The moment you unbox a new phone, you’re presented with a clean interface, a promise of performance, and an array of default settings that prioritize convenience over security. Most people never change them. They swipe through setup, tap “Agree” without reading, and begin using their device exactly as the manufacturer intended.

That’s a mistake.

The default configuration isn’t designed to protect your privacy. It’s designed to get you using the phone as quickly as possible and, in many cases, to share your data with the company that made it. A few minutes of adjustments can dramatically improve your security posture without sacrificing the features you actually need.

The First Line of Defense: Your Lock Screen

The lock screen is your device’s front door. If it’s weak, everything inside is vulnerable.

Set a Strong Screen Lock

Most phones ship with a simple swipe-to-unlock option, which offers virtually no protection. Setting a PIN, password, or pattern should be the first thing you do. Choose a PIN of at least six digits, and avoid obvious combinations like “123456” or your birthday. Biometric options like fingerprint scanning and facial recognition offer convenience, though the biometrics on some devices are less secure than a complex password .

Hide Notification Content on the Lock Screen

By default, your phone displays the full content of messages and app alerts on the lock screen. Anyone who glances at your device can see sensitive information. In Settings > Notifications, look for lock screen notification options and choose to hide content. You’ll still see that a notification arrived, but the details will stay private until you unlock the phone .

Reduce Screen Timeout

Set your screen to lock after 15 seconds of inactivity rather than the default 30 seconds. This small change reduces the window during which someone could access your device if you walk away briefly .

Google Account Security: The Gateway to Everything

Your Google account holds more information than most people realize: emails, photos, contacts, location history, and saved passwords. Securing it should be a priority.

Enable Two-Factor Authentication

Two-factor authentication adds a second layer of verification beyond your password. Even if someone learns your password, they can’t access your account without the second factor. Google has pushed for this on most accounts, but it’s worth confirming. In Settings, tap your profile picture, go to Manage Your Google Account > Security, and check that 2-Step Verification is enabled. Using an authenticator app is more secure than SMS-based verification .

Set Up Passkeys

Passkeys offer a phishing-resistant alternative to passwords. They use your device’s screen lock (fingerprint, face, or PIN) to authenticate you. Once set up, you can log in without entering a password at all. You’ll find this option in the same Security section of your Google Account settings .

Check Your Google Account Privacy Settings

Google tracks a staggering amount of data by default: your search history, location, voice commands, and YouTube activity. Visit myaccount.google.com, go to Data and Privacy, and review History Settings. Turn off Web & App Activity, Timeline, and YouTube History if you don’t want this data stored .

App Permissions: Who’s Looking at What

Apps request permissions for a reason. Sometimes it’s legitimate. Often, it’s not.

Review Permission Manager

Go to Settings > Security & Privacy > Permission Manager. You’ll see every permission category and which apps have access. Pay special attention to location, camera, microphone, and contacts. For each app, ask yourself: does this app genuinely need this permission to function? If not, revoke it .

Set Location Permissions to “While Using” or “Never”

Location data is particularly sensitive because it reveals where you live, work, and spend your time. For most apps, set location access to “Only while using the app.” For apps that don’t need location at all, choose “Never.” This prevents them from tracking you in the background .

Enable Clipboard Access Alerts

Apps can quietly read whatever you’ve copied to your clipboard, which may include passwords, addresses, or credit card numbers. Android offers a setting that alerts you when an app accesses the clipboard. Go to Settings > Security & Privacy > Controls and Alerts and turn on “Alert when clipboard accessed.” If you receive alerts from apps that shouldn’t need clipboard access, remove those apps .

Remove Permissions from Unused Apps

Android now automatically revokes permissions from apps you haven’t used in a while. But you can proactively review old apps and remove them or restrict their permissions. A flashlight app doesn’t need your location or contacts .

Theft Protection: When Your Phone Falls Into Wrong Hands

Theft is one of the most common ways people lose control of their data. Modern phones offer built-in protections that can make a stolen device nearly useless to thieves.

Turn On Theft Detection Lock

Android 10 and newer include Theft Detection Lock, an AI-powered feature that detects motions commonly associated with theft, like someone snatching the phone from your hands. When triggered, it locks the screen immediately, preventing access to your data. Find this under Settings > Google > All Services > Theft Protection .

Enable Offline Device Lock

Thieves often turn off internet access to prevent you from locating the device. Offline Device Lock locks the screen if the phone remains disconnected from the internet for a prolonged period. This means even offline, your data stays protected .

Activate Remote Lock

If your phone is stolen and you’re panicking, you might forget your PIN. Remote Lock lets you lock your phone using just your phone number and a security challenge. You don’t need your password or another device. This gives you time to find your device or erase it remotely. Enable it in the same Theft Protection menu .

Ensure Find My Device Is Active

Find My Device helps you locate, lock, or erase your phone remotely. It’s turned on by default when you add a Google account, but confirm it’s active under Settings > Google > All Services > Find My Device .

Enable Identity Check (Android 16+)

Android 16 introduced Identity Check, which requires biometric authentication for sensitive actions like changing your PIN or disabling theft protection features. The catch: this extra layer only activates when your phone is outside a trusted location, such as your home or office .

Android 16’s Hidden Security Boost: Advanced Protection

Android 16 includes a feature called Advanced Protection that bundles several security measures into a single toggle. It’s easy to enable, but it’s turned off by default .

What Advanced Protection Does

When enabled, Advanced Protection activates:

• Device Safety: Theft Detection Lock, Offline Device Lock, and inactivity reboot (which restarts the device if it remains locked for three days)
• Apps: Google Play Protect for scanning malware, blocking installations from unknown sources, and memory protection against certain exploits
• Networks: Avoidance of insecure 2G networks
• Web: Safe Browsing protection and warnings before visiting non-HTTPS sites
• Phone by Google: Spam call identification and automatic call screening
• Google Messages: Spam filtering and warnings about suspicious links 

How to Enable It

Go to Settings > Security & Privacy, scroll down to Advanced Protection, and toggle on Device protection. A pop-up will confirm your choice, and you’ll need to restart your phone to complete the process .

The feature was designed with high-risk users in mind, but it offers benefits for anyone who wants stronger security. If it interferes with your usage, you can disable it later.

Network Security: What Your Phone Connects To

Disable Automatic Connections

By default, your phone may automatically connect to open Wi-Fi networks. This is convenient but dangerous. Unsecured networks can expose your traffic to attackers. Turn off automatic connections and choose networks deliberately .

Turn Off Bluetooth and Wi-Fi When Not in Use

Leaving Bluetooth and Wi-Fi enabled exposes your device to potential attacks. When you’re not actively using these features, disable them. If you want Bluetooth on for convenience, enable the “ask before connecting” option to prevent automatic pairing with unknown devices .

Opt Out of Diagnostic Data

Your phone sends diagnostic and usage data to Google by default. This is meant to improve Android, but it also shares information about how you use your device. Go to Settings > Security & Privacy > More Privacy Settings > Usage & Diagnostics and turn it off .

Delete Your Advertising ID

Every phone has a unique advertising ID that helps apps and advertisers build a profile about you. You can’t stop ads, but you can make them less personalized. Under Settings > Privacy > Ads, delete your advertising ID and disable ad personalization options .

Location Tracking

Location services are essential for navigation and certain apps. But by default, your phone tracks your location history continuously. Open your Google Account settings, go to Data and Privacy, and turn off Timeline to stop Google from storing your location history. For individual apps, restrict location access to “while using” rather than “always” .

The Foundation: Keep Your Phone Updated

Security patches are issued regularly to address vulnerabilities that criminals actively exploit. System updates may be automatic, but it’s worth checking periodically. On Android, go to Settings > System > Software Update. On iOS, go to Settings > General > Software Update .

Start with Security, Not Convenience

Most phone defaults are chosen for ease of use. The manufacturer wants you to have a smooth experience out of the box. But that trade-off, convenience over security, leaves you exposed. Setting up a passcode, reviewing app permissions, enabling theft protection, and turning off unnecessary connections doesn’t take long. It doesn’t break anything. It simply shifts the balance toward protecting what’s yours.