Maintenance
Part of Consumer device security: a four-asset framework
Phone and tablet security checklist: set it up before a loss
A device security checklist to finish before a phone goes missing: lock and encryption, account recovery, tested backups and the records to keep.
What to take away
- Set the lock, encryption, and find-my-device features before a loss, not after.
- Keep authenticator recovery codes offline, and use SMS codes only as a fallback.
- Test access from another device without erasing anything.
- Record the serial number, IMEI, carrier, warranty, and insurer, and keep support contacts outside the device.
- Treat travel, repair, sale, and a phone-number change as security events.
Use the exact controls for the device and current software. Organization-managed devices may require an administrator to make changes. The reasoning behind each item is set out in the consumer device security guide, and the same checks apply to a tablet as to a phone.
Lock and encrypt the device first
A lost phone is only as safe as the lock and encryption that were configured before it left your hand. Check each setting in the device menu, because a setup screen that promised protection is not proof that it is active.
Lock and encryption setup
- Use a long passcode or password
- Set a short automatic-lock delay
- Review enrolled fingerprints and faces
- Hide sensitive lock-screen previews
- Confirm full-device encryption status
- Store encryption recovery keys separately
- Lock the screen when stepping away
On Apple devices the feature is called Find My, and on Android it is Find My Device.
FTC guidance on protecting a phone from hackers specifically recommends locking the phone, updating software, backing up data, and enabling the platform feature that can find, lock, or erase a lost phone. These steps need configuration before the phone disappears, and each one is easier to set on a calm afternoon than from a borrowed screen.
Close the account gaps a thief would use
A phone often holds the keys to other accounts: authenticator apps, SMS codes, and signed-in sessions. Review those routes while the phone is still in your hand, and keep the recovery material somewhere the phone cannot lose.
Account security review
- Prioritize email, password manager, device, carrier, financial
- Replace reused passwords
- Enable strongest practical MFA
- Register a spare MFA method
- Store recovery codes offline
- Remove old sessions and devices
- Check recovery email and phone details
- Inspect email forwarding rules
A backup does not necessarily contain authenticator codes, so confirm the authenticator's own transfer and recovery process. If none of this has been done yet, start with how to harden personal devices and accounts.
Prepare the backup and the paperwork
Recovery depends on two things that exist outside the lost device: a backup you have actually tested, and the records a carrier or insurer will ask for. Prepare both while the phone works.
- Confirm photos, messages, app exports, and authentication data separately.
- Turn on lost-device finding and remote lock.
- Test access from another device without erasing anything.
- Record the serial number, IMEI, carrier, warranty, and insurer.
- Keep support contacts outside the device.
The copies that make a lost phone survivable are designed in a personal backup system. Treat the test as part of the plan, because a backup that has never been restored is an assumption. Run it from another device, and do it again after any change of phone or provider.
Keep the safety net current each week
Settings drift. An update changes a default, a backup quietly stops, a recovery phone number goes out of date. A short weekly check keeps the lost-device plan working without turning it into a project.
Weekly device security check
- Install OS, browser, app, security updates
- Restart after completed updates
- Confirm latest backup date and scope
- Read sign-in and security alerts
- Inspect charger, port, battery, case, screen
- Investigate unfamiliar apps or profiles
- Record crashes, heat, pop-ups, redirects
CISA's software-update tip sheet explains that providers issue updates to patch security weaknesses and that the protection depends on users installing them. Use automatic updates where supported, then check that they succeed.
- Confirm the latest backup date and scope.
- Read sign-in and security alerts.
- Restart after completed updates.
- Investigate unfamiliar apps or profiles before deleting them.
- Inspect the charger, port, battery area, case, and screen.
Treat travel, repair, and sale as loss events
Handing a device to a repair counter, a buyer, or a border officer carries some of the same risk as losing it. Prepare for each the way you would for a loss.
- Before travel, download required files and maps, and review roaming and border rules.
- Avoid public USB data connections, and keep devices under physical control.
- Before repair, back up, photograph the device condition, and ask whether data or storage will be erased.
- Remove external cards and keys, and use repair mode if supported.
- For sale, remove accounts and activation locks as directed.
- Erase through the supported process and keep a receipt.
Common questions
Are automatic updates enough?
No. Check that the device remains supported and that updates complete. Some firmware and applications need separate action.
Where do authenticator recovery codes go?
Offline, and not in the same app that they recover.
Is a factory reset a security check?
No. It erases data and settings. Use it only within a verified recovery or disposal process.
When should I stop and escalate?
When there is swelling, smoke, unknown administration, or active compromise.
