A new phone is an exciting purchase and a moment of vulnerability — a fresh device with none of your existing security measures, maximum factory defaults on privacy settings, and a setup process that many users rush through. Fifteen minutes of attention during initial setup significantly improves your privacy and security for the entire life of the device.

Set a Strong Screen Lock First

Before doing anything else: set a PIN, password, or pattern as your screen lock, and set the auto-lock timeout to 30 seconds or 1 minute. This is your first and most important security layer. If your phone is stolen, lost, or left unattended, the screen lock is the primary barrier to accessing your data, accounts, email, banking apps, and personal messages.

PIN strength: a 6-digit PIN provides 1,000,000 possible combinations and is adequate for most threat models. Avoid PINs that are your birth year, phone number, or any number someone who knows you could guess. Enable biometric unlock (fingerprint or Face ID) for convenience — but verify that it is backed by a PIN/password requirement after failed biometric attempts, not an easier fallback.

Review App Permissions During Setup — and Decline Most

During app installation and first launch, apps request permissions: location, contacts, camera, microphone, storage, calendar, health data. The default answer to most permission requests should be “while using the app” or “allow once” rather than “always allow.” Location “always on” means the app can access your location in the background without your active engagement — appropriate for navigation apps, rarely appropriate for others.

Review permissions by category after initial setup: go to Settings → Privacy (iOS) or Settings → Privacy & Security → Permission Manager (Android) and review which apps have access to location, microphone, and camera. Revoke anything that does not have a clear, obvious reason for needing it. A flashlight app that requests contacts or a game that wants microphone access are red flags.

Enable Find My Device and Set Up Backups

Enable Find My (iPhone) or Find My Device (Android) immediately. This allows you to locate your phone on a map, remotely lock it with a message and contact number displayed on the lock screen, or erase all data if you cannot recover it. These features only work if enabled before the phone is lost — you cannot enable them remotely after the fact.

Set up automatic cloud backups — iCloud Backup (iPhone) or Google One backup (Android). Choose what to back up (contacts, photos, app data) and set it to run automatically on Wi-Fi overnight. A lost or damaged phone is an inconvenience; a lost phone without a backup means permanently losing contacts, photos, and app data. The backup setup takes five minutes; the recovery regret lasts indefinitely.

Enable Two-Factor Authentication on Your Main Account

Your Apple ID or Google Account is the master key to your phone’s data, purchases, and connected services. Enable two-factor authentication immediately: Settings → [Your Name] → Password & Security → Two-Factor Authentication (iPhone) or Google Account → Security → 2-Step Verification (Android). This requires a verification code in addition to your password when signing in from a new device, making account takeover substantially more difficult even if your password is compromised.

Enable 2FA on your email account as well — email is typically the recovery method for every other account you own, making it the highest-value target for attackers. Two minutes of 2FA setup protects all accounts that use that email for recovery.

Adjust Default Privacy Settings

Manufacturer defaults favour their own data collection and advertising personalisation. Spending five minutes reviewing and adjusting these settings is worthwhile. On Android: Settings → Privacy → Ad privacy — disable personalised ads and reset your advertising ID. On iPhone: Settings → Privacy & Security → Tracking — disable “Allow Apps to Request to Track.” Both settings reduce cross-app tracking for advertising purposes without affecting any app’s core functionality.

On Android, review Google’s data collection settings via your Google account at myaccount.google.com — location history, activity controls, and ad personalisation can all be limited or disabled without affecting Google services’ core functionality. These are settings that default to “on” and require manual opt-out.

Keep Software Updated

Enable automatic software updates for both the OS and apps. Security vulnerabilities are discovered regularly in smartphone operating systems and popular apps. Manufacturer security patches address these vulnerabilities within days to weeks of discovery; devices running outdated software remain exposed. Automatic updates eliminate the gap between patch availability and installation on your device.

Updated August 2026 · Digital Idea How-To Guide.