Labs · Cyber Security
Lab: Phone Security Check-Up for Android and iPhone: Screen Lock, Updates, App Permissions, Find My Device and SIM PIN
Course: Cyber Security · Chapter 44: Mobile Device Security – Android, iPhone, Bluetooth and Wi-Fi
Chapter 44 covers mobile device security; this lab turns it into a 30-minute check-up on your own phone.
Chala mitrano! Our phone holds UPI, banking, email, photos and OTPs. If it is lost or a bad app gets in, everything is at risk. Today we do a 30-minute check-up like a doctor: lock, updates, permissions, Find My, SIM. One setting at a time, and we verify each one. Phone surakshit, paise surakshit!
चला मित्रांनो! आपल्या phone मध्ये UPI, banking, email, photos आणि OTPs असतात. Phone हरवला किंवा वाईट app आत आलं, तर सगळंच धोक्यात. आज आपण doctor सारखा 30 मिनिटांचा check-up करणार: lock, updates, permissions, Find My, SIM. एका वेळी एक setting, आणि प्रत्येक verify करणार. Phone सुरक्षित, पैसे सुरक्षित!
चलो दोस्तों! हमारे phone में UPI, banking, email, photos और OTPs होते हैं। Phone खो जाए या कोई बुरा app अंदर आ जाए, तो सब ख़तरे में। आज हम doctor की तरह 30 मिनट का check-up करेंगे: lock, updates, permissions, Find My, SIM। एक बार में एक setting, और हर एक verify करेंगे। Phone सुरक्षित, पैसे सुरक्षित!
Suppose we are…
Suppose we work in mobile security at Paytm. Most account-takeover complaints start with a lost phone without a screen lock, an app with too many permissions, or a SIM swap. Before advising customers, we check our own phone with the same list. (Menu names differ slightly between Samsung, Xiaomi, OnePlus and Pixel; use Settings → search to jump to any setting.)
Goal of this lab
By the end your phone will have:
- A strong screen lock with biometrics, and the latest OS and security update.
- Reviewed permissions for camera, microphone, location, SMS and accessibility; no unknown-source installs.
- Find My Device / Find My iPhone working (proved from a second device), and a SIM PIN.
What you need (all free)
- Your own phone, charged and on Wi-Fi. A laptop or family member's device for step 8. About 30 minutes.
Safety and ethics
Check only your own phone, or a family member's phone together with them. Never install tracking or "monitoring" apps on someone else's phone without their knowledge; that is illegal stalking.
Steps
- Screen lock. Android: Settings → Security (& privacy) → Screen lock. iPhone: Settings → Face ID & Passcode. Use a 6-digit PIN or longer (not 123456 or a birth date) plus fingerprint/face. Set auto-lock to 1 minute.
-
Updates. Android: Settings → System → Software update (Samsung: Software update → Download and install) and Security → Google Play system update. iPhone: Settings → General → Software Update; turn on Automatic Updates.
What you should see: "Your system is up to date", and on Android a security patch level within the last 2–3 months (Settings → About phone).
-
Risky permissions. Android: Settings → Security & privacy → Privacy → Permission manager. iPhone: Settings → Privacy & Security. Check SMS, Camera, Microphone, Location, Contacts and Files. Remove access from apps that do not need it (for example a torch or game app with SMS or Contacts access).
- Accessibility and device admin (Android). Open Settings → Accessibility → Installed apps/services and Settings → Security → Device admin apps. Only apps you trust and need (for example Find My Device, your company's MDM) should be there. Unknown apps here are a classic sign of banking malware.
-
Unknown sources. Android: Settings → Apps → Special app access → Install unknown apps. Every app (browser, WhatsApp, file manager) should say Not allowed. Check Google Play Protect is on: Play Store → profile → Play Protect → Scan.
What you should see: "No harmful apps found" and every app "Not allowed" to install unknown apps.
-
iPhone extras. Settings → Face ID & Passcode → Stolen Device Protection → On, and check Settings → General → VPN & Device Management for profiles you do not recognise.
- Find My. Android: Settings → Google → Find My Device → On. iPhone: Settings → [your name] → Find My → Find My iPhone → On, with Send Last Location on.
-
Prove Find My works from a laptop: Android at
https://www.google.com/android/find, iPhone athttps://www.icloud.com/find. Sign in with your own account.What you should see: your phone on a map with options Play sound, Secure device / Lost Mode and Erase. Tap Play sound to test, nothing else.
-
SIM PIN. Android: Settings → Security → More security settings → SIM card lock (or search "SIM lock"). iPhone: Settings → Mobile Service → SIM PIN. Turn it on with your SIM's default PIN (often
1234for Jio/Airtel/Vi), then change it to your own. Do not guess: 3 wrong tries lock the SIM and need the PUK from your operator. - Write your phone card: lock ✓, patch level date, apps with risky permissions removed, Find My ✓ tested, SIM PIN ✓.
Ravindra Bagale's Tip
Without a SIM PIN, a thief can put your SIM in another phone and receive your OTPs, even if your phone is locked. And keep your UPI PIN different from your phone PIN. Two different locks for two different doors. Don kulpe, don darwaje!
Ravindra Bagale's Tip – मराठी
SIM PIN नसेल तर चोर तुमचं SIM दुसऱ्या phone मध्ये टाकून तुमचे OTPs घेऊ शकतो, तुमचा phone lock असला तरी. आणि तुमचा UPI PIN phone PIN पेक्षा वेगळा ठेवा. दोन वेगळ्या दारांसाठी दोन वेगळी कुलपं. दोन कुलपं, दोन दरवाजे!
Ravindra Bagale's Tip – हिंदी
SIM PIN न हो तो चोर आपका SIM दूसरे phone में डालकर आपके OTPs ले सकता है, भले आपका phone lock हो। और अपना UPI PIN phone PIN से अलग रखो। दो अलग दरवाज़ों के लिए दो अलग ताले। दो ताले, दो दरवाज़े!
Common mistakes
| Mistake | What happens | Fix |
|---|---|---|
| Using a pattern or 4-digit PIN like 1111 | Easy to guess or watch over your shoulder | 6+ digit PIN plus biometrics |
| Allowing "install unknown apps" for WhatsApp or Chrome | Fake APKs from messages can install | Set every app to Not allowed |
| Ignoring Accessibility permissions | Malware reads the screen and OTPs | Only trusted apps in Accessibility |
| Turning on Find My but never testing it | It may be off for your account or location | Test once from a laptop |
| Guessing the SIM PIN | SIM locks after 3 tries | Use the operator default once, then change it |
Self-check checklist
0 of 5 done
Try-at-home challenge
Do the same check-up on an elderly family member's phone, together with them. Which three settings would you prioritise, and why?
Check your answer
1) Install unknown apps: Not allowed and Play Protect on, because fake "KYC" or "electricity bill" APKs are the most common scam route. 2) Screen lock + SIM PIN, so a lost phone does not hand over OTPs. 3) Find My Device tested and the family card from Lab 34 saved on the phone. Explain each in simple words and let them make the change themselves.
Samjla ka? Lock, update, permissions, Find My, SIM PIN: thirty minutes, big protection. Aata pudhe jaauya: Chapter 45 puts everything together in one capstone.