How safe is your phone if someone gets hold of it today?

Your phone may hold bank alerts, email, photos and the number used to recover your accounts. A strong screen lock, current updates and careful app permissions are a good place to start. Add secure account recovery and a backup, and a lost phone becomes less likely to turn into a much bigger problem.

No single setting makes a phone impossible to attack. The aim is to make it harder for someone to get in, spot suspicious activity early and keep a way to recover your data if the device goes missing.

Set a screen lock you can rely on

Use a strong PIN or password that is difficult for someone nearby to guess. Avoid obvious choices such as your birthday or a repeated digit. Fingerprint or face unlock can be convenient where your phone supports it, but keep the PIN or password private because it is usually needed as a backup.

Set the phone to lock automatically after a reasonable period of inactivity. If notification previews show sensitive messages on the lock screen, review your notification settings and hide their contents where the option is available. Menu names differ between devices.

Do not let a stranger watch while you type your PIN. If you think someone has seen it, change it. Also use separate passcodes for sensitive apps where they offer that option, rather than depending on the screen lock alone.

Keep Android or iOS and your apps updated

Updates can fix security problems as well as add features. On Android, look under Settings for System or Software update. On an iPhone, check Settings, General, then Software Update. Paths and available updates depend on the model and software version.

Update apps through the store you normally use. Schedule large downloads for a reliable Wi-Fi connection if your mobile data is limited, but do not put security updates off indefinitely. If your phone no longer receives security updates, check the manufacturer’s support information and consider your options for a supported device when you can.

Do not install an update sent as an unexpected link in a text message. Open your phone’s settings or app store directly instead. The Nigerian Communications Commission has warned about malware disguised as app installations and security updates.

Be selective about apps and permissions

Download apps from reputable sources and check the publisher, the description and recent reviews. A familiar-looking name is not proof that an app is genuine. Even official stores can contain harmful apps, so remain careful about what you install.

On a supported Android phone, keep Google Play Protect enabled. Open the Play Store, tap your profile picture and look for Play Protect. It checks apps for harmful behaviour, but it is not a substitute for caution. Google explains how Play Protect works.

Think about why an app wants access. A torch app has no obvious need to read your messages or contacts. Be particularly cautious when an unfamiliar app asks for accessibility access, permission to read notifications or permission to appear over other apps. These capabilities can be misused. If you do not understand a request, stop and check the app’s official guidance before allowing it.

Review permissions periodically in your phone settings. Denying a permission may stop a genuine feature from working, so turn it back on only if you need that feature and trust the app.

Protect your email and other important accounts

Your email account can be used to reset passwords elsewhere, so give it a unique password you do not reuse. A password manager can help you create and store different passwords. Protect the manager itself with a strong password and any available security options.

Turn on two-factor authentication where available. Depending on the service, you may be able to use a security key, an authenticator app, a prompt or an SMS code. Choose a method supported by the service and keep its recovery options in a safe place. Never give a verification code to someone who calls or messages you unexpectedly.

For a step-by-step introduction, read how to turn on two-factor authentication on your accounts. A second factor helps, but a convincing fake login page can still trick someone into handing over a code.

Watch out for messages that create panic

A message claiming your bank account will be blocked today may contain a link to a fake sign-in page. A person posing as a friend may ask for a code sent to your phone. A parcel message may push an unfamiliar app download. Slow down and verify the request through a number or app you already know belongs to the organisation.

Do not approve an unexpected sign-in prompt. If a caller asks you to share your screen or install remote-access software to receive a refund, end the interaction and contact the organisation independently. A real-looking logo, a Nigerian phone number or a professional profile picture does not prove who is behind a message.

Our guide to protecting your bank app and mobile money from fraud covers payment-specific precautions.

Protect your SIM and recovery details

Your phone number may receive sign-in codes. Ask your mobile provider about the protections it offers for SIM replacement or account changes, and keep its official support details accessible somewhere other than your phone. A SIM PIN, if supported, can add protection when the SIM is moved to another device. Learn how it works first: repeated incorrect entries can lock the SIM and require a PUK code from your provider.

Review the recovery email addresses and phone numbers on your important accounts. Remove details you no longer control, following the service’s process. Do not post photos of identity documents or your SIM pack publicly just because someone online asks for proof.

Prepare for a lost phone

Turn on your device’s find or locate feature before you need it. Check that you can sign in to the account used to locate the device and understand the available options for locking or erasing it. Location and recovery depend on the phone’s settings, connectivity and other conditions, so they are not guaranteed.

Back up important photos and documents to a place you control. Check that the backup has actually completed and that you can access it from another device. A backup is useful against loss or damage, but it does not replace a screen lock or account protection.

If your phone is stolen, prioritise your safety. Contact your network to protect the SIM, contact your bank through a verified channel if financial apps are at risk, and change important passwords from a trusted device. Use the device provider’s remote lock or erase tools where appropriate. Do not confront a suspected thief yourself.

If you suspect an app is malicious

Disconnect from the internet if you believe an attack is active, then use a trusted device to secure your most important accounts. Contact your bank immediately if money or banking details may be at risk. Remove a suspicious app only after checking what it is, and use your device’s security guidance if it refuses to uninstall.

A factory reset can erase personal data and may not solve an account takeover on its own. Back up what you need, seek trusted support and secure your accounts before considering that step. Prevention begins with a few habits: lock the screen, install updates, question requests for sensitive access and keep your recovery details current.