A secure phone setup has three parts: control access to the handset, protect the accounts it opens, and prepare for losing it. Start while the phone is in your hand and you can still sign in.
This guide is for personal iPhones and Android phones. Have the phone, its Apple or Google account, your carrier details and another trusted device available. For an employer-managed phone, involve the administrator before changing management, backup or erase settings. Menu names and supported features vary by model and software version.
Set a usable security baseline
- Update the operating system and apps. Open the phone's software-update settings and check the installed version. Enable automatic updates where available, and complete requested restarts. Check the manufacturer's support policy if updates have stopped.
- Use a strong screen lock. Choose a passcode you can remember without using a birthday or repeated digits; enable supported fingerprint or face unlocking for convenience. Keep the underlying passcode private and reduce how much message content appears on the locked screen.
- Review app access. In privacy or permission settings, inspect location, photos, contacts, microphone and camera access. Give each app the access its task needs; test it after changing a permission. Remove apps you no longer use.
- Protect the main account. Check the recovery email and phone number, enable a suitable additional sign-in method, and inspect signed-in devices. Your email account often controls recovery for other services.
A short auto-lock interval helps when you put the phone down. A biometric unlock is convenient, while account recovery and the device passcode still deserve deliberate protection. Use the authentication and recovery guide to plan that second layer.
Check the recovery and theft settings
On iPhone, check Find My and review Stolen Device Protection in the passcode settings if the phone supports it. Apple's lost-device guidance explains that Find My must be enabled before loss for remote Lost Mode and erasure. Test that the correct phone appears from another trusted device or at iCloud Find Devices.
On Android, open Google's Find Hub guidance and confirm the phone appears in your account. Under Google services, review Theft protection. Google documents device and version limits for Theft Detection Lock, Offline Device Lock, Remote Lock and Identity Check. A missing or unavailable setting can indicate unsupported hardware or software; record which features your phone actually offers.
Finding a location and delivering a remote command have different requirements. A recently reported location can be old. Read the device's status and timestamp, and check whether a lock request is pending or completed.
Verify the data you would need tomorrow
Check the last successful backup and the categories it includes. On iPhone, Apple's iCloud backup instructions show where to start a backup and see its completion time. On Android, inspect Backup details; Google notes that app restoration and data coverage vary.
Make a short recovery inventory: contacts, photos, messages, documents, password manager and authenticator app. For each, identify whether it is synced, backed up or requires its own transfer procedure. Open a sample photo and document from the intended recovery location on another device. That checks those files, while a complete restore requires a separate test.
If the phone is missing
- Use a trusted device and the official finding service. Check the device identity and timestamp, then request Lost Mode or Mark as lost. Use a contact number you can still answer. For a likely theft, contact local police; do not confront someone at a displayed location.
- Contact the carrier and workplace. Report the loss and ask the carrier about protecting or suspending the line. Tell an employer if work accounts or data are involved. Follow the administrator's incident process.
- Review important accounts from a trusted device. Inspect recovery details and recent activity. Address unauthorized changes and exposed credentials promptly, including email and financial services.
- Make the erase decision deliberately. Read the platform's current instructions, backup status and consequences. Remote actions may wait for connectivity. Erasure is destructive and changes recovery options.
Apple advises keeping a stolen device in Find My even after remote erasure, because removing it removes Activation Lock. For Android, Google's instructions explain the conditions for remote actions and the account password needed after a reset. Treat messages asking for unlock codes or claiming to have found the phone as untrusted; open the official service yourself.
Keep the plan usable
Recheck recovery after changing a phone number, replacing the phone, switching a password manager or adding a work account. Keep the carrier contact, device serial identifier and recovery-route locations somewhere accessible without this phone. Store secrets separately from a general household checklist.
The preparation card below records checks and contact routes, not passwords, device passcodes or recovery codes. Print or save it privately, then do one harmless rehearsal: reach the official finding page and identify the correct phone without sending an erase command.