A phone's security depends on several layers working together. Biometrics make secure locking convenient; the passcode remains the fallback; the Apple or Google account controls recovery; and the find service only helps if it was enabled and the owner can still sign in.
Use a passcode that is not guessable
Avoid dates of birth, repeated digits, simple sequences and the same PIN used for other services. NCSC guidance for small organisations recommends a different six-digit PIN or password for each device and warns against common values such as 123456 or 000000. Use a longer alphanumeric code where your risk justifies it and you can enter it reliably.
Understand what biometrics do
Face or fingerprint recognition can be a secure and convenient device-unlock method, but it does not replace the fallback passcode. The system may require that passcode after restart, after failed biometric attempts or in other security conditions. Enrol only your own biometrics and remove outdated fingerprints or appearances.
Protect lock-screen information
- Hide message previews and verification codes on the locked screen.
- Review whether wallet, reply, control-centre or quick-setting actions are available while locked.
- Use a short automatic-lock period that remains practical.
- Protect the SIM or network account against unauthorised replacement or account takeover.
Set up recovery before the phone is lost
| Preparation | Check |
|---|---|
| Find service | The phone appears in Apple Find My or Google's Find Hub and location features are enabled. |
| Account recovery | You can access the account from another trusted device or recovery method. |
| 2-step verification | The missing phone is not the only source of verification codes. |
| Backup | Recent essential data can be restored without the handset. |
| IMEI and serial | Recorded privately from settings, packaging or account records. |
Locate, lock or erase?
Start by marking the device lost or securing it. Remote erasure is a last step when protecting data outweighs the chance of continued location. Google states that after an Android device is erased its location will no longer be available in Find Hub. Keep the account association unless the platform or insurer gives a specific reason to remove it.
Do not travel to a live map point to confront a suspected thief. Give location evidence to police where appropriate.
Related guidance: For the wider buying decision, use Buying a Phone. The Complete Phone Buying Guide brings the main costs, checks and trade-offs together.
Sources checked
Information checked on 26 July 2026. This is general UK guidance, not legal, tax or security advice. Terms, complaint routes and platform features can change, so confirm the current wording before acting.
