How to Protect My Phone From Being Hacked: A Practical Checklist

To protect your phone from being hacked, lock it with a passcode of at least six digits, keep the operating system and apps updated automatically, install apps only from the official store, and turn on two-factor authentication for the accounts on it. Then close the two gaps most people miss: put a PIN on your mobile carrier account to block SIM swaps, and switch on your phone’s built-in theft protection.

That covers the large majority of real-world risk. Below is the full checklist, plus what to do if you think something is already wrong. Menu names and features are as of October 2026 and can move between software versions.

The basics that stop most attacks

The U.S. Federal Trade Commission’s phone security guidance boils down to a short list. None of it is glamorous, but it’s what actually matters.

1. Lock the screen. Set the phone to lock automatically when you’re not using it, and use at least a 6-digit passcode. Avoid obvious codes like 123456 or your birth year.
2. Turn on automatic updates. The FTC notes that operating system updates often include critical security patches. Set both the system and your apps to update automatically.
3. Back it up. Regular backups to the cloud or a computer mean a lost, stolen or wiped phone doesn’t take your data with it. The FTC also points out that a cloud backup lives on someone else’s server, so check that provider’s privacy and security policies if the data is sensitive.
4. Enable Find My (iPhone) or Find Hub (Android). Both let you locate, lock or erase a phone remotely if it’s lost or stolen.
5. Use strong passwords and two-factor authentication on the accounts your phone is signed into, especially email, your Apple Account or Google Account, banking and social media.

Apps and links

Most “hacks” that ordinary people run into are not clever exploits. They’re phishing texts and emails that trick someone into typing a password into a fake page or installing something harmful. The FTC warns that phishing messages try to get you to hand over passwords, account numbers or other personal details.

• Install apps only from the App Store or Google Play.
• Don’t tap links in unexpected messages about deliveries, bank problems or account “verification”. Open the company’s app or type its address yourself.
• Review app permissions now and then, and delete apps you no longer use.

On Android, Google Play Protect is the built-in malware scanner. It’s on by default and checks apps for harmful behavior, so leave it on.

Protect your phone number from SIM swaps

Your phone number is often the key to your other accounts, because many services send login codes by text. In a SIM swap, a scammer convinces your carrier to move your number to a SIM they control. Port-out fraud is the same idea, except the number is moved to a different carrier.

The FTC and the FCC both recommend the same first step:

1. Sign in to your carrier account or call customer service.
2. Ask to add a PIN or password that’s required for account changes, SIM changes and number transfers.
3. Ask whether the carrier offers a SIM or port-out lock and turn it on if so.

In late 2023 the FCC adopted rules requiring U.S. wireless carriers to use secure authentication before moving a number to a new device or provider, to notify customers of SIM change and port-out requests, and to offer an account lock. How each carrier implements this varies, so check your own account settings rather than assuming it’s on.

Where a service lets you, use an authenticator app or passkey instead of text-message codes for two-factor authentication. That way a hijacked number alone isn’t enough to get into the account.

Turn on theft protection

A stolen, unlocked phone is a fast route into your accounts. Both platforms now have features that make that much harder.

iPhone: Stolen Device Protection

Apple’s Stolen Device Protection adds extra checks, like Face ID or Touch ID, before sensitive actions when you’re away from familiar places. It needs iOS 17.3 or later, and it has to be on before the phone goes missing. Apple says it may already be on, so check:

1. Open Settings and tap Face ID & Passcode (or Touch ID & Passcode).
2. Enter your passcode.
3. Tap Stolen Device Protection and turn it on.
4. Choose Away from Familiar Locations or Always.

Apple’s guidance lists a passcode, Face ID or Touch ID, two-factor authentication on your Apple Account, Find My and Location Services as prerequisites.

Android: theft protection

Google’s theft protection settings include Remote Lock, which lets you lock a lost phone using just your phone number, and Identity Check, which asks for biometrics before sensitive actions from untrusted locations. Look for them under Settings > Google > All services > Theft protection. Remote Lock needs a screen lock, an active SIM, a verified phone number, Find Hub turned on and an internet connection. Google says some theft features require Android 10 or later and aren’t supported on Android Go devices, tablets or wearables.

Extra-strength modes: who actually needs them

Both Apple and Google offer a hardened mode. They’re useful, but they’re not for everyone.

Apple says most people will never be targeted by the kind of attack Lockdown Mode is built for, and the phone won’t behave normally with it on. Journalists, activists, lawyers and people in public or political roles are the obvious candidates. Calls, plain-text messages and Emergency SOS keep working.

Android’s Advanced Protection requires a screen lock before you can enable it. When it’s on, features like Theft Detection Lock and Offline Device Lock are enabled, and Google Play Protect can’t be turned off. Google notes some parts, such as USB protection, are currently limited to certain devices, including Pixel 6 and later, so what you get depends on your phone.

Public Wi-Fi and VPNs

Public Wi-Fi in cafés, hotels and airports is a shared network you don’t control. A reputable VPN encrypts your traffic between your phone and the VPN server, which helps on networks you don’t trust. It won’t stop phishing, malicious apps or SIM swaps, though, so treat it as one layer, not the whole plan. Choose a provider with a clear, independently checked privacy policy rather than an unknown free app.

Signs your phone may already be compromised

It isn’t always obvious. The FTC lists these warning signs of malware:

• The phone suddenly slows down.
• It won’t shut down or restart properly.
• It won’t let you remove certain software.

For SIM swaps, the signs are a sudden loss of service (no calls, texts or data) and an unexpected message from your carrier saying your SIM was activated on another device.

Battery drain, heat and data spikes are often mentioned online too, but they have plenty of harmless causes, so don’t treat them as proof on their own.

What to do if you think you’ve been hacked

1. Take the phone offline by turning on airplane mode and disconnecting Wi-Fi, as the FTC advises for a known infection.
2. Run a security scan (Play Protect on Android) and remove any apps you don’t recognize.
3. Update the operating system to the latest version.
4. Change your passwords from a different, trusted device, starting with email and your Apple Account or Google Account, and sign out other sessions.
5. Call your carrier if you lost service unexpectedly, to recover your number and add a PIN.
6. Check bank and payment accounts for activity you don’t recognize.
7. If personal information is being misused, U.S. readers can report it at IdentityTheft.gov for a recovery plan.

If problems persist after all that, back up your photos and documents (not apps), then do a factory reset through the phone’s official settings and restore carefully.

The short version

A strong passcode, automatic updates, official app stores, two-factor authentication, a carrier PIN and theft protection cover most of what matters. Lockdown Mode and Advanced Protection are worth it if you have reason to believe someone is specifically targeting you, but they’re optional for everyone else.