Skip to content
LatchkeyDaily
Subscribe

Lockdown guide · about 10 minutes

Lock down your Android phone

By The Latchkey Daily Team, EditorsPublished Updated Verified January 16, 2027

What's at risk: Your phone holds your bank, your email and your two-factor codes. A weak screen lock or a sideloaded app hands all of it over.

Verified against Android 16, January 2027.

You'll need: your Android phone, your carrier account login.

One account a day

The Deadbolt series runs in the daily brief. Get the next guide tomorrow morning.

Free. Weekday mornings. Includes free access to In Case and Serum, the Latchkey tools. Unsubscribe in one click.

Step by step

  1. Strengthen the screen lock. Settings, Security & privacy, Device unlock, Screen lock. Choose PIN (six digits) or Password. Add fingerprint or face unlock for convenience; the PIN is the backup.
  2. Turn on theft protection. Settings, Security & privacy, Device unlock (or Theft protection on recent versions). Turn on Theft Detection Lock, Offline Device Lock and Remote Lock. These lock the phone automatically when it is snatched or taken offline.
  3. Turn on call and text spam protection. Open the Phone app, tap the menu, Settings, Caller ID & spam, and turn on both switches. Open Messages, menu, Settings, Spam protection, on. Add your carrier's free scam-blocking app if it has one.
  4. Keep Play Protect on. Open Google Play, tap your profile, Play Protect, settings gear, and make sure Scan apps with Play Protect is on. Never install an app from a link in a text or email; that is how banking malware arrives.
  5. Turn on Find My Device. Settings, Security & privacy, Device finders, Find My Device, on. Test it at android.com/find.
  6. Turn on automatic updates. Settings, System, Software update; turn on automatic download. In Google Play, settings, Network preferences, auto-update apps.
  7. Lock the SIM with your carrier. Call your carrier or use its app and add an account PIN and a port-out or number lock. This stops SIM swaps, where a scammer moves your number to their phone and receives your codes.
  8. Review app permissions. Settings, Security & privacy, Privacy, Permission manager. Look at SMS, Accessibility and Display over other apps; nothing but your keyboard and a password manager should have Accessibility.

Android’s biggest risk is different from iPhone’s: it is the app you were talked into installing. A “delivery tracker,” a “video call app” from a stranger, a “bank security update.” Once installed with Accessibility permission, it reads your screen, including your bank. Play Protect and the no-links rule prevent it; the permission review above catches it.

Do this for a parent

  1. Set a six-digit PIN they will remember and write it in their notebook.
  2. Turn on spam protection in Phone and Messages; explain that family in Contacts always gets through.
  3. Add yourself in Google Family Link or share location in Google Maps so you can find the phone.
  4. Hide the Play Store sideloading option; set "Install unknown apps" to off for every app.

The whole set, in one afternoon: the Family Setup Kit.

If you get locked out

  1. If the phone is lost, go to android.com/find, lock it and show a message with a callback number.
  2. If you forgot the PIN, you will need to erase from android.com/find and restore from your Google backup; check that backup is on today.

Questions people ask

Why is sideloading the big risk?
Most Android banking malware arrives as an app installed from a link ("install this to track your package"). Keeping Play Protect on and never installing from a link closes that door.
My phone is a few years old and doesn't have these settings.
Older versions have the screen lock, spam protection and Find My Device; the theft-protection features arrived in 2024 and 2025. If the phone no longer gets security updates, that is the strongest reason to replace it.

Related

  • Guide

    Lock down your iPhone

    Your phone is your bank, your email, your photos and your two-factor codes. A stolen passcode is a stolen life.

  • Guide

    Lock down your Gmail account

    Your email is the master key. Anyone inside it can reset the password on your bank, your Amazon and everything else.

  • Guide

    Lock down your bank login

    Online banking is the account scammers are actually after; everything else is a route to it.

  • The scam this stops

    The unpaid toll text scam

    The unpaid toll text scam is a text message claiming you owe a small toll balance and must pay through a link today to avoid a late fee; the link leads to a fake toll-agency page that takes your card number and personal details.

  • The scam this stops

    The package delivery text scam

    The package delivery text scam is a text claiming a package could not be delivered because of a missing address detail or a small redelivery fee, with a link to a fake carrier page that collects your card number and personal details.