Phone Security Checklist

Simple steps to secure your phone, apps, voicemail, and SIM.

Phone Security Checklist

1. Lock screen setup

Options to reduce access if someone gets your phone into their hands.

• Choose a screen lock:
  • Use a PIN or passcode that is not:
    • Your birthday
    • Anniversary dates
    • Repeating numbers (1111, 0000, 1234, etc.)
  • Consider turning off:
    • Simple swipe-only unlock
    • Face unlock if someone can hold the phone to your face
    • Fingerprint unlock if someone can use your hand while you are asleep
• Adjust lock timer:
  • Set the screen to lock automatically after a short time of inactivity (for example 30 seconds–1 minute).
  • Turn on “lock immediately” when pressing the power button, if available.
• Limit lock-screen information:
  • Turn off message previews on the lock screen (texts, messaging apps, email).
  • Hide notification content or show only “you have a new message.”
  • Turn off lock-screen access to:
    • Quick reply to messages
    • Wallet or payment apps
    • Smart home controls
    • Microphone and camera shortcuts, if possible
• Check device login and accounts:
  • Confirm that the main device account (Apple ID, Google account, etc.) uses:
    • A strong, unique password
    • Two-factor authentication (2FA) or multi-factor authentication (MFA) where you control the second step
  • Review which email or phone number is set for account recovery and change it if someone else can access it.

2. App permissions audit

Options for limiting what apps can see and do on your phone.

• Location access:
  • Open your phone’s privacy or permissions settings.
  • Review which apps can access your location.
  • Change apps that do not need constant location to:
    • “While using the app” or
    • “Ask every time” or
    • “Deny” if location is not required.
• Microphone and camera:
  • Review which apps have:
    • Microphone permission
    • Camera permission
  • Turn off access for any app you do not recognize or do not actively use for calls, photos, or video.
• Contacts, messages, and call logs:
  • Check which apps can see:
    • Your contacts
    • Your SMS or text messages
    • Your call history
  • Remove access from apps that do not need this information to function.
• Always-on access and background activity:
  • Look for apps allowed to:
    • Run in the background
    • Use “unrestricted” battery or data
    • Bypass data saver modes
  • Restrict background use for any app you do not trust or recognize.
• Account and device admin rights:
  • Check for apps listed as:
    • “Device admin” or “Device management”
    • “Profile” or “Mobile device management (MDM)”
  • Review who set them up (work, school, or another person).
  • Consider removing any profile or admin that gives someone else control over your device, where safe to do so.

3. Backup settings

Options for protecting data while limiting who can see it.

• Check what is being backed up:
  • Open your phone’s backup or cloud settings.
  • Review which items are included:
    • Photos and videos
    • Messages
    • Call history
    • App data and phone settings
  • Decide what you prefer to keep backed up and what you prefer to keep only on the device.
• Review where backups go:
  • Confirm the backup account (email address or cloud service) is something only you can access.
  • If someone else knows the password to that account, consider:
    • Changing the password
    • Turning on 2FA/MFA with a verification method they cannot access
    • Creating a new account for future backups
• Shared devices and computers:
  • Check whether your phone syncs or backs up to:
    • Shared computers
    • Shared tablets
    • Shared cloud storage
  • Turn off automatic backups to any device or service where another person may browse your data.
• Download a copy of important information:
  • Consider storing copies of key items somewhere secure, such as:
    • Important contacts
    • Evidence files saved from gathering-evidence-related steps
    • Account recovery codes
  • Use storage that is not easily accessed by others (for example, an encrypted drive or a private cloud account).

4. SIM security

Options for protecting your phone number and mobile account.

• Basic SIM checks:
  • Confirm which phone number is active on this device.
  • If your phone has more than one SIM or eSIM:
    • Review which numbers are installed
    • Note any numbers you do not recognize
• SIM PIN (if supported and safe for your situation):
  • Check if your SIM has a PIN code enabled.
  • If you turn on a SIM PIN, store the code somewhere secure so it is not lost.
  • Avoid sharing the SIM PIN with anyone who may try to control your phone service.
• Mobile carrier account security:
  • Log in to your mobile carrier account from a trusted device.
  • Review:
    • Who is the account holder
    • Authorized users or managers on the account
    • Any “port-out” or “SIM swap” protections offered by the carrier
  • Where available, add:
    • A separate PIN or passcode required for changes to the line
    • Alerts for SIM swaps or number changes
• Signs of SIM or number interference:
  • Pay attention if you notice:
    • Sudden loss of service for no clear reason
    • Verification codes you did not request
    • Calls or texts not reaching you, or going to another device
  • Consider contacting your carrier from a safe device to review any recent changes to your line.

5. Hidden tracking checks

Options for checking whether your phone has tracking or monitoring tools you did not agree to.

• Review installed apps:
  • Open your list of apps (including “all apps” or “system apps” views, if available).
  • Look for:
    • Apps you do not remember installing
    • Apps with generic names (for example, “System Services,” “Service Tool,” “Data Service”)
    • Apps that do not have an icon or appear hidden
  • Search each unfamiliar app name online from a separate, safe device when possible.
• Check location sharing:
  • Open your phone’s built-in location sharing or “find my device” settings.
  • Review:
    • Who has access to your real-time location
    • Any shared location links you have created
  • Turn off location sharing with anyone you do not want to see where you are.
• Check account access:
  • Open your main account settings (for example, Apple, Google, or similar).
  • Review:
    • Devices logged into your account
    • Third-party apps connected to your account
  • Sign out devices you do not recognize.
  • Remove third-party apps that do not need access.
• Look for remote control features:
  • Check whether any app has:
    • Remote access or remote control capabilities
    • Screen sharing or remote support tools always running
  • Uninstall or disable any remote access app that you do not use for work, school, or support.
• Factory reset considerations:
  • On some devices, a full factory reset can remove hidden apps or changes.
  • Before resetting, consider:
    • Backing up data you want to keep (contacts, photos, documents)
    • Whether restoring from an old backup might re-install unwanted apps
    • Setting up the phone as a new device instead of restoring, if that feels safer

Recommended Articles

• Safety Planning Checklist
• Gathering Evidence
• Technology Safety Basics
• Secure Communication Options
• Checking Shared Accounts