Android Security and Privacy: The Complete Protection Checklist

Your screen lock is the wall around everything else, because a phone anyone can pick up and use exposes your email (the master key to every account's password reset), your messages, your photos, your banking apps and your accounts. Set a real lock: Settings, Security, Screen lock, and choose a PIN of at least six digits, or a password, plus a fingerprint or face unlock for convenience. Avoid the weak options, no lock, a swipe, a 1234 PIN, or a simple pattern (patterns are guessable from smudges and over-the-shoulder glances). The biometric unlocks the phone quickly day to day; the underlying PIN or password is the real security that also protects it after a restart.

The screen lock does more than block casual snooping, it is the linchpin of theft protection. A locked phone cannot be used, wiped-and-resold easily (Factory Reset Protection ties it to your account, per our find-my-phone guide), or mined for your accounts. This is why our find-my-phone, factory-reset and used-phone guides all treat the screen lock as fundamental: it is what makes a lost or stolen phone useless to a thief and safe for you. Everything else in this guide builds on the assumption that a strong lock is in place, so if you have been running an unlocked phone or a trivial PIN, this is the first and most important fix.

Configure the lock's behavior for real protection: set a short auto-lock timeout (the screen locks quickly when idle, so a set-down phone is not left open), require the PIN/password after restart (which it does by default, and which protects the encrypted storage), and consider hiding sensitive notification content on the lock screen (Settings, Notifications, so message previews do not display to anyone glancing at your locked phone). These settings turn the screen lock from a token gesture into genuine protection, and they cost nothing but a minute to configure.

Your Google account is the crown jewel, because it holds your email, and email is how every other account resets its password, so protecting it protects everything downstream. Enable two-factor authentication (2FA) on your Google account (myaccount.google.com, Security, 2-Step Verification): now a password alone is not enough to access your account, a second factor is required. But configure the second factor wisely, and this is the critical, often-missed detail: do NOT make your only second factor the very phone you might lose. Add a backup, a second device, printed backup codes kept in a drawer, or an authenticator app you can migrate, so that losing your phone does not lock you out of your own account when you most need it (to find or wipe the phone).

Extend 2FA to your other important accounts, banking, email, social, work, and prefer authenticator-app or hardware-key 2FA over SMS where offered, since SMS codes can be intercepted via SIM-swap attacks (which is also why our find-my-phone guide's stolen-phone protocol urges killing the SIM fast). Crucially, back up your authenticator: 2FA codes that live only on your phone vanish with it, locking you out of every protected account, so use an authenticator that syncs or export/migrate your codes, and keep printed backup codes for your most important accounts, as our backup guide stresses. This single preparation prevents the worst-case lockout scenario.

Round out account protection with good password hygiene: unique, strong passwords for every account (a password manager makes this practical, and never reuse passwords, since one breach then compromises everything), and periodic checks of your Google account's security page, which shows recent sign-ins and connected devices so you can spot and remove anything unfamiliar. Our password generator creates strong unique passwords locally. Strong, unique passwords plus well-configured 2FA plus backups of your 2FA are the account-security trifecta, and together they make your accounts genuinely hard to compromise even if your phone is lost or a password leaks.

Set up Find My Device before you ever need it, because it only helps if enabled beforehand: Settings, Google, Find My Device (or the newer Find Hub), on, with location and the offline-finding network enabled. This lets you locate, ring, lock or erase a lost phone from any browser at android.com/find, the full capability our find-my-phone guide details. Pair it with location on and a rehearsal (open android.com/find today and confirm your phone appears), so that a future loss is a practiced routine rather than a panic. This is theft-and-loss insurance that costs nothing and takes two minutes.

Modern Android encrypts your storage by default, tied to your screen lock, which means that even if someone physically extracts the storage, your data is unreadable without your PIN/password, another reason a strong lock matters, since it is also your encryption key. You do not need to do anything to enable this on current phones (it is on by default), but you should not undermine it by disabling your screen lock. Keep your software updated too (our update guide), because security patches close the vulnerabilities that malware and attackers exploit, and the security-patch date in Settings, About phone is the number that reflects how current your protection is.

Prepare for theft in advance so the response is fast. Record your IMEI now (dial star-hash-zero-six-hash, our secret codes tool covers it) and keep it somewhere safe, you need it to report a stolen phone. Know your Google password (not just have it saved on the phone). Ensure your 2FA backup exists (previous section). With Find My Device on, the IMEI recorded, the account protected with backed-up 2FA, and a strong lock in place, a lost or stolen phone becomes a manageable event, you lock it, protect your accounts, kill the SIM, and report it, per the find-my-phone stolen-phone protocol, rather than a catastrophe. The preparation is the whole difference.

Apps are the main privacy risk on a modern phone, and permissions are your control. Review them: Settings, Privacy, Permission manager (or Settings, Apps, per-app permissions), and audit which apps hold sensitive access, location, camera, microphone, contacts, storage, and revoke anything that does not need it (a game with no reason to see your location or contacts, a flashlight wanting your camera-roll). Prefer 'Only while using the app' over 'Always' for location, and use the one-time permission option for occasional needs. Android's privacy dashboard (on recent versions) shows which apps accessed what recently, useful for catching a surprisingly nosy app.

Install safely, because the biggest malware risk is the app you choose to install. Stick to the Play Store, where apps are scanned (and keep Play Protect on: Play Store, profile, Play Protect); when you must install from outside, treat the source with real scrutiny, since sideloaded apps bypass the Store's checks. Before installing anything, read its permissions against its purpose and its reviews (sorted by recent), the red flags our popup-ads and bloatware guides describe, a wallet app wanting accessibility access, a simple utility wanting everything, are declines. Avoid the app categories that are malware magnets: 'cleaners', 'boosters', fake antivirus, cracked apps and shady 'downloaders'.

Tune the broader privacy settings for control. The camera and microphone quick-settings indicators (a dot appears when an app uses them) alert you to unexpected access, and the global toggles let you cut camera/mic access system-wide instantly. Location can be turned off entirely when not needed. Review Google's activity and ad personalization settings (myactivity.google.com) if you want to limit data collection, and use the ad-privacy controls Android offers. And apply the family dimension our block-spam and popup-ads guides raise: set up the same protections, strong lock, Find My Device, careful permissions, Play Protect, on the phones of relatives who are less aware of the risks. A phone secured with a strong lock, protected accounts with backed-up 2FA, Find My Device ready, careful permissions and safe installing habits is genuinely hard to compromise, lose to a thief, or exploit, and every layer here is free and built in.