Android security advice from 2018 aged quickly. “Never use public Wi-Fi” and “install a VPN” are not enough for a phone that now holds passkeys, banking apps, identity documents and years of private messages.
Modern Android includes much stronger built-in protections. The job is making sure the important ones are actually configured.
Seven things to check today
Use a strong screen lock
Google recommends a strong PIN of six or more digits, a strong password, or another secure lock. Biometrics add convenience but do not remove the need for a strong fallback credential.
Turn on Theft Protection where supported
On compatible devices, Android can offer Theft Detection Lock, Offline Device Lock, Remote Lock and Identity Check.
Make sure Find Hub can locate the phone
A lost phone is much easier to handle if location and device-finding features were enabled before it disappeared.
Keep Google Play Protect on
Play Protect checks apps for potentially harmful behavior and can warn about or remove harmful apps.
Review app permissions
Camera, microphone, location, contacts and files should be available only to apps that have a reason to use them.
Install system and app updates
Security fixes lose value when they remain in the update screen for three months.
Use stronger account authentication
Passkeys and two-step verification reduce the damage from a stolen or guessed password.
Android now treats physical theft as its own security problem
Can lock after theft-like motion
Google says supported phones can use device motion and connectivity signals to detect a grab-and-run scenario.
Disconnecting does not necessarily help the thief
Supported devices can lock after being used offline for a period.
Lock using your phone number
Google documents remote locking through android.com/lock when the feature has been configured.
Extra biometric protection for sensitive changes
On supported devices, critical account or device changes can require biometrics outside trusted places.
Keep the caution, lose the panic
The original article correctly warned that hostile networks exist, but modern encrypted websites and apps protect much more traffic than they did years ago. Avoid suspicious networks, verify the network name, keep the device updated and do not bypass browser certificate warnings. A trustworthy VPN can add another layer in some situations, but it is not a substitute for device and account security.
The Play Store is safer than random APKs — not magical
Google recommends getting apps from Google Play and uses Play Protect to check apps for harmful behavior. Sideloading can be legitimate for advanced users, but it removes some of the normal store-level friction and makes source verification much more important.
The best Android security setup is mostly built in
Strong lock. Theft protection. Find Hub. Play Protect. Updates. Tight permissions. Strong account authentication.
Those seven layers are more useful in 2026 than turning one privacy app into the entire security strategy.