How to secure your Android: 8 security settings

You're on the subway, you unlock your phone with your face, and two minutes later someone rips the handset out of your hand. The thief has an unlocked device — and with it, access to your banking app, your messages, the passwords saved in your browser. Android has features that cut off exactly that path, but most of them ship disabled by default or require manual setup. These 8 settings take less than 15 minutes in total and completely change your device's risk profile.

1. A 6-digit PIN on the lock screen (don't rely on biometrics alone)

Biometrics — face and fingerprint — are convenient day to day, but they have a weak point: they can be forced. A criminal can hold the phone up in your direction before you realize what's happening, or use a high-resolution photo to fool the facial sensor. The PIN works as the mandatory fallback, and it's what protects you when biometrics fail or get bypassed.

How to set it up: Settings → Security → Screen lock → PIN. Use at least 6 digits. Avoid obvious sequences (1234, birthdays, years).

Without a solid PIN, every other security feature stays vulnerable to a simple approach: someone watching you type the code before making their move.

2. Identity Check — extra authentication away from trusted places

Available from Android 15 on, Identity Check requires biometrics (fingerprint or face recognition) before allowing critical changes when you're outside a registered "trusted place" such as home or work.

What that prevents: a criminal who obtained your PIN — by observation or coercion — can't change your Google password, disable protections, access saved passkeys or modify account settings. For those actions outside a safe location, the owner's biometrics are mandatory.

How to turn it on: Settings → Google → All Services → Identity Check. Set up your trusted places and enable the feature.

3. Theft protection — automatic snatch detection

Android uses AI and the device's sensors (accelerometer, gyroscope) to identify abrupt movements consistent with a phone being snatched. When it detects that pattern, it locks the screen automatically, according to Android's official documentation.

The feature has three layers:

• Theft Detection Lock: locks on suspicious movement.
• Offline Device Lock: if the thief turns off the internet or gets the PIN wrong several times in a row, the screen locks.
• Remote Lock: you lock the handset from another device, even without access to your Google account at that moment.

How to turn it on: Settings → Google → All Services → Theft protection. Enable all three items.

What happens if the phone is stolen without this protection enabled?

Without those layers, a thief holding an unlocked handset has unrestricted access until you manage to lock it remotely — which can take critical minutes. Automatic detection shrinks that window to seconds.

4. Advanced Protection Mode (Android 16)

Android 16 introduced Advanced Protection Mode: a single toggle that enables a whole hardening bundle at once, with no need to configure item by item.

What it turns on:

• Blocks app installs from outside the Play Store
• Disables 2G connections (more susceptible to interception by stingrays)
• Mandatory Safe Browsing, with no option to disable it
• Blocks USB data while the screen is locked
• Logs intrusion attempts

How to turn it on: Settings → Security → Advanced Protection. Available on devices running Android 16. On earlier versions, each item can be configured individually.

5. Audit your app permissions

Apps accumulate permissions — location, microphone, camera, contacts — and rarely hand them back when they stop needing them. Excessive permissions are a data-collection vector and, in more serious cases, a vector for malware operating in the background.

How to run the audit: Settings → Privacy → Permission Manager. Go through permission by permission and question each app: "does this app really need location all the time, or would only while in use be enough?"

Rule of thumb: if an app hasn't used a given permission in the last 3 months, Android itself already suggests revoking it. Accept whenever there's no clear reason to keep it.

6. Automatic updates — system and apps

Most exploitation on mobile devices attacks vulnerabilities that have already been fixed. The difference between being affected or not usually comes down to simply having installed the available update.

How to make sure:

• System: Settings → System → System update → enable automatic updates.
• Apps: Google Play → profile icon → Settings → Network preferences → Auto-update apps.

Setting it to update over Wi-Fi only is enough — there's no need to burn mobile data on it.

7. Block installs from unknown sources

Why is installing an APK from outside the Play Store risky?

Apps from outside the official store don't go through Google's security checks and are the main malware vector on Android. That includes APKs sent over messaging apps, third-party links and alternative stores with no rigorous review.

The setting ships disabled from the factory, but it may have been enabled without you noticing — when installing an app from outside the store, for example. To check: Settings → Apps → Special app access → Install unknown apps. If any app has that permission active with no clear need, revoke it.

8. Disable USB Debugging

USB debugging mode — part of Developer Options — opens a direct command interface with the operating system over a cable. It's indispensable for anyone building apps, but dangerous for everyday use: any connected computer can run privileged commands on the device.

How to check: Settings → System → Developer Options. If USB Debugging is on and you're not a developer, turn it off. If the entire Developer Options menu is visible unnecessarily, switch off the main toggle at the top of the section.

What matters beyond the device itself

The settings above cover the hardware layer. The account layer demands equal attention: unique passwords per service (a password manager like Bitwarden makes that easy at no cost) and 2FA enabled on critical accounts complete the protection. For anyone who wants a broader view of reducing digital exposure, the OPSEC and privacy guide covers the next steps.

The 8 settings above take less than 15 minutes in total. They don't eliminate every risk — no setting does — but they put your Android on a very different footing from the factory default.