Your phone holds your bank app, your email, your photos, your two-factor codes, and a record of everywhere you’ve been. If someone gets in, they can reach almost every part of your life from one screen. The good news is that most phone hacks aren’t movie-style break-ins. They come from weak lock screens, reused passwords, phishing texts, and stolen phone numbers, and you can fix every one of those in an afternoon.
Zero-click spyware, which infects a phone without a single tap, is real, but it’s expensive and aimed at journalists, activists, and executives. For most people, the everyday threats below matter far more. Everything here works on both iPhone and Android unless noted.
The Short Version
If you only have ten minutes, do these five things first:
- Set a six-digit or longer passcode
- Turn on two-factor authentication, using an authenticator app instead of text messages
- Add a PIN or number lock to your phone account at your carrier
- Turn on automatic updates for your phone and apps
- Turn on Find My iPhone or Find Hub (Android)
1. Set a Strong Lock Screen
Many phone compromises start with someone holding your unlocked phone for a minute, not with a remote attack. Use Face ID or your fingerprint for daily convenience, but back it with a six-digit PIN or longer. A pattern or four-digit code is easy to guess or to watch over your shoulder.
iPhone: Settings > Face ID & Passcode > Change Passcode > Passcode Options, then choose a custom alphanumeric code or a longer numeric code.
Android: Settings > Security (or Security and privacy) > Screen lock, then choose PIN or Password. Menu names vary a little by manufacturer.
iPhone users should also turn on Stolen Device Protection in the same menu. When your phone is away from familiar places like home or work, it adds an extra Face ID check and a one-hour delay before sensitive changes, such as changing your Apple ID password.
2. Turn On Two-Factor Authentication and Use Passkeys
Two-factor authentication (2FA) means a stolen password alone can’t open your account. Turn it on for your email first, because email can reset every other account you own. Then do your bank, social media, and anything with a saved card.
Where you have a choice, use an authenticator app such as Google Authenticator or Microsoft Authenticator instead of text message codes. Text codes can be intercepted through SIM swapping, covered in the next step.
Better still, use passkeys wherever a site offers them. A passkey replaces your password with a key stored on your device and unlocked with your face or fingerprint, so there’s nothing for a fake login page to steal. A password manager helps with everything else by creating a unique password for each account. We compared the main options in our guide to the best password managers.
3. Protect Your Phone Number From SIM Swapping
In a SIM swap, a scammer convinces your carrier to move your phone number to a SIM card they control. Then they receive your text message codes and can reset your passwords. It’s a common route to drained bank accounts and hijacked email.
Call your carrier or open your account settings and add a port-out PIN, number lock, or extra account passcode. Most major US carriers offer one. Avoid anything easy to guess, like a birthday. If your phone suddenly loses service for no clear reason, call your carrier from another phone right away.
4. Spot Phishing Texts and QR Code Scams
Phishing is still one of the most common ways people get hacked on a phone, and the old advice to look for spelling mistakes no longer works. Scammers now use writing tools that produce clean, personalized messages that sound like your bank, your boss, or a delivery company.
- Don’t react to urgency. “Your account will be closed in 24 hours” is a pressure tactic, not a fact.
- Verify another way. Call the number on the back of your card, or open the official app yourself instead of tapping the link.
- Be careful with QR codes. A code on a parking meter or table card can lead to a fake login page, and you can’t see the address until you scan. Read the address your phone shows before typing anything.
- Report it. Forward scam texts to 7726 (SPAM), which works with major US carriers, and report fraud at ReportFraud.ftc.gov.
5. Keep Your Software Updated
Updates fix security holes that attackers are already using. Turn on automatic updates: on iPhone, go to Settings > General > Software Update > Automatic Updates. On Android, go to Settings > System (or About phone) > Software update. Update your apps too.
If your phone no longer gets security updates from the manufacturer, which is common with older Android models, no setting can fix that. Replacing the phone is the real upgrade.
6. Clean Up Your Apps and Permissions
Delete apps you haven’t opened in months. Abandoned apps stop getting security fixes and may still collect data you forgot you allowed. For the ones you keep, review permissions: on iPhone, go to Settings > Privacy & Security. On Android, go to Settings > Privacy > Permission manager. A flashlight app that wants your contacts or microphone is a red flag. Set location to “While Using” for most apps.
Install apps only from the App Store or Google Play. Sideloaded apps skip the review process and are a major source of Android malware.
7. Stay Safe on Public Wi-Fi and Public Chargers
Public Wi-Fi is less risky than it used to be, since most sites use HTTPS encryption. Fake hotspots named after a real cafe or hotel can still capture your activity, though. Turn off auto-join for open networks and skip banking on public Wi-Fi.
When you need an unfamiliar network, use a VPN so the network owner can’t read your traffic. Avoid free VPNs, since some make money by logging or selling your browsing data. Our breakdown of the best VPN services for privacy and security shows how the main options compare.
Federal agencies have also warned about “juice jacking” at public USB charging ports, although confirmed real-world cases are rare. The easy fix is to use your own charger and an outlet, or carry a USB data blocker.
8. Decide Whether You Need Mobile Antivirus
On iPhone, apps run in a sandbox and Apple reviews the App Store, so a third-party antivirus app adds little for most people. On Android, Google Play Protect is built in. Open the Play Store, tap your profile icon, choose Play Protect, and make sure scanning is on.
A paid security app can add scam link warnings and safe browsing, which helps if you tap a lot of links or install apps from outside the Play Store. If you want one, check independent lab results from AV-Test or AV-Comparatives instead of relying on ads.
9. Set Up Find My Device and Backups Before You Need Them
Strong passwords can’t help if your phone is physically gone. What matters then is location tracking, remote lock, and remote erase, and you have to turn them on in advance.
iPhone: Settings > tap your name > Find My > Find My iPhone, then turn on Find My network and Send Last Location.
Android: Search Settings for Find Hub (formerly Find My Device) and make sure it’s on.
Back up your phone regularly so a remote erase doesn’t cost you your photos. iCloud and Google backups work, and a dedicated service gives you a second copy. See our guide to the best cloud backup services.
Signs Your Phone May Be Hacked
Watch for sudden battery drain, unusually high data use, apps you don’t remember installing, password reset emails you didn’t request, or friends getting odd messages from your accounts. Many of these have ordinary causes, like a bad app update, so treat them as a reason to check, not as proof.
What to Do If Your Phone Has Been Hacked
- On a different, trusted device, change your passwords, starting with your email and your Apple ID or Google account. Sign out of all other sessions.
- Check your account security pages for unknown devices, new recovery emails or phone numbers, and mail forwarding rules. Remove anything you don’t recognize.
- Delete apps you don’t recognize. On Android, run a Play Protect scan.
- Call your bank if money or card details may be involved, and call your carrier if you suspect a SIM swap.
- Back up what you need, then do a factory reset if problems continue.
- If personal data was exposed, freeze your credit with Equifax, Experian, and TransUnion. It’s free and stops new accounts from being opened in your name. Report identity theft at IdentityTheft.gov.
Paid identity theft protection services add monitoring and recovery help, but a credit freeze handles the most important job for free.
Frequently Asked Questions
What is the most important way to protect my phone from hackers?
Start with a strong lock screen and two-factor authentication through an authenticator app. Those two steps block most opportunistic attacks. Then protect your phone number from SIM swapping and keep your phone updated.
Can iPhones get hacked?
Yes. iPhones are harder to infect with malware, but they can still be compromised through phishing, stolen Apple ID credentials, SIM swapping, or a thief who knows your passcode.
Can someone hack my phone with just my phone number?
Not directly in most cases. But a phone number can be used for SIM swapping and targeted phishing texts. A PIN or number lock at your carrier closes the biggest risk.
Is a VPN enough to keep my phone secure?
No. A VPN protects your connection on networks you don’t control, but it doesn’t stop phishing, weak passwords, or malicious apps. It’s one layer, not a complete fix.
Final Thoughts
Phone security comes down to a short list of habits: a strong lock screen, an authenticator app or passkeys, a locked-down phone number, quick updates, and healthy doubt toward urgent messages. Do the five steps in the short version today, then work through the rest as you have time.
Enjoyed this article?
If this guide helped you, consider supporting Rough Diary. Your support helps us continue creating practical, informative, and useful AI and technology content.
