How to Set Up a New Phone Securely in 20 Minutes

To set up a new phone securely, do five things before you install a single app: set a strong passcode or PIN, turn on biometrics, install every pending update and switch on automatic updates, confirm Find My (iPhone) or Find Hub (Android) is on, and turn on theft protection. Then review app permissions and confirm your backup is running. That takes about 20 minutes, and the order matters, because several protections depend on the passcode and your account.

This checklist covers current iPhones and Android phones as of October 2026. Where a menu differs on your phone, type the feature name into the search bar at the top of Settings.

Key takeaways

• Set a 6-digit or longer passcode first. On iPhone it switches on data protection; on Android a PIN, pattern or password is what encrypts your Google backup.
• Install updates before anything else, then turn on automatic updates so you never fall behind.
• On iPhone, turn on Stolen Device Protection (iOS 17.3 or later). On Android, open Theft protection and turn on Theft Detection Lock, Offline Device Lock and Remote Lock.
• Restoring from a backup is fine for most people, but review what came across: old apps, old permissions and old accounts.
• The phone is only as safe as the Apple Account or Google Account behind it, so check two-factor sign-in on that account too.

What should you do first on a new phone?

Start with the lock screen. Almost every other security feature depends on it. On an iPhone, Apple says setting a passcode also turns on data protection, which encrypts the data on the phone. On Android, Google notes that theft protection features require a screen lock, and that your backups are only encrypted with your screen lock if you use a PIN, pattern or password rather than a swipe.

Next, update. A phone straight out of the box may not have the latest security fixes, depending on how long it sat in a warehouse or on a shelf. The U.S. Cybersecurity and Infrastructure Security Agency (CISA) advises installing critical updates promptly rather than postponing them, and turning on automatic updates so fixes arrive without you having to remember.

Then make the phone findable and harder to abuse if it is stolen. A thief who has watched you type your passcode can do far more damage than one who only has the handset, which is why Apple and Google both built protections that demand your face or fingerprint for sensitive changes when you are away from familiar places.

The 20-minute order

1. Minutes 0 to 3: lock screen. Set a passcode or PIN of at least 6 digits (longer or alphanumeric is better) and add Face ID, Touch ID or a fingerprint.
2. Minutes 3 to 8: updates. Install every pending system update, then turn on automatic updates.
3. Minutes 8 to 11: find and lock remotely. Confirm Find My or Find Hub is on, including offline finding.
4. Minutes 11 to 14: theft protection. Turn on Stolen Device Protection (iPhone) or the Theft protection toggles (Android).
5. Minutes 14 to 17: permissions. Review location, camera, microphone, contacts and photo access for every app that came across.
6. Minutes 17 to 20: backups and accounts. Confirm the backup is on and check that two-factor sign-in is active on your Apple Account or Google Account.

Should you restore from a backup or set up as new?

For most people, restoring is the right call. It brings over your photos, messages and settings, and on iPhone it also brings over Stolen Device Protection: Apple says the setting carries across when you restore from iCloud Backup or transfer directly from your old iPhone, though the new phone may take a while to learn your familiar locations.

Setting up as new makes more sense when the old phone was compromised, behaved strangely, or was shared with someone you no longer trust. A restore can bring back old configuration profiles, forgotten apps and permissions you granted years ago. A middle path: restore, then delete apps you no longer use and re-check permissions.

Two practical notes. Google says you cannot restore an Android backup made on a higher Android version onto a phone running a lower one. And once the new phone is working, wipe the old one properly before you sell or trade it in; on iPhone, Apple advises turning off Stolen Device Protection before you sell or give it away, and the FCC reminds owners to wipe eSIM data when replacing a phone.

How to set up a new iPhone securely

On a model with a Home button, "Face ID & Passcode" is called "Touch ID & Passcode."

iPhone security setup

1. Passcode: Settings > Face ID & Passcode > Change Passcode > Passcode Options. Apple calls Custom Alphanumeric Code and Custom Numeric Code the most secure options.
2. Auto-Lock: Settings > Display & Brightness > Auto-Lock. Pick a short time.
3. Updates: Settings > General > Software Update. Install anything pending, then tap Automatic Updates and turn on Automatically Install, which installs overnight while the phone charges on Wi-Fi.
4. Find My: Settings > [your name] > Find My > Find My iPhone. Turn on Find My iPhone, Find My network (so the phone can be found while offline) and Send Last Location.
5. Stolen Device Protection: Settings > Face ID & Passcode > Stolen Device Protection. It may already be on. For extra protection, choose Always under Require Security Delay.
6. App access: Settings > Privacy & Security. Tap each category, such as Location Services, Photos, Camera and Microphone, and turn off access you do not need.
7. Backup: Settings > [your name] > iCloud > iCloud Backup and make sure Back Up This iPhone is on. Then tap Back Up Now once to confirm it works.

What Stolen Device Protection actually does

Stolen Device Protection is built for the case where a thief has your phone and your passcode. When the iPhone is away from familiar places such as home or work, Apple requires Face ID or Touch ID, with no passcode fallback, to use saved passwords and passkeys, use saved payment methods in Safari, turn off Lost Mode or erase the phone. Bigger changes, such as changing your Apple Account password, changing the passcode or turning the feature off, require a one-hour security delay followed by a second Face ID or Touch ID check.

To turn it on, Apple requires two-factor authentication on your Apple Account, a passcode, Face ID or Touch ID, Significant Locations in Location Services, and Find My. You must enable it before the phone is lost; it cannot be switched on remotely afterward.

How to set up a new Android phone securely

These steps follow Google's Android Help pages as of October 2026. Theft protection features need Android 10 or later and are not offered on Android Go phones, and some need Android 15 or later.

Android security setup

1. Screen lock: Settings > Security > Screen lock. Choose a PIN (Google recommends 6 digits or more), pattern or password, then add fingerprint or face unlock.
2. Updates: Settings > System > Software updates. Google says most system updates and security patches install automatically; on Pixel phones they take effect after a restart, so restart once setup is done.
3. Find Hub: Settings > Security > Find Hub and confirm "Allow device to be located" is on. Then go to Settings > Google > All services > Find Hub > Find your offline devices.
4. Theft protection: Settings > Google > All services > Theft protection (under "Personal & device safety"). Turn on Theft Detection Lock, Offline Device Lock and Failed Authentication Lock.
5. Remote Lock: On the same screen, tap Remote Lock and turn it on. It needs a verified phone number; you can add an optional security question so only you can trigger it from android.com/lock.
6. Identity Check: If your phone lists it under Theft protection, turn it on. Outside trusted places it requires a fingerprint or face check for actions such as viewing saved passwords, changing the screen lock, factory resetting or turning off Find Hub.
7. Permissions: Settings > Security & privacy > Privacy > Permission manager. Review location, camera, microphone and contacts, and prefer "Allow only while using the app" or "Ask every time."
8. Backup: Settings > Google > All services > Backup. Google says a backup can take up to 24 hours to complete, and that a Google Account includes 15 GB of storage at no charge.

Theft Detection Lock uses motion sensors, Wi-Fi and Bluetooth to spot a snatch-and-run and lock the screen, but Google notes it may not trigger while the phone has a stable Wi-Fi or Bluetooth connection, so treat it as a backstop rather than a guarantee. Offline Device Lock covers a thief switching off connectivity so you cannot locate the phone.

iPhone vs Android: where each setting lives

Setting	iPhone (iOS)	Android (Pixel-style menus)
Passcode / PIN	Settings > Face ID & Passcode	Settings > Security > Screen lock
Automatic updates	Settings > General > Software Update > Automatic Updates	Settings > System > Software updates (most install automatically)
Find a lost phone	Settings > [your name] > Find My	Settings > Security > Find Hub
Offline finding	Find My network toggle	Google > All services > Find Hub > Find your offline devices
Theft protection	Face ID & Passcode > Stolen Device Protection	Google > All services > Theft protection
Remote lock	Lost Mode via Find My or iCloud.com	Remote Lock via android.com/lock
App permissions	Settings > Privacy & Security	Security & privacy > Privacy > Permission manager
Backup	[your name] > iCloud > iCloud Backup	Google > All services > Backup

Paths from Apple Support and Google Android Help, checked October 2026. Samsung and other Android brands may place items under different menus; use Settings search.

Lock down the accounts behind the phone

A phone setup is only half the job. Whoever controls your Apple Account or Google Account can locate, lock or erase the phone. Apple says two-factor authentication is now the default for most Apple Accounts, and it is required for Stolen Device Protection. For a Google Account, check that 2-Step Verification is on and that your recovery phone and email are current.

While you are signed in, move your passwords into a password manager and add passkeys wherever your important accounts offer them. Our guide to passwords, 2FA and passkeys walks through that in detail.

Finally, think about your phone number. The FCC warns that scammers can take over a number by porting it to a device they control or by stealing the SIM, then intercept the text codes banks send. Ask your carrier which account PIN or number-lock options it offers, and where an account lets you, use an authenticator app or passkey instead of text-message codes.

From Mike: My daily setup includes multiple phones on a mixed Mac and PC home network. My personal security setup is a password manager, two-factor authentication, passkeys, a hardware encryption key and backups. The home network those phones connect to has its own network security as well.

That is one person's setup, not a requirement. A hardware security key is optional for most people; the phone settings above matter first.

What to do if something goes wrong

• Stolen Device Protection will not turn on. Check the requirements: two-factor authentication on your Apple Account, Find My on, and Significant Locations on (Settings > Privacy & Security > Location Services > System Services > Significant Locations & Routes).
• An Android theft toggle is grayed out. Google says that means the phone does not support that feature. Check for a system update, then check your manufacturer's own security settings.
• An update will not install. Free up storage, connect to Wi-Fi and plug in. Apple notes that a VPN or proxy can block the update servers, so pause it temporarily.
• You get locked out by the security delay. That is the feature working. Go somewhere familiar, such as home, where Apple says the delay may end early.

For more phone settings worth knowing about after setup, see hidden built-in features on your phone, and for a deeper pass on what apps can see, our guide to privacy settings.

When this checklist is not the right move

These settings come with real trade-offs. Stolen Device Protection set to Always means a one-hour wait for some changes even at home, which is frustrating if you need to change your Apple Account password in a hurry. Android's Theft Detection Lock can occasionally lock the screen during normal use; Google says to simply unlock and carry on.

Work phones differ. If your employer manages the device, IT may control updates, backups and permissions, and Google says personal backup is not available on company-owned devices or work-only setups. NIST's mobile security guidance (SP 800-124 Revision 2) is written for organizations managing fleets of phones, so follow your employer's policy rather than this checklist.

People facing targeted threats, such as an abusive partner, may need more. Apple's Safety Check, in Settings > Privacy & Security, helps review who you share access and location with. And a backup only helps if a second copy exists somewhere else; our complete guide to backups explains how to add one.

Frequently asked questions

What should I do first on a new phone?

Set a passcode or PIN of at least 6 digits and add biometrics, then install updates. Most other protections, including theft protection and encrypted backups, depend on a screen lock being in place.

Should I restore from a backup or set up as new?

Restore if your old phone was healthy; it saves time and, on iPhone, carries over Stolen Device Protection. Set up as new if the old phone was compromised or shared. Either way, review apps and permissions afterward.

Which phone settings improve security the most?

A strong passcode, automatic updates, Find My or Find Hub, and theft protection give the biggest gains for the least effort. Two-factor sign-in on the Apple Account or Google Account behind the phone is just as important.

Is Stolen Device Protection on by default?

Apple says it might already be on. Check Settings > Face ID & Passcode > Stolen Device Protection; if it is off, turn it on there. It requires iOS 17.3 or later.

Do Android theft features work on every phone?

No. Google says they need Android 10 or later, some need Android 15 or later, they are not offered on Android Go phones, and support varies by manufacturer. A grayed-out toggle means your phone does not support that feature.

About the author. Mike is a tech enthusiast who has spent 20 years around future-leaning startups and likes to be ahead of the curve. Thank You Robot covers how people use technology day to day and the trends shaping it. We do not use affiliate links or sponsored recommendations.

Sources

• Apple Support: About Stolen Device Protection for iPhone (accessed October 2026)
• Apple Support: Update your iPhone or iPad (accessed October 2026)
• Apple Support: How to turn on Find My (accessed October 2026)
• Apple Support: How to back up your iPhone or iPad with iCloud (accessed October 2026)
• Apple Support: Two-factor authentication for Apple Account (accessed October 2026)
• Apple iPhone User Guide: Set a passcode on iPhone (accessed October 2026)
• Apple iPhone User Guide: Control access to information in apps (accessed October 2026)
• Google Android Help: Protect your personal data against theft (accessed October 2026)
• Google Android Help: Be ready to find a lost Android device (accessed October 2026)
• Google Android Help: Set screen lock on an Android device (accessed October 2026)
• Google Android Help: Check and update your Android version (accessed October 2026)
• Google Android Help: Change app permissions (accessed October 2026)
• Google Android Help: Back up or restore data on your Android device (accessed October 2026)
• CISA: Secure Our World, Update Software (accessed October 2026)
• FCC: Cell phone fraud (accessed October 2026)
• NIST SP 800-124 Rev. 2: Guidelines for Managing the Security of Mobile Devices in the Enterprise (accessed October 2026)

Top image: "Unboxed Motorola Moto G35 5G" by Savantup, CC0 1.0, via Wikimedia Commons (resized). Charts and tables by Thank You Robot.