4.4 Securing iPhone and Android phones

Reviewed 1 October 2026. Menu names and features vary by operating-system release, hardware, Android manufacturer, region, account type, and whether an employer or school manages the phone. If a path below does not match your phone, search within Settings. A missing control can mean it is unsupported or blocked by an administrator.

What mobile security means

Your phone is probably the most security-sensitive computer you own. Messages, photos, location history, health data, passwords, passkeys, banking apps, and the email account that resets everything else all live there.

It also receives login codes and often approves new logins. Lose control of the phone and you can lose your wider digital identity.

Mobile security is not one thing. It is a stack of layers, and a phone can be strong at one and weak at another:

• Secure boot: makes it harder to replace the operating system.
• Storage encryption: protects data while the phone is locked.
• App sandboxing: stops one app reading another app's files.
• Permissions: control access to sensors and personal information.
• App store and malware scanning: cut the chance of installing hostile code.
• Account security: protects cloud copies and remote-management functions.
• Network encryption: protects data in transit.

The threat matters too. A six-digit passcode and current software are excellent protection against opportunistic theft. They do not guarantee protection if:

• an abusive partner knows the passcode;
• a criminal takes over the cloud account;
• you are tricked into installing a management profile;
• a highly resourced attacker uses an unknown vulnerability.

So let your threat model pick your settings, rather than flipping every switch you can find.

The iPhone security model

Apple controls almost everything: the main hardware, the operating system, the default app distribution and the security-update channel.

• An iPhone starts from a hardware root of trust and verifies the software it loads.
• The Secure Enclave is a separate security subsystem that protects cryptographic material and evaluates Face ID or Touch ID data.
• Data Protection encrypts files with keys tied to the device and, for protected classes, the passcode.
• Apps are sandboxed and must request access to protected data and sensors.

The upside: supported iPhones generally get security updates directly and at the same time, security features are fairly consistent across models, and the tightly controlled app environment limits common malware.

"Limits" is doing real work in that sentence. Malicious and abusive apps still appear. Legitimate apps can collect excessive data with permission. Web and message parsers can have vulnerabilities. And someone who controls your Apple Account or your unlocked phone may not need malware at all.

The downsides of the closed model:

• You have less ability to inspect or replace system components.
• Apple is a large point of trust.
• Some cloud services are designed for convenience rather than end-to-end confidentiality.

Sandboxing also means consumer "antivirus" apps cannot inspect the whole phone the way desktop antivirus can. That is a platform strength, but it means no antivirus subscription can make up for an old iOS version, a stolen passcode or a compromised Apple Account.

The Android security model

Android is a platform used by many manufacturers, not one uniform product. At platform level, modern Android uses:

• a hardware-backed boot chain and Verified Boot;
• file-based encryption;
• per-app Linux identities and application sandboxing;
• SELinux access controls;
• runtime permissions;
• hardware-backed key storage where the device supports it.

Google Play Protect scans apps and devices for harmful behaviour on devices with Google Mobile Services.

The core architecture is strong. The variation comes from the device wrapped around it: manufacturer update policy, hardware security, bundled apps, carrier customisation, bootloader state, and how quickly patches arrive.

A current, supported Pixel, Samsung flagship or other device with a clear long-term patch commitment is a very different proposition from a cheap handset getting irregular updates. "Android is secure" and "Android is insecure" are both too vague to be useful. The exact model, support date, software build and configuration are what matter.

Android's openness is a genuine advantage: more hardware choice, stronger separation options on some devices, work profiles and private spaces, alternative app distribution, and specialist operating systems on selected hardware.

The catch: more flexibility means more decisions that can go wrong. Unlocking the bootloader, rooting, installing apps from unknown sources or running an unsupported custom build can weaken Verified Boot, sandbox assumptions and update reliability. A carefully maintained specialist installation may improve privacy; an improvised one can reduce security.

iPhone versus Android: practical pros and cons

iPhone strengths:

• consistent, long-lived updates across supported devices;
• tight hardware and software integration;
• a strong default app sandbox;
• relatively uniform security features;
• Stolen Device Protection;
• Lockdown Mode for people facing sophisticated targeted attacks.

The smaller range of models also makes it easier to give reliable instructions and know whether a feature exists.

iPhone limitations:

• reliance on Apple for hardware, operating system, app distribution, cloud integration and account recovery;
• limited user inspection and customisation;
• some data remains accessible to Apple under standard iCloud protection;
• privacy settings cannot stop an app collecting what you deliberately give it;
• Lockdown Mode restricts functionality and is not a general privacy switch.

Android strengths:

• broad device and price choice;
• good security architecture on current devices;
• granular permissions and the Privacy Dashboard;
• Private DNS and always-on VPN support;
• work profiles or Private Space on supported versions;
• Android Advanced Protection on supported devices;
• the option of a manufacturer or specialist system aligned with a particular privacy need.

Android limitations:

• update duration and speed vary;
• manufacturer menus and bundled software differ;
• cheaper or older devices may stop getting patches while still working normally;
• sideloading expands software supply-chain risk;
• some biometric implementations give weaker assurance than others.

The Android label alone will not tell you whether the phone will be supported for as long as you plan to keep it.

The verdict: the better phone is the supported one you will keep updated, lock properly and understand. A well-maintained Android handset is safer than an abandoned iPhone. A supported iPhone with a weak passcode shown to strangers is less safe than its spec sheet suggests.

People at elevated risk should also think about ecosystem diversity, repair and replacement logistics, and whether they need Apple's Lockdown Mode or Android's specialist deployment choices.

A strong baseline for every phone

Choose support before features

Buy a model whose published security-update end date runs past the time you expect to use it. "It still runs apps" is not the test: once security support ends, newly discovered flaws stay open.

On Android, check the policy for the exact model and region, not just the manufacturer's newest flagship. Replace or repurpose an unsupported phone rather than using it for banking, authentication or sensitive communication.

Install operating-system and app updates

Turn on automatic system, security and app updates, and apply urgent security releases promptly. A short delay on a major feature release can sometimes dodge compatibility problems, but repeatedly postponing security patches leaves known holes open for attackers.

Restart the phone now and then. That lets completed updates take effect and returns data protected until first unlock to its stronger post-reboot state.

Use a strong device credential

Use at least a six-digit PIN that is not a date, part of an address, a repeated digit or your reused bank PIN. A longer numeric PIN or alphanumeric passcode is stronger, especially if the phone could be seized or deliberately targeted.

Enter it discreetly. Shoulder-surfing followed by theft defeats impressive hardware if the thief watched you type the code.

Biometrics help because they make a longer passcode bearable and cut how often you type it in public. But they are a convenience, not a replacement for the passcode that ultimately protects encryption keys and recovery operations.

• Register only your own face or fingers.
• Review enrolled biometrics after a repair, travel, or any time the phone left your control.

The legal treatment of compelled biometrics and compelled disclosure of knowledge varies with jurisdiction and circumstances. Seek legal advice for a real case.

Lock quickly and hide lock-screen data

Set a short auto-lock interval and require authentication immediately, with no grace period.

On the lock screen, hide these unless you truly need the convenience:

• message previews and one-time codes;
• calendar details and email contents;
• smart-home controls and reply actions;
• wallet access and USB data access.

A locked screen that displays password-reset messages is only partly locked.

Secure the primary account

Your Apple Account or Google Account can locate the phone, restore backups, sync passwords and approve recovery. Treat it accordingly:

• Use a unique password plus a phishing-resistant passkey or security key where available.
• Review trusted devices, recovery phone numbers, recovery email addresses, app passwords and third-party access.
• Keep at least one recovery method that does not depend only on the phone itself.
• Store recovery codes or a backup security key offline, somewhere physically secure.

Prepare for loss before it happens

Set this up while you still have the phone:

• Enable Find My on iPhone, or Find Hub/device-finding features on Android.
• From another device, confirm you can sign in and locate, mark lost or erase the phone.
• Record the IMEI and carrier contact details somewhere else.
• Set a carrier account PIN and protect number-porting to reduce SIM-swap risk.
• Know how to revoke wallet cards, active sessions and mobile service.

Remote erase is a last resort and only works if the phone reconnects. The screen lock and encryption have to provide the immediate protection.

Minimise apps

Every app is code, an update channel, a set of permissions and often an account. Remove the ones you no longer use.

• Prefer the official store and a known developer.
• Check the publisher name, recent reviews, privacy information and permission requests, rather than trusting a familiar-looking icon.
• Avoid configuration profiles, device-management enrolment, accessibility services, keyboard apps and VPN apps unless you understand why they need elevated control.

Never install a certificate or management profile just to join a network at a hotel, airport, cafe, school or event.

Hardening an iPhone

Updates and account protection

• Open Settings > General > Software Update > Automatic Updates. Enable automatic download and installation of iOS updates and security responses where offered.
• Open Settings > [your name] > Sign-In & Security. Confirm two-factor authentication, trusted phone numbers, recovery contacts, and security keys if you use them.
• Review every device listed under the Apple Account. Remove any you no longer have or do not recognise.
• Turn on Find My iPhone, the Find My network, and Send Last Location. Activation Lock then makes simple resale harder, but it does not replace reporting a theft.

Passcode, Face ID, and theft resistance

• Open Settings > Face ID & Passcode. Use Passcode Options to choose a longer numeric or custom alphanumeric code if your risk justifies it.
• Under Allow Access When Locked, disable features that expose data or control without unlocking. Keep only those whose emergency or accessibility value outweighs the risk.
• Turn on Stolen Device Protection. It requires Face ID or Touch ID, with no passcode fallback, for defined sensitive actions, and can impose a security delay before critical account changes. On supported versions, consider requiring it away from familiar locations or always, depending on the options shown.
• Lock especially sensitive apps where iOS offers Require Face ID. This adds a boundary after the phone itself is unlocked; with Stolen Device Protection, locked apps get stronger protection away from familiar places.
• Use the power-and-volume button gesture or the emergency screen to disable biometric unlock temporarily. After a restart or biometric lockout, the passcode is required.

Lockdown Mode

Lockdown Mode (iOS 16 and later) is Apple's optional extreme protection for the small number of people who may be personally targeted by sophisticated mercenary spyware. Think some journalists, political figures, campaigners, diplomats, lawyers, executives, and people assisting sensitive investigations.

It shrinks the attack surface by restricting features that have historically been exploitation routes:

• message attachments and link previews;
• some web technologies;
• unsolicited service invitations;
• connections to computers and accessories while locked;
• automatic connections to non-secure Wi-Fi, and 2G and 3G mobile networks;
• configuration profiles, and more.

The restrictions expand on newer releases, so update before relying on it.

Turn it on under Settings > Privacy & Security > Lockdown Mode, review the effects, and restart when prompted. Keep every linked Apple device current: protecting only the phone while a synced tablet or laptop stays exposed weakens the result. You can add exceptions for selected websites or apps, but each one restores some attack surface.

Myth: Lockdown Mode is a general privacy upgrade. Reality: it is not an anonymity mode, ad blocker, VPN or firewall, and it does not protect you from someone who knows the passcode. It will not:

• stop an app receiving data you submit;
• prevent account phishing;
• hide your location from a carrier;
• secure an already-compromised cloud account.

It can also break websites, attachments, shared albums, calls from unknown contacts, accessories and organisational management. Most people gain more from updates, a strong passcode, Stolen Device Protection, careful permissions and account security. Turn it on because the threat warrants the restrictions, not because "more security" always means "better".

Tracking, permissions, and sharing

• Open Settings > Privacy & Security > Tracking. Turn off Allow Apps to Request to Track if you do not want apps asking to link your activity across other companies' apps and websites for advertising or data-broker sharing. Review any existing exceptions.
• Know the boundary: App Tracking Transparency restricts one defined category of cross-company tracking. It does not stop first-party analytics, information you give an app, server logs, subscription records, or every fingerprinting technique.
• Review Location Services app by app. Prefer Never, Ask Next Time or While Using over persistent access. Disable Precise Location where approximate is enough. Check system services and significant-location features separately.
• Review Contacts, Calendars, Reminders, Photos, Bluetooth, Local Network, Microphone, Camera, Health, Motion and Files permissions. Give selected-photo access rather than the whole library when practical. A torch, wallpaper or simple game rarely needs your contacts or microphone.
• Use the App Privacy Report (iOS 15.2 and later) to see sensor access and network domains. Treat it as an investigation aid, not proof that a connection is malicious.
• On iOS 16 or later, with two-factor authentication on the Apple Account and the account signed in, use Settings > Privacy & Security > Safety Check to review people, apps, devices and account access. Screen Time restrictions or mobile-device management can make some options unavailable. Emergency Reset can stop sharing quickly. In an abusive situation, plan first: removing access or location sharing may alert the other person or change their behaviour.
• Keep Private Wi-Fi Address on for networks that support it. It reduces use of the hardware Wi-Fi address as a stable tracking identifier. Forget networks you no longer need and disable automatic joining of open hotspots.

iCloud, Private Relay, and backups

Decide deliberately what syncs to iCloud, because device encryption does not mean every cloud copy is end-to-end encrypted.

In the UK, Apple no longer allows users to enable Advanced Data Protection. So iCloud Backup, iCloud Drive, Photos and Notes use Apple's standard protection, not keys held only by your trusted devices. Some categories, including iCloud Keychain and Health data, remain end-to-end encrypted by default.

iCloud Private Relay, included with iCloud+ where available, protects supported Safari browsing and related name-resolution traffic by splitting knowledge of who you are from knowledge of where you are going. But:

• it is not available in every country or region;
• it is not a full-device VPN and does not protect all app traffic;
• Limit IP Address Tracking controls it for individual Wi-Fi or cellular networks.

The Private Relay icon is not proof that every app is tunnelled.

Hardening an Android phone

Device choice, updates, and boot integrity

• Check the manufacturer's published security-support end date for the exact model. Prefer monthly or clearly scheduled security patches and several years of support remaining.
• Open Settings > Security & privacy > System & updates, or search Settings for Security update, Google Play system update and System update. These can be separate update channels; check all of them.
• Leave the bootloader locked and Verified Boot intact unless you have a specific, researched reason and a maintained alternative system. A warning at every boot deserves investigation.
• Keep Google Play Protect on. It reduces harmful-app risk but is not permission to install indiscriminately.

Screen lock, biometrics, and theft protection

• Use a strong PIN or password rather than a simple pattern. Patterns are easy to watch and may leave visible smudge traces. Set a short lock timeout and immediate locking with the power button.
• Check whether the phone's face unlock is approved for strong authentication. Some models use a convenient camera-based match that apps will not accept for banking or passkeys. A good fingerprint sensor plus a strong PIN is often the more predictable choice.
• Open Settings > Google > All services > Theft protection where available. Enable Theft Detection Lock, Offline Device Lock, Remote Lock and Identity Check as appropriate. Names and availability vary by device and Android version.
• Identity Check, on supported devices, requires strong biometric authentication for sensitive actions outside trusted places and removes the screen-lock fallback for those actions. It helps against a thief who has watched you enter your PIN. Choose trusted places carefully: making a large area trusted weakens the control.
• Enable Find Hub/device-finding and offline finding where available. Check which account can erase or locate the phone and secure that account independently.

Android Advanced Protection

Advanced Protection is one switch that holds a group of strong protections on, introduced for supported devices on Android 16 and later. It can:

• prevent Play Protect from being disabled;
• block installs and updates from unknown sources;
• restrict accessibility services to verified tools;
• enable memory-safety protections on supported hardware and apps;
• prevent connections to 2G networks on supported devices;
• apply stronger settings across Google apps.

Search Settings for Advanced Protection, commonly under Security & privacy. An eligible release does not guarantee that a particular manufacturer or managed device exposes it.

The set is not fixed across releases. Google's current help also lists inactivity reboot after 72 hours locked, locked-device USB protection, failed-authentication locking, restrictions on watch unlock, and optional Intrusion Logging.

Intrusion Logging stores end-to-end encrypted security logs in a Google Account you choose, for later investigation. Not everyone needs it, and it creates recovery material that must stay accessible after an incident.

Quick comparison with Apple:

• Lockdown Mode aggressively removes or restricts features to resist sophisticated targeted exploitation.
• Android Advanced Protection assembles defence-in-depth controls with less disruption.

Availability depends on Android version, hardware, manufacturer, region and apps. Some protections can affect performance or compatibility.

Do not confuse it with the separate Google Advanced Protection Program for accounts. That programme requires passkeys or security keys, restricts third-party access to Google data, adds download checks, and makes recovery more rigorous. If you face targeted phishing, consider both, with a backup security key and recovery plan stored away from the phone.

Permissions and app control

• On current Google-style menus, open Settings > Security & privacy > Privacy > Privacy Dashboard, or search Settings for Privacy Dashboard. It exists from Android 12, but where it lives and whether it shows 24 hours or seven days of activity depend on release and manufacturer. Review which apps used location, camera, microphone, contacts, nearby devices, call logs, SMS, files and other permissions, and when.
• Use Only while using the app, Ask every time, approximate location or selected media where available. Remove permissions from unused apps and enable automatic permission removal for apps you stop using.
• On Android 17 devices that expose the controls, use temporary precise-location access when an app needs accuracy only briefly, and share selected contacts rather than the whole address book. Earlier releases and manufacturer builds may not offer either.
• Watch the camera and microphone indicators; tap one to see which app is active. Quick Settings can disable camera or microphone access globally for a high-risk meeting, but that also breaks legitimate calls and recording.
• Audit Special app access: accessibility, notification access, display over other apps, install unknown apps, device admin apps, usage access, unrestricted battery and VPN. These powers can expose far more than an ordinary permission. Accessibility access in particular can let an app read screens and press controls on your behalf.
• Leave Install unknown apps off by default. If sideloading is genuinely necessary, enable it only for the intended installer, verify the file and publisher through an independent channel, install, then disable the permission again. Manual installation makes updates and provenance your responsibility. Google's developer-verification rollout began on 30 September 2026 in Brazil, Indonesia, Singapore and Thailand, with global expansion planned for 2027, so do not treat it as a universal UK requirement yet.
• Use Private Space, a work profile or a separate user profile on supported devices when you need genuine isolation. Hiding an icon is not the same as encrypting a separate profile, and notifications, backups, keyboards, accounts or file sharing can still bridge compartments depending on configuration.
• Review the advertising ID and ad-personalisation controls under Privacy or Google settings. Resetting or deleting the advertising identifier removes one linkage method; it does not stop account-based, first-party, IP-based or fingerprint-based tracking.
• Keep Android's Private DNS on Automatic, or use a trusted provider hostname if you understand the trust trade-off. It protects DNS queries and answers where supported; it does not encrypt all traffic or replace a VPN.
• Android 17 adds a permission boundary for apps that scan or connect to devices on the local network. Prefer the system device picker for casting where an app offers it, and deny broad local-network access when an app has no need to discover household or workplace devices. Roll-out and menu wording can still vary by device.

Backups and cloud accounts

A backup protects availability, but it is also another copy to defend. Work out:

• what the phone backs up;
• who holds the decryption keys;
• how account recovery works;
• whether deleting something on the phone deletes it in the cloud, or keeps it.

Watch for side channels: photos may use a separate service from the device backup, messaging apps may have their own backup settings, and authenticator seeds and passkeys may sync through another credential manager.

Test recovery before an emergency. Confirm that essential photos, contacts, documents and authenticator recovery materials can be restored without the only recovery code living on the phone you are restoring.

Do not screenshot master recovery codes and leave them in a cloud-synced photo library. For highly sensitive material, consider an encrypted offline backup under a key you control, balanced against the risk of losing that key.

Old backups and old devices are often the weakest way in. An obsolete tablet signed into the same account, or a years-old cloud backup, can expose current data. Remove devices you no longer control, erase them before disposal and revoke their sessions. After a repair, check account devices, biometrics, VPNs, certificates and management profiles.

Mobile data security

Mobile data is generally a good choice when the alternative is an unknown public Wi-Fi network. The cellular connection authenticates the SIM or eSIM and encrypts the radio link between handset and network. Other people in the cafe are not on your local network, and a fake hotspot cannot intercept a connection the phone never makes.

But cellular is neither anonymous nor end-to-end private. The carrier necessarily knows:

• the subscriber or account and SIM identifiers;
• device and network identifiers;
• connection times and data volume;
• which cells serve the phone, which gives location information of varying precision.

Without a VPN or other protective protocol, the carrier may handle your DNS queries and infer destinations from connection metadata, although HTTPS normally stops it reading the contents and exact path of a secure web session.

Android 17 adds Encrypted Client Hello support which, together with Private DNS, can hide the destination hostname for compatible apps and sites. That depends on adoption and is not a full-device anonymity system. Apps can still send their own analytics and identifiers straight to their providers.

Practical habits:

• Use 4G or 5G rather than forcing legacy network modes where practical, and keep carrier settings current.
• Set a carrier account PIN and port-out protection.
• Prefer app-based or hardware-backed MFA over SMS, because phone-number takeover and message redirection can compromise SMS codes.
• Be alert to a sudden loss of service, a notice that the SIM changed, or password-reset messages you did not request.

Turn off data roaming when you do not need it, mainly to control cost and unintended use of foreign networks. Roaming does not automatically expose plaintext app content, but it adds network and jurisdictional parties. For sensitive travel, consider a separate supported device with a minimal set of accounts rather than carrying your whole personal archive.

Using the phone as a hotspot? Set a strong hotspot password, use the strongest compatible Wi-Fi security, switch it off after use and review connected clients. Do not assume the phone's VPN covers tethered devices: routing differs by operating system and VPN app, and tethered traffic may bypass the tunnel. Test the other device's apparent IP address and DNS path instead of trusting the VPN icon on the phone.

Free and public Wi-Fi

"Free Wi-Fi" is not automatically hostile, and modern HTTPS has removed much of the old risk of a hotspot simply reading passwords and page contents. The risks that remain are still real:

• joining a convincing fake network;
• local-network probing;
• insecure non-HTTPS traffic and DNS manipulation;
• tracking by the venue or network provider;
• malicious captive portals;
• prompts designed to get you to install an app, certificate or management profile.

Prefer mobile data for banking, account recovery, confidential work or anything where failure would be costly. If you must use public Wi-Fi:

• Confirm the network name with a sign or a member of staff. A name such as "Station Free WiFi" proves nothing by itself.
• Disable automatic connection to open networks. Join deliberately, complete the captive portal, then start the VPN if it could not connect before portal login.
• Do not install a root certificate, configuration profile, device-management enrolment, keyboard or unknown app to get ordinary guest access. Leave if the network demands disproportionate control.
• Treat HTTPS warnings as a hard stop. Do not click past a certificate error because the venue seems trustworthy; the warning means the secure identity check failed.
• Keep AirDrop, Quick Share, file sharing, media casting and discoverability restricted. A private/randomised Wi-Fi address reduces stable local tracking but does not hide activity after login.
• Forget the network afterwards if you do not expect to return. Otherwise the phone may reconnect to any network presenting the same name.
• Avoid sensitive work during the brief window between satisfying the captive portal and the VPN connecting.

A password printed on the wall does not make a guest network private; every visitor may know it. WPA2 or WPA3 still improves radio-link protection, but the network operator and the path beyond the access point remain trusted parties. HTTPS protects each secure service connection. A VPN adds a consistent encrypted path from the phone to the VPN server.

The benefits and limits of a VPN on a phone

A VPN is an encrypted tunnel from your phone to a VPN server. What it changes:

• On public Wi-Fi: the local operator and nearby observers cannot see the individual destinations and DNS traffic inside the tunnel, subject to the VPN's configuration.
• On mobile data: the carrier learns less about destinations, but still sees that you are connected to the VPN, when, and how much data moves.
• Websites and services see the VPN server's IP address instead of your phone's current public one.

That is useful for protecting traffic on untrusted networks, reaching an employer's internal services, reducing ISP or carrier destination logging, keeping a more consistent apparent location, and not handing your home or mobile IP address to every site. A full-device, auto-reconnecting VPN with leak protection beats remembering to switch one on after you have already started something sensitive.

Myth: a VPN makes your phone anonymous. Reality: the VPN provider becomes a concentrated point of trust, and plenty still identifies you:

• Apps still know your account, advertising identifiers, push-notification token, device characteristics, location permission and whatever you type into them.
• Cookies and browser fingerprints remain.
• It does not stop phishing, malicious apps, screenshots, cloud syncing, carrier location records, or an attacker who controls the unlocked device.
• It normally protects traffic only between the phone and the VPN server. After that, traffic continues to its destination, where HTTPS remains essential.

Choosing and configuring one

• Choose a provider with clear ownership, a sustainable business model, documented logging practices, current independent security assessments, modern protocols, prompt updates, and a history that matches its claims. A privacy policy is evidence of a promise, not proof of technical impossibility.
• Avoid unknown "free" VPN apps. Servers cost money; a free service may monetise advertising, behavioural data, traffic manipulation or an upsell. A reputable limited free tier can be different, but investigate the company and architecture just the same.
• Use the operating system's supported VPN framework. Do not grant a consumer VPN unrelated contacts, photos, accessibility or device-administrator permissions.
• Enable automatic connection on untrusted networks. On Android, use Always-on VPN and, where appropriate, Block connections without VPN. On iPhone, dependable always-on enforcement is normally strongest in a managed configuration; consumer apps often offer on-demand or auto-connect rules instead. Test after sleep, after switching from Wi-Fi to mobile data, and after changing networks.
• Use a nearby, stable exit unless you need a different country. It generally means less latency, fewer location anomalies, fewer account-security alerts and fewer banking blocks.
• Check whether the VPN handles IPv6 and DNS. Use a reputable test site to compare apparent IP and DNS before and after connecting, but remember a clean test says nothing about the provider's internal logging.
• Expect some battery use, latency, connection failures, streaming restrictions, bank challenges and captive-portal friction. A kill switch trades accidental leakage for total loss of connectivity when the tunnel fails.
• Do not stack multiple consumer VPNs without a designed reason. Mobile operating systems usually support one active system VPN, and DNS filters, firewalls, parental controls and security apps may compete for the same VPN slot.

Choose the tool for the threat. Some neighbouring tools solve narrower or different problems:

• iCloud Private Relay is not a full-device VPN.
• Private DNS encrypts name lookups but not the connections named by those lookups.
• Tor Browser is a different anonymity design for web activity, not simply a stronger VPN.

High-risk and emergency actions

Got a credible targeted-attack warning from Apple, Google, an employer or a security team? Preserve the message and verify it through a separately obtained official contact. Then:

• update all devices;
• consider Apple Lockdown Mode or the applicable Android and account Advanced Protection controls;
• get specialist help.

Do not forward a suspicious attachment to colleagues for a second opinion. That can spread the risk.

Phone stolen? Personal safety first. Then, from a different trusted device:

• mark it lost and contact the carrier;
• revoke payment cards if necessary;
• change the primary account password if account access may be at risk;
• review email sessions and password-manager access, because they unlock other accounts.

Remote erase may be appropriate once recovery is unlikely, but follow organisational or evidential requirements if it is a work device or part of an investigation.

Suspect intimate-partner monitoring? Do not make abrupt changes without thinking about physical safety. Account or location changes may notify the other person. Seek specialist support from a device they cannot access.

Apple's Safety Check is useful, but it cannot audit non-Apple accounts, a different Apple Account, every social service or a physical tracker. Android permissions and account-device lists likewise show only part of the picture.

Phone acting strangely? Do not jump to sophisticated spyware. Battery drain, heat and crashes usually have ordinary causes. Check:

• software version;
• battery and data use by app;
• device-admin or management profiles and accessibility services;
• VPNs and certificates;
• account devices and recently installed apps.

For a high-consequence case, preserve evidence and get expert advice before resetting. For an ordinary suspected compromise: update, remove untrusted configuration, change account credentials from a clean device, and factory-reset if you cannot restore confidence.

Mobile security checklists

Ten-minute baseline

• Install all system, security, Google Play system, carrier and app updates.
• Set a unique six-digit-or-longer PIN and a short auto-lock interval.
• Hide sensitive notification previews and disable unnecessary lock-screen actions.
• Enable account two-factor authentication, device finding and theft protection.
• Remove apps you do not use and revoke unnecessary location, microphone, camera, contacts and photo access.
• Disable automatic joining of open Wi-Fi; keep private/randomised Wi-Fi addressing on.
• Set a carrier PIN and move important accounts away from SMS-only MFA.

Elevated-risk baseline

• Use a longer alphanumeric passcode, entered away from cameras and onlookers.
• Use phishing-resistant passkeys or hardware security keys, with an offline backup key.
• Enable iPhone Lockdown Mode when targeted-spyware risk justifies the breakage, or Android device and Google Account Advanced Protection where supported.
• Turn on Stolen Device Protection or Android Identity Check and audit trusted locations.
• Minimise cloud syncing, old backups, linked devices and third-party account access.
• Use a reputable automatic full-device VPN on untrusted networks and verify how it reconnects.
• Separate high-risk roles from everyday accounts or devices where cross-contamination would be costly.
• Keep an offline recovery plan and a known route to specialist incident response.

Official sources

• Apple Platform Security: hardware security overview, Lockdown Mode security, and Apple: About Lockdown Mode.
• Apple: Stolen Device Protection, app tracking permissions, and Safety Check.
• Apple: iCloud Private Relay on iPhone.
• Android Open Source Project: security overview, encryption, and Verified Boot.
• Android Advanced Protection, Privacy Dashboard, theft protection and Identity Check, Android developer verification, Android 17 privacy and security controls, and Google's Android 17 network-security update.
• Android VPN settings and Private DNS and advanced network settings.
• UK National Cyber Security Centre: VPN guidance and keeping devices updated.