Before you finish setting up a new phone, check its screen lock, software updates, lost-device tools, theft protection, and account recovery options. Then review what your apps and lock screen are allowed to reveal.
These settings address ordinary problems: a phone left on a café table, a password forgotten after an upgrade, or an app with more access than it needs.
You do not need to switch on every setting with “security” in its name. Start with the protections you can use reliably, and check that they still work after transferring your old apps and accounts.
The instructions below cover iPhone and Android. Android menus vary by manufacturer, and both platforms change with software updates. If a path does not match your phone, use Settings search or your manufacturer’s official support guide.
Make the screen lock worth having
Your phone may contain email, banking apps, saved credentials, family photos, and account-recovery messages. Its unlock code deserves more thought than a familiar birthday.
Choose a unique PIN or passcode. Avoid repeated digits, obvious sequences, and a code other people routinely use. A longer code is worthwhile if you can remember and enter it consistently.
Set up fingerprint or face unlocking where supported, but remember that the underlying PIN or passcode still matters. You will need it in situations such as restarting the device.
On iPhone:
Open Settings → Face ID & Passcode, or Touch ID & Passcode on supported models.
Review your passcode and biometric settings.
Open Settings → Display & Brightness → Auto-Lock and choose a short interval that works for you.
Apple’s passcode guide explains the available controls.
On Android:
Search Settings for Screen lock and choose a PIN or password. “Swipe” is not a protective screen lock. Review the screen timeout and any separate setting controlling how quickly the phone locks afterward.
Check convenience features that keep the phone unlocked near a place or accessory. Use them deliberately rather than assuming that “at home” always means private.
Check the result: lock the phone, set it down, and confirm that opening an app requires authentication.
Keep updates moving after setup day
A new phone may have spent time in a warehouse. Check for updates before treating it as current.
On iPhone: open Settings → General → Software Update → Automatic Updates. Enable automatic installation if you are comfortable with it, and review the available system-file update options. Apple explains these choices in its update guide.
On Android: search for Software update and Google Play system update. Also review the security update date. These are related checks, but they are not necessarily the same update.
Google’s Android update guide notes that schedules depend on the device, manufacturer, and carrier.
Keep app updates enabled through the app store you use. If you choose manual updates, make them a recurring task rather than something you only do when an app stops working.
Check the result: finish any required restart and return to the update screen. An update that has downloaded may still need installation.
Set up lost-device access while the phone is still in your hand
A device-finding tool is most useful when you have already checked how to reach it without the missing phone.
On iPhone: open Settings → your name → Find My → Find My iPhone. Review the available finding options. Apple’s setup guidance explains accessing Find My from another device or through iCloud.
On Android: search Settings for Find Hub, Google’s device-finding service. Follow its setup checks, including whether the device can be located and your preferred offline-finding settings.
Google’s lost-device preparation guide explains the requirements and privacy choices.
From another trusted device, confirm that the new phone appears in the appropriate service. You can try a harmless feature such as playing a sound. Do not test remote erasure.
Location is not guaranteed in every situation. Device support, connectivity, power, and settings affect what the service can do. A map location is also not a reason to confront someone who may have stolen the phone.
Check the result: you know where to start if the phone goes missing, and how to access that service independently.
Enable the theft protections your phone supports
A screen lock helps when someone does not know your code. Some newer protections address the harder situation where a thief has seen the code or takes the phone while it is unlocked.
On iPhone: check Stolen Device Protection
Stolen Device Protection adds safeguards to certain sensitive actions when someone has both the iPhone and knowledge of its passcode.
Depending on the action and configuration, it can require Face ID or Touch ID without a passcode fallback, or introduce a security delay.
Open Settings → Face ID & Passcode, or Touch ID & Passcode, then look for Stolen Device Protection. Review whether protection applies away from familiar locations or always.
Apple’s instructions explain the behavior. Understand it before you need to change account settings while traveling.
On Android: review Theft protection
Google lists Settings → Google → All services → Theft protection as a starting point on supported devices.
Options may include Theft Detection Lock, Offline Device Lock, Remote Lock, and Identity Check. Availability and requirements vary.
For example, Remote Lock requires setup conditions including a screen lock and verified phone number. Identity Check is available only on certain devices. Google’s theft-protection guide explains these differences.
Enable supported features after reading what they do. Do not interpret an unavailable option as evidence that the phone is broken, or assume automatic theft detection will catch every incident.
Reveal less on the lock screen
A locked phone can still display private information.
On iPhone: open Settings → Notifications → Show Previews. Consider When Unlocked or Never, particularly for messages, email, and financial apps. Apple documents these preview choices.
On Android: search for Lock screen notifications and review whether sensitive content is hidden. The wording varies by device.
Check any widgets or live activities you have added, too. The aim is to keep useful alerts without displaying their contents to everyone nearby.
Check the result: send yourself a harmless message and look at the phone before unlocking it.
For additional privacy when handing someone your phone, supported iPhones can lock eligible apps: touch and hold an app and look for Require Face ID, Touch ID, or Passcode. Apple lists the restrictions.
App locking is useful, but it does not replace a strong device passcode.
Give apps the access they need—and review the rest
Transferring apps can bring old habits onto a new phone. Review permissions rather than granting everything during setup.
Start with location, photos, contacts, microphone, and camera.
App’s purpose | Permission worth considering |
|---|---|
Turn-by-turn navigation | Location while using the app; precise location when needed |
Adding a profile picture | Selected photos, if supported |
Voice or video calls | Microphone and camera |
A basic calculator | Question requests for contacts or location |
These are decision examples, not universal rules. Some apps have legitimate background functions; check what you use before disabling them.
On iPhone: start in Settings → Privacy & Security. Apple’s location guide explains choices such as allowing access while an app is in use.
On Android: use Permission manager or Privacy dashboard, depending on the device. Google’s guide explains reviewing recent permission access.
Keep Google Play Protect enabled on Android devices that support Google Play services. Be cautious when an unfamiliar app asks you to bypass restricted settings or grant extensive accessibility access.
Check the result: you can explain why each app with sensitive permissions needs them.
Make recovery independent of the new phone
The most secure setup is frustrating if losing the phone also locks you out of every recovery method.
Review the Apple Account or Google Account that manages the device. Confirm its recovery details and account-security options.
Apple supports account recovery contacts. Google supports backup codes for 2-Step Verification.
Keep necessary recovery material somewhere protected that you can access without this phone. Do not put the only copy inside an account you cannot open without it.
Then check backups separately:
iPhone: review iCloud Backup or your chosen computer-backup process.
Android: review the device backup settings and any separate photo-backup service you use.
Apple and Google explain their backup options.
Look for a recent successful backup and check what it includes. Available storage and app-specific rules matter. A successful phone backup does not necessarily preserve every app’s login or authentication setup.
Before erasing or trading in the old phone, verify important accounts, authenticator access, photos, and other data on the new one.
Useful extras that need the right expectations
Some settings are valuable in specific situations. They should not distract from the checks above.
Private Browsing on iPhone: Safari keeps private tabs out of ordinary browsing history and tab syncing. It does not make you anonymous to every website or prevent you from submitting information to a scammer. Apple explains its scope.
Blocking cookies: on current iPhone menus, Apple lists Settings → Apps → Safari → Advanced → Block All Cookies. Blocking everything can break sign-ins and other website functions. It is an optional privacy choice, not a required security upgrade. See Apple’s cookie guidance.
Message encryption: not every message sent from an iPhone uses the same protection. iMessage, RCS, and SMS/MMS differ. Supported RCS conversations can be end-to-end encrypted, but software, carrier support, and the other participant matter. Do not judge encryption by bubble color alone; consult Apple’s messaging guide.
Android Lockdown mode: on supported Pixel phones, Lockdown temporarily disables biometric unlocking, Extend Unlock, and lock-screen notifications until the next unlock. It is an occasional control, not a permanent protection switch. Other brands may implement it differently. See Google’s Pixel instructions.
A child’s phone: use an appropriate child account and parental controls. On iPhone, review Screen Time and Content & Privacy Restrictions through Apple’s supported family setup. Apple’s parental-control guide explains the options. Use controls alongside conversations about purchases, contact requests, and suspicious messages.
Know when a setup check becomes an account-security problem
Battery drain, warmth, or a slow app does not by itself establish that an iPhone has been hacked.
Unexpected account changes, unfamiliar devices, or activity you did not authorize deserve investigation. Open the account’s official settings directly and follow its recovery guidance; do not install software from a pop-up claiming to diagnose an infection.
Apple’s compromised-account guidance provides specific signs and next steps.
For an ordinary new-phone setup, finish with three practical checks: the phone locks as intended, you can find it from another device, and you have a recovery route plus a recent backup.
Those checks give you a useful result today—and a less stressful starting point if something goes wrong later.
