Your Android phone: the security basics official guidance covers

The main Android phone security settings that Google’s and the ACSC’s guidance cover are automatic updates, a screen lock, 2-Step Verification, backups, Find Hub, app permissions and Google Play Protect. Android is the operating system on phones from many makers, including Google’s Pixel phones and Samsung’s Galaxy phones. Because so many companies build Android phones, menus and feature names differ from one model to the next. This guide explains the main Android phone security settings, what each one does and how it’s turned on.

The steps below follow Google’s own Android Help, with Samsung Australia’s steps where Galaxy phones work differently, and guidance from the Australian Signals Directorate’s Australian Cyber Security Centre (ASD’s ACSC). Google notes that some steps “may vary based on your device”, so each section links the maker’s page for the latest steps.

Why it matters

An Android phone is usually signed in to a Google Account, which can hold email, contacts, photos, passwords and backups. Each setting covers a different risk. Updates close security weaknesses. A screen lock keeps the phone private, and Google says it also encrypts backups. 2-Step Verification protects the Google Account even if the password leaks. A backup keeps data safe if the phone is lost. Find Hub can locate, lock or erase a missing phone.

Some of these only help if they’re set up beforehand. Google says Find Hub needs to be turned on, with the phone signed in to a Google Account, before the phone goes missing.

How to check for and install updates

The ACSC says developers release updates that “fix any security concerns and improve functionality”, and its mobile phone guidance says: “Turn on automatic updates for your phone’s operating system and apps”. On Android, Google says most system updates and security patches install automatically, usually announced by a notification. But Google also says: “Update schedules vary by device, manufacturer, and mobile carrier.”

Based on Google’s instructions (checked October 2026). Menus can change between versions; Google’s update guide has the latest steps.

1. Open the Settings app.
2. Tap System, then Software updates.
3. Check the update status and follow any on-screen instructions.
4. To see the current version, go to Settings > About phone > Android version. This shows the Android version, the Android security update, the Google Play system update and the build number.

Google’s page suggests connecting to Wi-Fi and charging to at least 75% before updating.

On Samsung Galaxy phones, based on Samsung Australia’s update guide (checked October 2026):

1. Open Settings.
2. Tap Software update.
3. Tap Download and install. If an update is available, tap Install now.
4. Repeat until the phone shows that its software is up to date.

Samsung notes that some carriers may require Wi-Fi to check for and install updates. The ACSC’s mobile phone guidance says: “If your phone or operating system is too old it may no longer receive updates”, and describes replacing outdated devices or operating systems.

How to set a strong screen lock

A screen lock stops other people using the phone. Google lists the choices: None and Swipe give no protection; PIN is four or more numbers; Pattern is drawn with a finger; Password is four or more letters or numbers. Google says a “6 digit PIN is recommended for added security” and that “a strong password is the most secure screen lock option.” Google also says a PIN, pattern or password is what encrypts automatic and manual backups. The ACSC’s mobile phone guidance notes that “simple patterns or your date of birth are too easy.”

Based on Google’s instructions (checked October 2026). Google’s screen lock guide has the latest steps.

1. Open Settings.
2. Tap Security. (Google says that if this isn’t there, the phone maker’s support site has the path.)
3. Tap Screen lock, entering the current PIN, pattern or password if one is set.
4. Choose PIN, Pattern or Password.
5. Follow the on-screen instructions.

On Samsung Galaxy phones, based on Samsung Australia’s screen lock guide (checked October 2026):

1. Open Settings, then Lock screen.
2. Tap Screen lock type and confirm the current PIN, pattern or password.
3. Choose the new lock type from the list.
4. Enter and confirm the new PIN, pattern or password.

How to turn on 2-Step Verification for your Google Account

2-Step Verification means signing in to a Google Account needs a second step as well as the password. Google says it adds “an extra layer of security to your account in case your password is stolen.” Google lists several second steps: Google prompts on a signed-in phone, passkeys and security keys (which Google says protect against phishing), authenticator apps, text or call codes, and printable backup codes. Google warns that text and call codes “can be vulnerable to phone number-based hacks.”

The ACSC’s multi-factor authentication guide suggests starting with email accounts such as Gmail, because “a cybercriminal with access to your email accounts can reset passwords for your other accounts.” Our guide to which accounts the ACSC lists first covers this in more detail.

Based on Google’s instructions (checked October 2026). Google’s 2-Step Verification guide has the latest steps.

1. Open the Google Account page at myaccount.google.com.
2. Go to Security & sign-in.
3. Under How you sign in to Google, select Turn on 2-Step Verification.
4. Follow the on-screen steps.

Google says it won’t call asking you to verify a code, and: “Never share your verification codes with anyone, as scammers may try to take over your account.” Our guides to how passkeys work and planning account recovery explain related settings.

How to back up your phone

Google says an Android phone can back up apps and app data, call history, contacts, device settings and text messages to the Google Account, with photos and videos backed up through Google Photos. Google notes that “not all apps can back up or restore all settings and data”, and that photos in Google Photos aren’t encrypted by the screen lock. The ACSC’s mobile phone guidance says: “Backups of important information should be kept on at least two other devices.”

Based on Google’s instructions (checked October 2026). Google’s backup guide has the latest steps.

1. Open Settings.
2. Tap Google services (on some versions, Google), then All services.
3. Under Backup and restore, tap Backup.
4. Choose Photos and videos, Device data, or both, and turn backup on. Google says a first backup can take up to 24 hours.
5. To back up straight away, tap Back up now.

Our guide to the 3-2-1 approach to backups explains keeping more than one copy.

How to turn on Find Hub

Find Hub is Google’s tool for finding a lost Android device. The ACSC’s mobile phone guidance describes using a phone’s remote tracking features to locate it or “remotely erase the contents if it is lost or stolen.” Google says Find Hub can show a phone on a map, ring it at full volume for five minutes even on silent, lock it with a message and contact number, or erase it. To secure or erase a phone, Google says it needs power, mobile data or Wi-Fi, a signed-in Google Account, Find Hub turned on, and to be visible on Google Play; Google’s setup page also lists turning Location on. Google also describes an offline-finding network, which by default stores encrypted recent locations.

Based on Google’s instructions (checked October 2026). Google’s Find Hub setup guide has the latest steps.

1. Open Settings > Security > Find Hub.
2. Check that Allow device to be located is on.
3. Go to Settings > Location and turn on Use location.
4. Optionally, go to Settings > Google > All services > Find Hub > Find your offline devices and choose an option (Off, Without network, With network in busy places only or With network everywhere). Google says setting a PIN, pattern or password helps with finding offline devices.
5. To test, sign in at android.com/find on another device and check the phone appears.

If the phone is lost, Google’s lost device guide explains ringing, locking and erasing. Google warns that erasing “permanently delete[s] all data on your device”, and that its location is then no longer available in Find Hub. Our guide to locking and locating a lost Android phone covers the wider steps, including blocking the phone and the SIM.

On Samsung Galaxy phones, Google’s Find Hub steps describe Android devices generally, and Samsung also offers its own service linked to a Samsung account. Samsung Australia’s SmartThings Find page says Galaxy devices need to be signed in to a Samsung account with Find My Mobile activated. Samsung says SmartThings Find, at smartthingsfind.samsung.com, can ring a device for up to one minute at maximum volume, track its location (updated every 15 minutes), and lock it with a message or emergency contact on the lock screen. Samsung Australia’s Find My Mobile page shows the setting under Settings > your Samsung account > Find my mobile, with an Allow this phone to be found switch, and notes that with Find My Mobile turned off, “you will not be able to locate the device through the website or App if you lose it.” Menus can differ between Galaxy models.

How to review app permissions

Apps ask before using things like the camera, microphone, contacts or location. Google describes four choices for sensitive permissions: All the time (location only), Allow only while using the app, Ask every time and Don’t allow. The ACSC’s mobile phone guidance says: “Only download apps from an official app store”, describes checking that apps are made by a reputable company, and says: “Remove apps when you no longer need them.” It also describes reviewing app permissions and removing apps that ask for excessive or suspicious permissions.

Based on Google’s instructions (checked October 2026). Google’s app permissions guide has the latest steps.

1. Open Settings, then tap Apps.
2. Tap the app (or See all apps first).
3. Tap Permissions, then tap the permission to change.
4. Choose an option, such as Allow or Don’t allow.
5. Optionally, under Unused app settings, turn on Pause app activity if unused.

To see all apps with a particular permission, Google describes Settings > Security and Privacy > Privacy > Permission manager. Samsung’s menus may use different names; Samsung Australia Support covers Galaxy models.

How to check Google Play Protect

Google Play Protect is built into Google Play. Google says it “runs a safety check on apps from the Google Play Store before you download them”, checks for potentially harmful apps from other sources, can warn about, deactivate or remove harmful apps, and may block unverified apps that request sensitive permissions often used in financial scams. Google says it is on by default, and Google’s page recommends always keeping it on.

Based on Google’s instructions (checked October 2026). Google’s Play Protect page has the latest steps.

1. Open the Google Play Store app.
2. Tap the profile icon at the top right.
3. Tap Play Protect, then Settings.
4. Check that Scan apps with Play Protect is on.

Things to watch for

• Phones that no longer get updates. Google says update schedules vary by device, manufacturer and carrier. The ACSC describes replacing outdated devices or operating systems.
• Swipe or no lock. Google says these give no protection, and that backups are only encrypted with a PIN, pattern or password.
• Unexpected codes or prompts. Google says it won’t call asking you to verify a code. The ACSC says never to approve unknown sign-in attempts or share an MFA code. Our guide to how phishing, smishing and vishing work explains how scammers ask for codes.
• Apps from outside Google Play. The ACSC’s guidance describes using only official app stores; Play Protect warnings are worth reading. Our guide to getting the real banking app covers banking apps in particular.
• Find Hub switched off. Google says a phone can only be found if Find Hub was turned on beforehand.

Common questions

How do I secure my Android phone?

Google’s and the ACSC’s guidance covers a handful of settings: automatic updates, a PIN, pattern or password screen lock, 2-Step Verification on the Google Account, backups, Find Hub, app permissions and Google Play Protect. Some only help if set up beforehand: Google says Find Hub has to be on before a phone goes missing. Menus differ between makers, so each section above follows Google’s steps, with Samsung’s where Galaxy phones differ, starting with updates.

What do I do if my Android phone is lost or stolen?

Google’s Find Hub, at android.com/find, can show the phone on a map, ring it, lock it with a message and contact number, or erase it, provided Find Hub was turned on beforehand. Google warns that erasing permanently deletes all data on the device and that its location is then no longer available in Find Hub. Galaxy phones may also use Samsung’s SmartThings Find. The guide to a lost or stolen phone also covers blocking the phone and SIM.

Do I need an antivirus app on my Android phone?

Android phones that use Google Play already have built-in app checking through Google Play Protect. Google says it is on by default, runs a safety check on apps from the Google Play Store before download, and checks for potentially harmful apps from other sources. How to check Google Play Protect shows where the setting is, and the guide to antivirus software explains what paid security suites add on top of built-in protection.

Is a PIN or a password better for my Android screen lock?

Google says “a strong password is the most secure screen lock option”, and that a “6 digit PIN is recommended for added security.” Google also says None and Swipe give no protection, and that a PIN, pattern or password is what encrypts the phone’s backups. The ACSC’s mobile phone guidance notes that “simple patterns or your date of birth are too easy.” The screen lock steps cover both Google’s and Samsung’s menus.

How do I know if my Android phone still gets updates?

It depends on the phone: Google says “Update schedules vary by device, manufacturer, and mobile carrier.” Settings > System > Software updates shows the update status, and Settings > About phone > Android version shows the Android security update. The ACSC says a phone or operating system that is too old may no longer receive updates, and describes replacing outdated devices. See how to check for and install updates, including Samsung’s steps.

Do Samsung phones use Find Hub or SmartThings Find?

Both can be available. Google’s Find Hub works through the Google Account on Android phones. Samsung Australia says its SmartThings Find, at smartthingsfind.samsung.com, needs the Galaxy device signed in to a Samsung account with Find My Mobile activated, and can ring, track and lock the device. Samsung notes that with Find My Mobile turned off, the device can’t be located through the website or app. The Find Hub section has both sets of steps.

Where to get official help

• Google Android Help (support.google.com/android) has current steps for Android settings.
• Samsung Australia Support (samsung.com/au/support) covers Galaxy phones. Other makers have their own support sites.
• ASD’s ACSC publishes mobile phone guidance and runs a 24/7 hotline on 1300 CYBER1 (1300 292 371). Cybercrime can be reported through ReportCyber.

Related guides

• If your phone is lost or stolen
• Setting up a new phone
• How to secure your online accounts
• Passkeys explained
• An account recovery plan
• Backups for personal devices: the 3-2-1 approach
• Smartwatches and fitness trackers: the security basics