Setting up a new phone securely: a step-by-step guide

Setting up a new phone securely mostly means getting four things right during setup: moving data across, a strong screen lock, automatic updates and phone finding. A new phone usually ends up holding the same email, banking apps, photos and messages as the old one within an hour of being switched on. The choices made during setup decide how well all of that is protected. This guide walks through how to set up a new phone securely, one step at a time and in a sensible order, for iPhone and Android phones. Each set of steps is based on the maker’s own instructions, with a link to the latest version.

Why it matters

Setup is the easiest time to get the basics right. Several of the most useful protections, such as a strong screen lock and phone finding, are quick to turn on now and much harder to add after a phone goes missing. Some things can also only be done once. Google, for example, says its tool for copying data from an old Android phone can only be used during setup.

The Australian Signals Directorate’s Australian Cyber Security Centre (ASD’s ACSC) publishes a guide to securing a mobile phone. It covers updates, screen locks, apps, backups and remote tracking, and the steps below line up with those topics.

Before you start

A few things make setup smoother. Apple and Google both describe:

• Charging both phones, and keeping them plugged in while data moves across.
• Connecting to Wi-Fi. Google recommends Wi-Fi for transfers.
• Updating the old phone first. Apple describes updating both the old and new device to the latest version of iOS or iPadOS before using Quick Start.
• Checking a recent backup exists. Google says restoring from a Google backup only works if backups were turned on for the old phone before it became unavailable. The guide to the 3-2-1 backup approach explains how backups work.

Setting aside some time helps too. Google says a transfer can take from minutes to a few hours, and Apple says Quick Start ties up both devices for a while.

How to move data to a new iPhone

Based on Apple’s instructions (checked October 2026). Apple’s guide Use Quick Start to transfer data to a new iPhone or iPad has the latest steps.

1. On the old iPhone, connect to Wi-Fi and turn on Bluetooth. Unlock it and go to the Home Screen.
2. Turn on the new iPhone and place it near the old one. Follow the prompts that appear on both screens.
3. Connect the new iPhone to Wi-Fi or the mobile network, and activate the mobile service if asked.
4. Set up Face ID or Touch ID when prompted.
5. Choose how to bring data across: Download from iCloud, which lets the new phone be used straight away while apps and data download in the background, or Transfer directly from the old phone, which means waiting until it finishes.
6. Keep both phones near each other and plugged in until the transfer is complete.

Apple also describes a wired transfer, and restoring from an iCloud or computer backup, in separate guides.

How to move data to a new Android phone

Based on Google’s instructions (checked October 2026). Google’s guide Copy apps and data from an Android to a new Android device has the latest steps.

1. Turn on the new phone and tap Start.
2. Connect to Wi-Fi, or insert the SIM or download an eSIM to get online.
3. On the new phone, tap Copy and connect the two phones with a cable. Google describes a cable as the recommended method, and lists a wireless option for phones without a suitable cable.
4. On the old phone, tap Copy. Google says signing in to the Google Account gives a more complete transfer.
5. Choose what to copy, then tap Copy and wait for the old phone to say it’s finished.

Google says “You can only perform data transfer once,” and the option may disappear after setup. It also lists things that don’t move across, including downloaded files such as PDFs, apps that didn’t come from the Google Play Store, and accounts other than Google Accounts. Those apps and accounts need to be set up again by hand.

If the old phone isn’t available, Google describes restoring from a backup stored in the Google Account during setup instead.

How to set a strong screen lock

The ACSC describes locking a phone with “a passphrase, password, PIN or biometrics”. It says patterns and birthdays are weak choices, and describes setting the phone to lock automatically “after a short time of inactivity, such as five minutes.” It also describes facial recognition or a fingerprint as a way to stop people watching the code being typed.

iPhone. Based on Apple’s instructions (checked October 2026). Apple’s guide Use a passcode with your iPhone has the latest steps.

1. Open Settings, then tap Face ID & Passcode (or Touch ID & Passcode on earlier models, or Passcode on devices without Touch ID).
2. Tap Turn Passcode On.
3. Enter a six-digit code, or tap Passcode Options to choose a custom numeric or custom alphanumeric (letters and numbers) code. Apple also lists a four-digit option there.
4. Enter the passcode again to confirm.

Apple’s guide also describes an optional Erase Data setting, which erases the phone after ten failed passcode attempts. Apple says the passcode is needed when the phone is turned on or restarted, when software is updated and when the phone is erased. Other settings worth knowing about are covered in iPhone security settings, step by step.

Android. Based on Google’s instructions (checked October 2026). Google’s guide Set screen lock on an Android device has the latest steps.

1. Open the Settings app.
2. Tap Security. Google notes the name and location of this menu differ on some phones, and points to the phone maker’s support site.
3. Tap Screen lock.
4. Choose a lock type: PIN, pattern or password.
5. Follow the prompts.

Google says a PIN needs four or more numbers, recommends six digits for better security, and says longer PINs are generally more secure. It describes a password as the most secure screen lock option. “None” and “Swipe” give no protection. The guide to Android phone security settings covers more Android options.

How to turn on automatic updates

Updates fix security weaknesses as they’re found. The ACSC describes turning on “automatic updates for your phone’s operating system and apps”.

iPhone. Based on Apple’s instructions (checked October 2026), from Update your iPhone or iPad:

1. Open Settings and tap General.
2. Tap Software Update, then Automatic Updates.
3. Turn on Automatically Install. Apple says the phone then installs updates overnight while it’s charging and on Wi-Fi.

Android. Based on Google’s instructions (checked October 2026), from Check and update your Android version:

1. Open Settings.
2. Tap System, then Software updates, to see the update status.
3. Follow the prompts to install anything waiting.

Google says most system updates and security patches install automatically, and that update schedules vary by device, maker and mobile provider. Its guide describes connecting to Wi-Fi and charging to at least 75% before a large update.

How to turn on phone finding

Phone finding is what makes it possible to lock, locate or erase a phone that goes missing. It only helps if it’s on before that happens.

iPhone. Based on Apple’s instructions (checked October 2026), from How to turn on Find My:

1. Open Settings and tap your name.
2. Tap Find My, then Find My iPhone, and turn it on.
3. Turn on Find My network, which Apple says helps locate the phone even when it’s offline.
4. Turn on Send Last Location, which sends the phone’s location to Apple when the battery is low.

Android. Based on Google’s instructions (checked October 2026), from Be ready to find a lost Android device:

1. In Settings > Passwords, passkeys and accounts, check that the Google Account appears.
2. Open Settings, then Location, and turn on Use location.
3. Go to Settings > Security > Find Hub and check that Allow device to be located is on.
4. To test it, go to android.com/find on another device, sign in with the same Google Account, and check the phone appears.

Google also says the phone must be visible in Google Play (at play.google.com/library/devices, with Show in menus ticked) to show up in Find Hub.

Accounts, apps and permissions

Setting up a phone means signing back in to email, banking and social media. The ACSC’s Easy Steps guide describes turning on multi-factor authentication (MFA), starting with the most important accounts: email, online banking and accounts with stored payment details. Setup is when many of these accounts get signed in to again. The guides on securing your online accounts and what passkeys are and how they work explain the options.

For apps, the ACSC describes:

• downloading apps “only from an official app store”
• checking the app’s developer before installing
• reviewing app permissions and removing apps that ask for “excessive or suspicious permissions”
• deleting apps that are no longer used.

The ACSC also warns against storing passwords, PINs or identity documents on a phone “without additional protection”, and gives a password manager with its own login as one option. How password managers work explains what they do.

The old phone

Once everything has moved across and been checked, the old phone still holds a full copy of the owner’s data. The ACSC describes removing all personal information before a phone is sold or given away, and says a factory reset erases data and restores the original settings. The guide on selling or recycling a device explains the steps for each type of phone.

Things to watch for

• The one-time transfer. Google says its Android transfer tool can only be used once, during setup.
• Things that don’t transfer. Apps from outside the Play Store, non-Google accounts and downloaded files have to be set up again on Android, according to Google.
• Skipping the screen lock. Some setup screens offer to skip it. Apple’s Lost Mode locks a missing phone with its passcode, and Google’s Mark as lost locks it with its PIN, pattern or password, so these features rely on a screen lock being set.
• Backups not turned on. Google’s restore option only works if backups were on for the old phone before it was lost or reset.
• Sign-in codes from an app. Some accounts send MFA codes to an authenticator app on the phone rather than by text. Each authenticator app’s own help pages explain how it moves to a new phone. The account recovery plan guide explains backup codes and other ways back in.
• Old phones that no longer get updates. The ACSC says an older phone “may no longer receive updates.”

Common questions

How do I set up a new phone securely?

Setup is the easiest time to get the basics right. The ACSC’s mobile phone guidance covers updates, screen locks, apps, backups and remote tracking. After moving data across, that means a strong screen lock, automatic updates, phone finding, and MFA on important accounts such as email and banking. The ACSC also describes downloading apps “only from an official app store”. The iPhone and Android steps start at before you start.

Do I need my old phone to set up a new one?

Not always. Apple describes restoring from an iCloud or computer backup, and Google describes restoring from a backup stored in the Google Account during setup. Google says this only works if backups were turned on for the old phone before it became unavailable. With the old phone on hand, Apple’s Quick Start and Google’s copy tool move data directly. See before you start.

Can I transfer data to a new Android phone after setup?

Google’s transfer tool is a one-time, setup-only option: Google says “You can only perform data transfer once,” and the option may disappear after setup. Google also lists things that don’t move across, including downloaded files such as PDFs, apps that didn’t come from the Google Play Store, and accounts other than Google Accounts. Those have to be set up again by hand. See how to move data to a new Android phone.

Is a PIN or a pattern better for a phone screen lock?

The ACSC says patterns and birthdays are weak choices, and describes locking a phone with “a passphrase, password, PIN or biometrics”. Google says a PIN needs four or more numbers, recommends six digits, and describes a password as the most secure option. “None” and “Swipe” give no protection. The ACSC also describes the phone locking automatically after a short time, such as five minutes. Steps: how to set a strong screen lock.

How do I make sure I can find my new phone if I lose it?

Phone finding only helps if it’s turned on before the phone goes missing. On iPhone, it’s under Settings > your name > Find My > Find My iPhone, along with Find My network and Send Last Location. On Android, Google describes checking that Allow device to be located is on under Settings > Security > Find Hub, then testing it at android.com/find. See how to turn on phone finding.

What do I do with my old phone after setting up the new one?

It still holds a full copy of your data until it’s erased. The ACSC describes removing all personal information before a phone is sold or given away, and says a factory reset erases data and restores the original settings. Checking that everything has moved across comes first. The old phone section has the summary, and the guide to wiping a phone before selling or recycling it has the steps.

Where to get official help

• The ACSC’s mobile phone guidance is the official source for the security settings above.
• Apple Support and Android Help describe the exact setup and transfer steps. Samsung and other makers publish their own guides.
• If a phone goes missing later, the guide on a lost or stolen phone explains what official sources say to do.