Is your mobile phone really secure?

An updated, locked phone can still be the device you use to give a password to a fake website. Its security depends on several protections: those built into the device, those securing your accounts and those you apply when receiving a message or installing an app.

Episode 53 of The BIG podcast raises questions about QR codes, two-step verification, VPNs and differences between devices. It provides a starting point for a practical review: understanding what each protection does and what falls outside its scope.

Your phone lock and your account security

Your passcode and biometrics help prevent someone else from using your phone. Your accounts need their own protection. Someone who obtains your password could try signing in from another device while your phone stays in your pocket.

What happens if it is stolen also matters. Apple offers protection that requires biometric authentication for certain actions and can add a delay before sensitive changes. It must be enabled before the device is lost or stolen. Android offers theft protection features, with availability and requirements that vary by device. Apple: Stolen Device Protection; Google: protecting data against theft.

A message or QR code can lead to a fake website

Imagine receiving a message about an undelivered parcel. Its link opens a page asking you to sign in. Even if your phone is working properly, the information you enter could reach the person behind the scam. This is an illustrative example of impersonation, also known as phishing.

QR codes can conceal the same route. In September 2026, the US Federal Trade Commission (FTC) warned about fraudulent codes placed over legitimate ones on parking meters. It recommends checking the web address before opening it and looking for swapped letters or spelling mistakes. This check helps, but a convincing address can also be fraudulent. FTC: warning about QR codes in car parks.

If a request is unexpected, open the service's app yourself or use contact details you already know. Avoid checking the message through the same link or number it supplied. FTC: checking suspicious messages.

Two-step verification remains useful

Enabling it makes access harder when someone obtains your password. Codes also need care: Google warns that scammers can use them to take over an account and recommends not sharing them. Sign-in requests you did not initiate should be rejected. Google: two-step verification and precautions.

Where the service supports it, consider a passkey. Google explains that it offers stronger protection against phishing and allows you to sign in by unlocking your device. Create one only on devices you own and control. Google: signing in with passkeys.

Keep the additional verification available while reviewing stronger options. Do not share codes with people claiming to help you or approve sign-ins you did not initiate.

A VPN protects part of the connection

A VPN can encrypt traffic between your phone and another network endpoint, such as the provider’s server. Its protection depends on its configuration and which traffic passes through that connection.

The Canadian Centre for Cyber Security explains, in guidance updated on 5 February 2025, that a VPN does not protect against opening malicious links or downloading harmful content. It also recommends keeping the VPN updated. Using one does not replace checking a website’s address or taking care with the information you provide. Canadian Centre for Cyber Security: how VPNs work and their risks.

What you can check today

Start with these checks, without installing additional apps:

• Updates. On iPhone, go to Settings → General → Software Update. On Android, check your version and security update date; menu paths and schedules depend on the manufacturer. Check for app updates too. Apple: updating iPhone; Google: updating Android; Google: updating apps.
• Apps and permissions. Review the apps you have installed and the information they need. On supported Android versions, the Privacy dashboard lets you review access and manage permissions. On iPhone, go to Settings → Privacy & Security and review access categories. Remove permissions you do not need. Google: Privacy dashboard; Apple: app permissions.
• Accounts and recovery. Use different passwords, enable the additional protection available and check that your recovery details are current. Review devices with access and connected apps. Google: account security checks.
• Theft protection. Check which features your model supports and whether they are enabled. Read their requirements before relying on them: some need prior configuration or an internet connection.

If you have already shared a password

Access the service through its official app or web address and change your password. Change it on any other accounts where you reused it. If you supplied bank or card details, contact your bank immediately through an official channel. If you installed software at the message's request, seek help to check the device. UK National Cyber Security Centre: responding to phishing.

For more content, visit Mis Redes.