of this by hand.

An app installed from outside the store will not follow this path and must be updated from its original official source. If you no longer know that source, treat the app as a separate risk.

When the phone is no longer supported

After a manufacturer ends support, a check for updates often says the device is up to date even though the security-patch date no longer moves. Adding a third-party security app does not fix that. In that situation:

• Leave Google Play Protect on and install apps only from a source you trust.
• Keep the browser updated and use Safe Browsing.
• If you can, move highly sensitive work such as banking or work chat to a device that still receives patches.
• Before you buy a replacement, check the official support window.

If you still need this phone and cannot replace it yet, take the rest of this guide seriously: a strong lock, few permissions, a hardened Google account, and no installs from suspicious links in messages.

Screen lock

The screen lock is the first thing standing between a stranger and your photos, chats, email and signed-in accounts. Without it, device finding and storage encryption do much less in practice. Google also requires a PIN, pattern or password — not swipe — if you want backups to be encrypted with your screen lock.

PIN, password or pattern?

Skip the options that do not protect anything: None leaves the phone unlocked and Swipe is only an extra gesture. Of the three real choices:

• PIN: at least 4 digits; a 6-digit or longer PIN is recommended. Longer PINs are harder to guess. Do not use a birthday, a year you started work, a repeated digit or 123456.
• Password: letters and numbers, and symbols if the device allows them. This is usually the strongest choice, especially if someone nearby might see a short PIN or later pressure you to say it.
• Pattern: drawing a line between dots. It is quick, but it leaves an oily trace on the glass and is easier to watch over your shoulder. If you use a pattern, make it complicated and turn off the visible trail in settings.

To set or change the lock:

1. Open the Settings app.
2. Go to Security & privacy. On some devices you will still see only Security.
3. Tap Screen lock. On newer Android versions you may first see Device unlock and then Screen lock.
4. If a lock is already set, enter it.
5. Choose PIN, Password or Pattern.
6. Finish the on-screen steps and unlock once yourself to confirm it works.

If you set a PIN of 6 digits or more, you may see Auto-confirm unlock, which opens the phone without an extra confirmation tap. That is a little more convenient and a little less safe. If you are often in crowded places or people can see the screen, leave it off.

On a Samsung phone:

1. Go to Settings > Lock screen and AOD. On some versions this is simply Lock screen.
2. Tap Screen lock type.
3. Choose a PIN, password or pattern and finish the steps.

Auto-lock timing

Two settings matter, and they are not the same: when the screen turns off, and when the phone actually locks after that. If the screen stays on for a long time and then remains unlocked for several more minutes, leaving the phone on a table is enough for someone else to get in.

1. In Settings > Display, open Screen timeout.
2. Choose a short time such as 30 seconds or one minute, unless the phone stays on your own desk and you are watching it.
3. Return to Settings > Security & privacy and find the setting that locks the phone after the screen turns off. It may sit next to Screen lock or under More security settings.
4. Pick the shortest delay you can live with. For most people, “immediately” or a few seconds after the screen turns off is right.

On a Samsung phone:

1. Go to Settings > Lock screen and AOD > Secure lock settings.
2. Enter your current lock.
3. Set Auto lock when screen turns off to a short time.
4. If you want the phone to lock as soon as you press the side button, turn on Lock instantly with Side button.
5. If you use a pattern, turn off the option that shows the pattern as you draw it.

Many phones also offer a lockdown option in the power menu that turns off fingerprint and face unlock until you enter the PIN or password. Use that if someone might try to open the phone with your finger or by holding it up to your face.

Lock-screen notifications

The text of a message, a sign-in code, a sender’s name or an email preview on the lock screen can be exactly what someone standing next to you needs. Two-step verification codes in particular should not be readable on a dark screen.

1. Open the Settings app.
2. Go to Security & privacy > More security settings > Notifications on lock screen.
3. Choose a mode that hides sensitive content. Depending on the phone, the labels look like “show all notification content”, “hide sensitive content” or “don’t show notifications”.
4. If you also see the same control under Settings > Notifications > Lock screen, match it to the choice you just made.

For especially private apps, such as a work messenger or a banking app, you can also turn off lock-screen notifications inside that app’s own settings.

Fingerprints and face unlock: what they do and where they fall short

A fingerprint or face unlock makes daily use faster and, in ordinary situations, is a good idea. Google also encourages setting up biometrics so someone who picks the phone up off a table cannot get in with a swipe. Biometrics are not a substitute for a strong PIN or password; they sit on top of it. When the sensor is wet, the face is not recognized, or the system wants a sensitive change, you still enter that PIN or password. If the PIN is weak, biometrics only make the phone look safer.

See the limits clearly:

• A fingerprint can be used while you are asleep or if someone forces your finger onto the sensor.
• Face unlock on some devices is weaker with a photograph or in poor light. Newer methods are better, but they are not the same on every phone.
• If there is a real chance of inspection or of being forced to open the phone, turn biometrics off for a while and use only the PIN or password.
• You can also use a fingerprint or face to open sensitive apps, but still rely on the strong device lock underneath.

To add a fingerprint or face on most stock-like phones:

1. Go to Settings > Security & privacy.
2. Open the biometrics section; it is usually called Fingerprint or Face unlock.
3. Enter your screen lock. If you do not have one yet, the phone will ask you to create it first.
4. For a fingerprint, place the finger on the sensor several times until registration finishes. Use the finger you naturally hold the phone with, and add a second finger if the sensor allows it.
5. For face unlock, hold the phone in ordinary light and move it slightly so more angles are recorded.
6. Lock the screen once and unlock with the new method to make sure it works.

On a Samsung phone:

1. Go to Settings > Security and privacy > Biometrics.
2. Choose Fingerprints or Face recognition.
3. Finish the on-screen steps.
4. Come back and confirm that unlocking the lock screen with that method is turned on; only enrolling is not enough.

Use face unlock for payments or a banking app only if you trust the sensor on that model. If you are unsure, keep a PIN or password for money and important accounts.

Encryption of the phone’s storage

On modern Android, device storage is encrypted by default with file-based encryption. When you set a real screen lock (PIN, pattern or password), the keys that unlock that data are tied to the lock. Someone who pulls storage from a powered-off phone, or tries to read the files directly, should not get anything usable without that lock.

Unlike older Android versions, most people no longer need to find an “Encrypt phone” button and wait for hours. Your job is to keep a strong screen lock and not turn encryption off.

To confirm:

1. Go to Settings > Security & privacy > More security settings.
2. Open Encryption & credentials.
3. You should see that the device is encrypted. If you still see a button to start encryption, charge the phone, set aside enough time, and do not power it off in the middle of the process.

Encryption does not replace the screen lock, and the reverse is also true. Without a lock, data is available while the device is on. Encryption of the phone also does not hide cloud messages, backups or the Google account; those need their own protection.

Finding the device and erasing it remotely

The service Google now calls Find Hub is what many people still know as Find My Device. If you signed in with a Google account it is usually on by default, but you should check once yourself. It only helps if it was set up before the phone leaves your hands.

To find, lock or erase the device later, the phone needs power, a mobile-data or Wi-Fi connection, a Google account, and Find Hub turned on. Location also needs to be available at least enough for this service to work.

To confirm it is on:

1. Open the Settings app.
2. Tap Google > All services.
3. Open Find Hub or Find My Device.
4. Make sure the service is turned on.
5. If you are asked to allow location for finding the device, allow it. Without location, the map later has nothing to show.

Write down the phone’s unique number somewhere that is not only on the phone itself. A carrier can use it to suspend service, and you may be asked for it if you report a theft:

1. Go to Settings > About phone and find the IMEI.
2. You can also type *#06# in the phone app to display it.
3. Keep a copy in a safe place, such as an encrypted note or a paper at home, not in an unlocked photo album.

If the phone is lost or you think it was stolen:

1. On a computer or another phone, go to android.com/find, or open the Find Hub app on another device.
2. Sign in with the same Google account that is on the missing phone.
3. Select the device. If it is online, you should see an approximate location. If it is not, you may still see the last known place.
4. If the phone might be under furniture at home, tap Play sound. It rings at full volume for several minutes even if the phone is on silent.
5. If you are sure it is gone, Mark as lost. That locks the screen and lets you put a message and a way to contact you on the lock screen. Notifications and quick settings on the lock screen are restricted.
6. If you no longer expect to get the device back and you are more worried about the data on it, use Factory reset in that device’s settings in Find Hub. This erases data on the phone. It does not necessarily erase a removable SD card. After the wipe, you will not be able to track that device in this service any more.

A remote wipe cannot be undone. If the phone turns up later, you will need the Google account password to set it up again. So play a sound and lock it first; choose erase when the contents matter more than finding the device.

On a Samsung phone: besides Google’s service, Samsung has its own. On One UI 7 the usual path is Settings > Security and privacy > Lost device protection. Turn on the option that allows this phone to be found. You can also find, lock or erase the device through your Samsung account and Samsung’s official find service. If you have both services, you do not need to turn one off for the other; just make sure at least one is on and tied to an account whose password you know.

Theft protection, Identity Check and remote lock

Newer Android versions include a set of features called Theft protection for when someone snatches the phone, cuts it off from the internet, or tries to change sensitive settings quickly. These features are not the same on every model. They are not supported on some Android Go devices, tablets and wearables, and they need a screen lock. If a switch is greyed out, that model does not support it.

To open the set:

1. Open the Settings app.
2. Tap Google > All services.
3. Under personal and device safety, open Theft protection.

On a Samsung phone with One UI 7 or later:

1. Go to Settings > Security and privacy.
2. Open Lost device protection.
3. Tap Theft protection.

Theft Detection Lock

This option uses motion sensors, Wi-Fi and Bluetooth to try to tell that the phone was suddenly taken from you and is moving away. If it detects that kind of movement, it locks the screen at once so there is no time to change the PIN or browse your apps. It is not active when the screen is already locked. To avoid locking the phone during ordinary use, it may also be less sensitive when you have a stable Wi-Fi or Bluetooth connection.

1. Open the Theft protection screen.
2. Turn on Theft Detection Lock.
3. If the screen later locks while you are running or moving quickly, unlock it as usual and carry on.

Offline Device Lock and Failed Authentication Lock

A thief will often cut the internet first so you cannot find the device. Offline Device Lock is built so that if the phone is unlocked and then drops offline, it locks itself after a short time. There is a limit on how often this can happen in 24 hours, so it does not replace your normal lock.

1. On the same Theft protection screen, turn on Offline Device Lock.
2. On Samsung, if you are asked to confirm or accept terms, read them and confirm.

If you see Failed Authentication Lock, turn that on too so repeated failed attempts lock the device and cut down on guessing.

Remote Lock with your phone number

If you cannot reach your Google account at that moment, you can lock the screen remotely with your verified number. You need a screen lock, an active SIM and a verified number on the device, Find Hub turned on, and the phone at least able to come online later. If it is offline when you send the request, it locks when it next connects. After that, it can be unlocked only with the screen lock on the device itself.

To turn it on:

1. On the Theft protection screen, tap Remote Lock.
2. Turn on Remote lock.
3. If the number is not verified, tap Verify number and turn on automatic verification of phone numbers.
4. Optionally add a security question so that only you can send a lock request from the website.

When the phone is gone:

1. In a browser, go to android.com/lock.
2. Enter the phone number.
3. Complete the image challenge.
4. If you set a security question, answer it and send the lock request.

This only locks the screen. To erase data you still need to sign in to Find Hub with the Google account.

On a Samsung phone: you will find the same option at Settings > Security and privacy > Lost device protection > Theft protection > Remote lock. Turn on the switch to use remote lock.

Identity Check and trusted places

On the Theft protection screen you may also see Identity Check. When you are away from trusted places such as home or work, this stricter layer stops accepting a PIN or pattern for sensitive actions and asks for a fingerprint or face instead. The point is that if someone saw or obtained your PIN, they should not be able to remove the Google account, turn off Find Hub or factory-reset the phone on the spot.

Actions that typically need biometrics in this mode include viewing passwords and passkeys in Google Password Manager, changing the screen lock, changing fingerprints or face unlock, factory resetting, turning off Find Hub or theft protection itself, adding or removing a Google account, opening Developer options, and setting up a new device from this phone. Private space and some browser actions may still accept a PIN.

To turn it on:

1. In Theft protection, tap Identity Check.
2. Sign in to a Google account and add a screen lock and biometrics if you do not already have them.
3. Add trusted places such as Home or Work, and verify your phone number if you want easier account recovery.
4. Tap Done.

On a Samsung phone: the path is Settings > Security and privacy > Lost device protection > Theft protection > Identity check. You need biometrics and a Samsung account. Outside your safe places, changing sensitive settings may also start about an hour of security delay after the biometric check — for example when you turn Identity check off, change biometrics, change the lock screen, turn off Find My Mobile or edit safe places. That delay is intentional, so you have time to lock or erase the phone from another device if it was stolen.

If you do not see this option, the device does not support it. Do not look for an unofficial version.

Private space and Samsung Secure Folder

From Android 15 you can create a separate space on the same phone and put sensitive apps there. While that space is locked, its apps disappear from the launcher, search, recents and even some permission screens, and they stop running in the background. A medical or messaging app inside the space will not show notifications or read sensors until you unlock it. That makes the space a poor choice for anything that must stay alive in the background.

Private space is not available on a managed work device, on a secondary or guest user, or when the device already has more than four users or profiles. Some manufacturers also leave it out. You cannot completely hide it from someone who connects the phone to a computer with debugging tools; it is meant to keep casual observers out, not to hide everything from someone with low-level access to the device.

Set up Private space

1. Go to Settings > Security & privacy.
2. Under Privacy, tap Private space.
3. Authenticate with the device screen lock. If you do not have one, you will be asked to create it.
4. Tap Set up and then Got it.
5. If you add a Google account, it is safer to use a separate account created for this space, not the same account you use every day in the main space. Using the same account can let photos, email, contacts, download history and some suggestions appear outside the space.
6. Choose a lock for the space: the same as the device lock, or a new PIN, pattern or password.
7. Tap Done.

Lock, hide and install apps in Private space

To lock it yourself, scroll to Private space in the app list and tap the lock icon. To set automatic locking:

1. Open Private space and unlock it.
2. Tap the settings icon next to it.
3. Tap Lock private space automatically.
4. Choose Every time device locks, 5 minutes after screen timeout, or Only after the device restarts.

If you also want the Private space container itself hidden when it is locked:

1. Open Private space settings.
2. Turn on Hide private space when it’s locked.
3. The container disappears the next time you lock the space. To come back, open Private space from the app list or go to Settings > Security & privacy > Private space.

To install an app in the space, unlock it first, then either:

1. tap Install inside the space and install from the store there, or
2. touch and hold an app in the main list and choose Install app in Private space.

That creates a fresh copy of the app; it does not move the data from the copy outside. You can copy or move files in, but a transfer stops if the space locks while it is running.

If you forget the Private space lock there is no separate recovery path. You would have to delete the space, and the content on the device goes with it. You can delete it from the space’s own settings, or from Settings > System > Reset options > Delete private space. Google deliberately shows a reset option even if you never created a space, so someone else cannot tell whether you have one.

If you have a Samsung phone: Secure Folder

Many Samsung phones offer Secure Folder instead of Android’s Private space, or alongside other features. It is a separate container with its own lock, used for sensitive apps, photos and files.

1. Go to Settings > Security and privacy > More security settings > Secure Folder.
2. Follow the steps if a Samsung account is required. On many models it is.
3. Choose a lock type for the folder: PIN, password or pattern, and a fingerprint if you want one.
4. After it is created, install sensitive apps inside it or copy them in from outside.
5. Set automatic locking so the folder closes when the phone locks or after a short time.

Like Private space, Secure Folder is not a substitute for a separate phone or a completely separate account. It is an isolation layer on this device.

App permissions and the permission manager

Each app must ask before it uses the camera, microphone, location, contacts, SMS or files. A flashlight does not need SMS, and a decorative wallpaper rarely needs precise location all the time. A permission that goes beyond what the app does is one of the most common signs of a careless or hostile app.

Treat the accessibility permission as a special case. It can read what is on the screen, tap instead of you and in practice hand control of the phone to the app. Give it only to a tool that truly needs it for accessibility or a clearly defined job, not to every “optimizer” or unknown file.

Change one app’s permissions

1. Go to Settings > Apps.
2. If you do not see the full list, tap See all apps and select the app.
3. Tap Permissions.
4. Open the permission you want to change and choose Allow or Don’t allow.
5. For location, camera and microphone you usually also have finer choices: Allow all the time (mostly for location), Allow only while using the app, Ask every time and Don’t allow.

Give location “all the time” only when the app is genuinely broken without it, such as finding the device or certain maps. For everything else, “only while using” or “ask every time” is the better default.

See which apps have a particular permission

1. Go to Settings > Security & privacy > Privacy > Permission manager.
2. Open a permission type, such as Camera, Microphone, Location, SMS, Phone, Contacts, Files, Photos and videos, or Calendar.
3. Look at the apps that have that permission.
4. Tap any app that should not have it and tighten or remove the access.

If you want no app to use the camera or microphone for a while:

1. Go to Settings > Security & privacy > Privacy > Privacy controls.
2. Turn off Camera access or Microphone access.

That global switch is useful in a meeting or while travelling when you do not want any app to have a chance to listen. Remember to turn it back on later or video calls will fail.

Apps you no longer use

An unused app still takes space and may keep an old permission. Android can pause those apps and take the permissions back.

1. Go to Settings > Apps and open the app.
2. Under unused app settings, turn on Pause app activity if unused.
3. If you no longer want the app at all, tap Uninstall. Some system apps can only be disabled; if you do not need them, disabling is better than leaving them with every permission intact.

Every so often, scroll the full app list. Anything you do not remember installing should be checked: install date, permissions and install source.

Install apps only from a source you trust

Android can technically install apps from outside the official store. That flexibility is sometimes necessary, for example when a store hides an app in your region or the developer’s own site is the real source. The same flexibility is also the most common way a fake, modified or spyware app arrives. Take seriously any message that sends a “new version” as a file, any fake sign-in page with an install button, and any banking app advertised outside its real source.

Google Play Protect

Play Protect checks Play Store apps before you install them, also scans the device for harmful apps from other sources, warns you, and in some cases disables or removes an app. It does not see every threat, especially tools built to target one person, but turning it off without a clear reason is unwise.

To check the status and run a scan:

1. Open the Google Play Store app.
2. Tap your profile icon.
3. Open Play Protect.
4. Run a scan if one is offered and read any warnings.
5. Open the settings on that screen and leave Scan apps with Play Protect turned on.
6. If you sometimes install apps from outside the store, you can also turn on improved harmful-app detection so unknown files are sent for analysis. That trades a little privacy for a little more detection; decide that trade-off yourself.

Installing from outside the store and unknown sources

On recent Android versions, the right to install from an unknown source is not a single switch for the whole phone. Each app that wants to install a package — a browser, a file manager, a messenger — must be allowed separately.

1. Go to Settings > Apps > Special app access > Install unknown apps. If you cannot find that path, search Settings for “unknown” or “unknown sources”.
2. Open the list of apps that are allowed to install other apps.
3. Turn the permission off for any app that does not need it right now. In particular, turn it back off for a messenger or browser after a one-off install.
4. If a prompt says this source is not allowed, go into settings and grant it only when you obtained the file from a place you truly trust.

The simple rule is: the official store or the developer’s own site first. If you have to take a file from somewhere else, confirm the source through a separate channel, not through the same message that sent the file. Do not install a banking app, an authenticator or anything that wants SMS or accessibility access from a random source.

Google account security, 2-Step Verification and passkeys

The Google account on the phone is not only for the store. The same account often unlocks Gmail, files, contacts, backups, Find Hub and many other sign-ins. Someone who gets into that account can manage the device remotely or get past protection after a reset. So the account’s security is part of the phone’s security.

To review the account:

1. Go to Settings > Google.
2. Open Manage your Google Account.
3. Open the Security tab.
4. If you see a security checkup, run it and look through devices, recent sign-ins and recovery methods one by one.
5. Change the password to a unique phrase you do not reuse anywhere else. If you use a password manager, let it create and store that password. The guide to choosing a password manager covers that choice.

To turn on 2-Step Verification:

1. In the same Security tab, open 2-Step Verification.
2. Start the setup and choose a primary method.
3. If you can, rely on an authenticator app, a security key or a passkey rather than SMS alone. SMS can be redirected with your SIM, so it is a weaker layer, though it is still better than nothing.
4. Save backup codes or backup methods at once in a safe place, not in an unlocked gallery on this phone.
5. The guide to two-factor authentication has more on choosing a method and a recovery plan.

A passkey lets you sign in with the device lock or biometrics instead of typing a password. On services that support it, a typical phishing page has a much harder time stealing that sign-in.

1. In Google Account security, open Passkeys or Passkeys and security keys.
2. Create a passkey on this phone.
3. If you use the same account on another device, check that a passkey exists there too, so you still have a way in if this phone is gone.

From time to time, review the devices signed in to the account and sign out any you do not recognize. Change the password after that.

Backups

If the phone is lost, stolen or reset, you only get back what was already stored somewhere else. Android’s backup sits in your Google account, and some of that data is encrypted with your screen lock. Photos that go to Google Photos follow a separate path. Syncing contacts or photos does not by itself mean every message and every app setting is saved.

To turn on or review the backup:

1. Go to Settings > Google > All services.
2. Under backup and restore, tap Backup.
3. Turn backup on and see which account it uses. If you have several accounts, pick one you control, not a shared work account.
4. Read the details: apps and some app data, call history, contacts, device settings and SMS are commonly included. Not every app saves all of its data.
5. To take a fresh copy, tap Back up now and wait until you see that it is on, or until a latest-backup time appears.

On some phones Settings > System > Backup still opens the same screen. Samsung may also offer a separate backup through a Samsung account; if you use that, be just as careful about which account it uses and what it includes.

Free Google storage is limited and shared with Gmail and photos. Private space is usually not restored as part of a device backup. The guide to backups you can restore has more on making a copy that actually comes back.

Wi-Fi, Bluetooth, NFC and location

Radios that stay on all the time drain the battery and widen the attack surface: fake networks, unwanted pairing, accidental payments and location tracking. You do not have to turn everything off forever. Leave each radio on when you need it, and do not leave old networks or devices sitting in the list.

For Wi-Fi:

1. Go to Settings > Network & internet or, on Samsung, Settings > Connections > Wi-Fi.
2. Open saved networks and forget old hotel, airport and public networks you no longer need.
3. Open your home network and, if you see a privacy or randomized MAC address option, leave it on so the phone does not broadcast one fixed identifier on every network.
4. Turn off automatic connection to open networks if that setting exists. Avoid networks with no password unless you have no choice, and do not do sensitive work such as banking on them.
5. If you use public networks often, at least stick to encrypted connections (addresses that show as secure in the browser) and, if you need it, a tool you trust to tunnel the traffic.

For Bluetooth:

1. Go to Settings > Connected devices or, on Samsung, Settings > Connections > Bluetooth.
2. Unpair devices you no longer use.
3. Do not accept a pairing request you did not start.
4. When you are not using headphones or a watch, turn Bluetooth off from Quick Settings.

For NFC, which is used for tap-to-pay and some cards:

1. Find the NFC tile in Quick Settings, or go to Settings > Connected devices > Connection preferences > NFC.
2. On a Samsung phone: the usual path is Settings > Connections > NFC and contactless payments.
3. If you do not use tap-to-pay, leave NFC off.
4. If you do use it, make sure payment requires the screen lock and that the default payment app is the one you chose.

For location:

1. Go to Settings > Location.
2. See whether location is on for the device. Find Hub needs it to locate the phone; that does not mean every app should have precise location all the time.
3. From the same screen or from the permission manager, see which apps have location access and take “all the time” away from apps that only need it while they are open.
4. If you care about leaving a smaller trail even when location is off, review Wi-Fi and Bluetooth scanning used to improve location and limit it if you want to.

Developer options and USB debugging

The developer menu is built for app developers and troubleshooting, not for everyday use. When that menu — and especially USB debugging — is on, a computer attached to the phone can do more than charge it. If you are not deliberately using those tools, the whole menu is better off.

If the menu is already on, or you want to close it after a job:

1. Go to Settings > System > Developer options. On some phones the same screen is near the top of Settings.
2. If you do not see it, the menu is already off and you are done.
3. If you do see it, first turn off USB debugging.
4. If there is an option to revoke USB debugging authorizations, use it so previously allowed computers drop off the list.
5. Turn off the main Developer options switch as well.

If you ever need to open the menu for a while:

1. Go to Settings > About phone.
2. Tap Build number several times until you see the message that you are now a developer. Seven taps is the usual number.
3. On a Samsung phone: the build number is under Settings > About phone > Software information.
4. Change only the specific setting you need, then turn USB debugging and the menu itself off again when you finish.

When you plug a cable into a computer, choose charge-only if you are asked, not file transfer. On newer Android versions, USB access is more limited while the screen is locked; that is another reason to keep a real screen lock. Do not turn on OEM unlocking or bootloader unlocking unless you know exactly why you need it. That opens the door to unofficial software and removes a layer of device protection.

The SIM PIN and eSIM

The SIM is not only for signal. Your number, some SMS codes and sometimes account recovery are tied to it. If the phone is stolen and the SIM can move to another device without a PIN, that number may go with it. The SIM PIN is separate from the screen lock and is asked for when the device starts or when the SIM is put in another phone.

1. Go to Settings > Security & privacy > More security settings.
2. Tap SIM lock and then Lock SIM.
3. Enter the current PIN. Many carriers ship a default PIN that is printed in the packaging or available from support, and that default may be widely known. Change it to a PIN only you know.
4. Write the new PIN down somewhere other than the phone. Too many wrong attempts lock the SIM, and you will need the carrier’s backup code (sometimes called PUK) to unlock it.

If you use an eSIM instead of a physical card:

1. Go to Settings > Network & internet > SIMs. On a Samsung phone this is usually Settings > Connections > SIM manager.
2. See which line is downloaded on the device and what it is called.
3. If a SIM lock is available for the eSIM, turn it on just as you would for a physical card.
4. Before you sell or replace the phone, move the line to the new device with your carrier’s help and delete the eSIM from this phone so the number does not stay on a device you no longer have.

A carrier-side SIM swap is a separate risk. Ask the carrier what lock or extra confirmation they offer for changing the SIM, and turn on any alert they provide for SIM changes.

Safety Check and the Security & privacy dashboard

Security & privacy in Settings is not only a nested list; it is the device’s status dashboard. The top of that screen usually shows warnings: no screen lock, Play Protect off, an update waiting, or a permission that looks excessive. Open those warnings first and deal with them one by one.

1. Go to Settings > Security & privacy.
2. Open each red or yellow warning at the top and follow the suggestion, or dismiss it only if you have a clear reason.
3. Open the privacy section and look at the Privacy dashboard. It shows which apps have recently used location, the camera or the microphone.
4. If you see an app that should not have been using a sensor at that time, jump to its permission and restrict it.

The Google account has its own checkup:

1. Go to Settings > Google > Manage your Google Account > Security, or open the account security checkup in a browser.
2. Review sign-in methods, saved devices, and recovery phone numbers and email addresses.
3. Remove any recovery method that is no longer yours, such as an old number.

On Android 16, some devices also offer Advanced Protection, which gathers several layers in one place: the theft-related locks, tighter USB limits while the screen is locked, and stronger protection against harmful sites and apps. If you see it under Settings > Google > All services and you prefer more security than convenience, read the description and turn it on. It is not available on every phone.

The browser and Safe Browsing

A lot of account theft and infection starts with a fake page, not with a direct app install. If you use Chrome, leave Safe Browsing on. Standard protection warns you about known threats; Enhanced protection is stricter and may send more information to Google for checking.

1. Open Chrome.
2. Tap the more menu (three dots) and open Settings.
3. Go to Privacy and security > Safe Browsing.
4. Choose Enhanced protection, Standard protection or No protection. Do not use No protection.

If Chrome warns you that a page is unsafe, do not visit it and do not download the suspicious file. Check the connection details in the address bar, and type a password only on an address you opened yourself or from a bookmark you trust, not from a link in a message.

If you use another browser, find the equivalent protection in its privacy or security settings and leave that on too. Keep the browser updated from the official store like any other app.

Signs of compromise and what to do

No list is complete, but some signs are worth stopping for: an app you do not remember installing; fresh requests for accessibility or device-admin access; a two-factor prompt you did not start; a sudden jump in battery or data use with no explanation; ads appearing over every app; a keyboard or sign-in screen that looks like yours but came from somewhere else; SMS messages sent without you; or parts of Settings that no longer open.

If you suspect the device, do not change important passwords on that phone and do not sign in to new accounts there. Start from another device you trust:

1. From a computer or a healthy phone, sign in to the Google account, change the password, close unknown sessions and devices, and run the security checkup.
2. Do the same for email, social networks, banking and your main messengers. If someone may have controlled the SIM or SMS, strengthen recovery methods that are not based on SMS.
3. On the suspect phone, run a Play Protect scan and take any warning seriously.
4. Go to Settings > Apps, uninstall unknown apps, and under special app access see which apps have accessibility, display-over-other-apps or device-admin rights. Turn off and remove any you do not recognize.
5. Review camera, microphone, location, SMS and phone permissions in the permission manager again.
6. If the signs are serious, or an unknown app gained high-level access, factory-reset the device after a careful backup. Restore that backup only if you are confident the infection will not come back with it; do not reinstall the suspicious app.
7. If you think you were singled out for a targeted attack, replacing the device or getting help from someone who does this work is more sensible than stacking random scanners on the same phone.

After you have the situation under control, tell people who may have received messages from your account, and if money or sensitive data was lost, follow the official reporting path for that service.

Secure deletion and a factory reset before you sell the phone

Deleting a few apps or emptying the gallery is not enough before you sell the phone, give it away or leave it at a repair shop. A factory reset removes accounts and app data from the device storage. Because the storage is encrypted, wiping the keys makes the old content practically unrecoverable. This does not necessarily erase a removable SD card; take that card out and wipe it separately, or keep it.

Before you reset:

1. Make sure you know the Google account password and the screen lock. Sign in to that account once on another device so you are not surprised. If you recently changed the Google password, it is better to wait about 24 hours.
2. Take a fresh backup and check that photos, contacts and conversations you care about also live somewhere else.
3. If you have a digital wallet or a transit card on the device, back it up from that app or move the balance. On Android 15 and later the system may remind you of this before a reset.
4. Move an eSIM to the new device if you need the number, then delete it from this phone.
5. Unpair watches, headphones and other Bluetooth accessories.
6. Charge the phone to at least about 70 percent and leave it on the internet so you can confirm the account after the reset if needed.

On most phones the reset itself looks like this:

1. Go to Settings > System > Reset options.
2. Tap Erase all data (factory reset).
3. Read the explanation, enter the screen lock and confirm the erase.
4. Wait until the device starts and shows the initial setup screen.

On a Samsung phone:

1. Go to Settings > General management > Reset.
2. Choose Factory data reset.
3. Enter the Samsung account or screen lock if asked, and confirm that everything should be deleted.

When you reset from inside Settings while you can unlock the phone, the device is ready for the next person. If someone resets a locked phone, Google account protection usually asks for the previous account during setup; that is the layer that makes stealing and wiping the device pointless. That is also why the Google account should not be left with a weak password.

After the reset, go as far as the welcome screen and confirm that your account name is no longer on the device. If you have an SD card, format it separately or remove sensitive content from it beforehand.

Closing checklist

1. Look at the security-patch date, the Google Play system update and the Android version under About phone, and install anything that is waiting.
2. Update apps from the store.
3. Set a long PIN or a password, shorten the lock delay, and hide message previews on the lock screen.
4. Set up a fingerprint or face unlock if you want them, but keep relying on the strong lock underneath.
5. Leave Find Hub on and write the IMEI down somewhere other than the phone.
6. Review and turn on Theft Detection Lock, Offline Device Lock and, if available, Identity Check.
7. If you are on Android 15 or later, put the most private apps in Private space; on Samsung, use Secure Folder if Private space is not there.
8. Review the permission manager, remove or pause unused apps, and do not give accessibility access to an unknown app.
9. Leave Play Protect on and keep installation from unknown sources off except during one specific install.
10. Give the Google account a unique password, 2-Step Verification and, where you can, a passkey, and review signed-in devices.
11. Take a fresh backup and see which account it uses.
12. Clean up old Wi-Fi networks, unused Bluetooth devices and NFC, and tighten location permissions.
13. Turn off Developer options and USB debugging if you do not need them.
14. Change the SIM PIN and check the eSIM status.
15. Walk through the warnings on the Security & privacy dashboard and the Privacy dashboard.
16. In Chrome, set Safe Browsing to Standard or Enhanced protection.
17. Before you sell or hand the phone over, back it up and factory-reset it from Settings.

If you only have a short time today, finish these four: install the patches, strengthen the screen lock, leave device finding on, and look at permissions and extra apps. You can work through the rest of the list section by section.