How to Protect a New Phone Before Signing In to Your Accounts

A new phone is exciting, but signing in immediately can expose your accounts if the device is not properly secured. Before adding your email, banking apps, social media profiles or work accounts, take a few minutes to protect the phone itself.

This is especially important if you use mobile banking, digital payment services, work platforms or apps connected to your identity documents. The steps below apply broadly to Android phones and iPhones, although menu names may differ slightly between manufacturers and software versions.

1. Confirm that the phone is genuinely yours

If you bought the phone from a shop, online seller or another person, check its condition before signing in.

• Make sure the packaging, receipt and device details match.
• Check that the phone is not still linked to another person’s Apple or Google account.
• Ask the seller to complete a proper factory reset if it is a used phone.
• Inspect the phone for unusual applications, unknown user profiles or remote-management messages.
• Confirm that the device can receive software updates from its manufacturer.

On an iPhone, a used device that asks for the previous owner’s Apple Account during activation may still be protected by Activation Lock. On Android, a device reset without removing the previous Google account may request the former owner’s credentials through factory reset protection. Do not try to bypass these protections. Ask the seller to resolve the issue or seek a refund.

2. Update the operating system before adding accounts

Connect to a trusted Wi-Fi network and install available system updates. Updates can fix security weaknesses, improve stability and correct problems that existed when the phone left the factory.

On Android, look in the Settings app for System update, Software update or a similar option. On an iPhone, open Settings > General > Software Update. The exact wording can vary by device and software version.

Also update important built-in components and apps after the initial setup. If the phone is new but has been sitting in storage for months, it may need several updates before it is fully up to date.

3. Set a strong screen lock

Your screen lock is the first barrier protecting your messages, photographs, saved sessions and applications. Avoid simple patterns, birthdays, repeated numbers and codes that someone could guess from knowing you.

Use a long PIN, password or passcode that is not reused on another account. A six-digit PIN is generally stronger than a four-digit PIN, while a password can provide additional protection if you can enter it reliably.

Biometric unlocking, such as fingerprint or Face ID, is convenient, but it should support—not replace—a strong passcode. Your phone will still ask for the main passcode at certain times, including after a restart or other security events. Do not share that passcode with friends, agents, sellers or anyone claiming to need it for setup.

4. Enable the phone-finding and remote-lock features

Turn on the feature that helps you locate, lock or erase the phone if it is lost or stolen.

• Android phones commonly use Find My Device.
• Apple devices use Find My.

These features normally require you to sign in to the related Google or Apple account. If you are not ready to add your main account, complete the basic security steps first and enable the feature as soon as you sign in.

Check that location services, mobile data or Wi-Fi and the relevant device-finding settings are available. Test the service later from another trusted device or browser. Do not wait until the phone disappears before discovering that the feature was never enabled.

5. Protect your SIM and mobile number

Your phone number may be used to receive login codes, reset accounts or communicate with banks and payment services. Protect the SIM card as carefully as the phone.

Set a SIM PIN if your mobile network and device support it, but store the PIN and the PUK securely. Entering an incorrect SIM PIN repeatedly can block the SIM. If you use two SIMs, label them clearly in the phone settings and understand which number receives calls and messages.

Ask your network provider what to do if your phone or SIM is lost. Avoid posting your phone number publicly when it is connected to important accounts, and be suspicious of unexpected messages about SIM replacement or account verification.

6. Secure your main Google or Apple account

Your primary account controls access to backups, contacts, app downloads, photos and device-finding tools. Use a unique password that you do not use for email, social media or any other service.

Enable two-step verification or two-factor authentication where available. Prefer an authenticator app, security key or another strong method when it is practical. SMS codes can still be useful, but they depend on control of your phone number and may be exposed through SIM-related scams.

Review recovery phone numbers and email addresses. They should belong to you and remain accessible. Do not add a stranger’s number, an agent’s email address or a temporary address as a recovery method.

7. Install apps carefully

Use the official Google Play Store or Apple App Store whenever possible. Avoid installing applications from links sent through random WhatsApp messages, text messages, social media comments or unofficial websites.

Before installing an app, check its name, developer, reviews and requested permissions. Be careful with an app that asks for access unrelated to its purpose. For example, a simple calculator should not need access to your SMS messages, contacts, microphone and accessibility controls.

Some harmful apps imitate banking services, cryptocurrency platforms, delivery companies or government services. Download an organisation’s app through its verified website or the official app store listing rather than trusting an advertisement or forwarded link.

8. Review privacy and permission settings

During setup, applications may request access to your location, camera, microphone, contacts, photos, files or notifications. You do not have to approve every request immediately.

Choose options such as While using the app, Allow once or Limited photos where available. Later, review permissions in the phone’s privacy or application settings and remove access that an app does not need.

Be particularly careful with accessibility access, notification access, device administrator privileges and the ability to install unknown applications. These controls can be powerful. Only grant them to an app you trust and fully understand.

9. Reduce what appears on the lock screen

Message previews and one-time passwords can appear on a locked screen if notification settings are left unchanged. Someone holding your phone may read private information without knowing your passcode.

Change lock-screen notification settings so sensitive message content is hidden. You can allow general notifications while hiding the sender and message text. Consider doing the same for email, financial apps, password managers and work tools.

10. Prepare a safe backup and recovery plan

Turn on encrypted backups or the platform’s secure backup options after confirming that your main account is protected. Back up contacts, photographs and important documents, but avoid keeping unnecessary copies of identity documents in easily accessible folders.

If you use a password manager, install it from its official source and secure it with a strong master password. Keep recovery codes in a private, offline location. Do not save them in a public note, send them to yourself through an unknown account or photograph them without protecting the image.

A simple setup order for a new phone

1. Inspect the device and confirm that it is not linked to another owner.
2. Connect to trusted Wi-Fi and install system updates.
3. Create a strong screen lock and enable biometric unlocking if desired.
4. Set up device-finding and remote-lock features.
5. Secure your Google or Apple account with a unique password and two-step verification.
6. Install only essential apps from official stores.
7. Review permissions, notifications and backup settings.
8. Sign in to banking, email and social accounts only after completing the earlier steps.

When you should pause before signing in

Stop the setup if the phone behaves strangely, shows an unknown administrator, repeatedly displays fake security warnings, redirects you to unusual websites or contains apps you did not install. A seller or technician who demands your password, OTP, banking PIN, recovery phrase or verification code is also a serious warning sign.

For banking and payment apps, type the official website address yourself or use a verified app-store listing. Never give your login details to someone offering to “help” activate the account. Legitimate support should not need your password, card PIN or one-time code.

The practical takeaway

Protecting a new phone is not only about installing an antivirus app. The most important safeguards are a trustworthy device, current software, a strong screen lock, secure account recovery, careful app installation and controlled permissions. Complete those basics before signing in, and your phone will be a much safer place for your email, financial services, work, education and everyday online accounts.