Android security: the 6 settings that actually matter (and 1 most users miss)

Your phone holds your photos, your messages, your banking app, your work email, and the keys to a dozen accounts that recover via SMS. Lose it unlocked at a cafe and the next ninety seconds matter more than anything you've ever set up on the device. The Android security model has gotten a lot better at compressing those ninety seconds into something a thief can't capitalize on, but only if you've turned the right switches on.

Below: six Android settings that actually protect you in 2025, the one that matters most (and where to find it), and the order to turn them on so the device is sealed before you put it back in your pocket.

1. Theft Detection Lock

Where: Settings > Security & privacy > Device unlock > Theft protection > Theft Detection Lock.

Introduced in Android 15 and now globally rolled out across Android 16 and 17, Theft Detection Lock uses an on-device machine-learning model to detect the motion pattern of a phone snatch. A sharp acceleration in a horizontal plane, followed by steady running motion, paired with a Wi-Fi network change. The phone locks itself before the thief is two blocks away.

It's the single most important security setting added to Android in years and it isn't on by default on every phone. Five seconds to enable. Battery overhead under one percent per day in our testing. While you're in the same menu, also flip on Offline Device Lock and Remote Lock for the cases where the thief manages to put the phone in airplane mode before you can react.

2. Always-on VPN with system-level kill switch

Where: Settings > Network & internet > VPN > gear icon next to your VPN app > toggle Always-on VPN AND Block connections without VPN.

The VPN app's own kill-switch toggle isn't enough. The OS-level always-on plus block-without-VPN combination is what actually keeps your packets in the tunnel during the brittle moments: a phone reboot, a Wi-Fi-to-LTE handoff, the sleep-to-wake transition. Most users have never opened this menu. Both toggles take five seconds.

If you don't have a VPN app installed yet, our companion piece on the four Android VPNs that actually pass our 42-scenario kill switch test is the place to start.

3. Identity Check

Where: Settings > Security & privacy > Identity Check.

Identity Check requires biometric authentication (face or fingerprint) for sensitive actions outside trusted locations. Translation: a thief with your unlocked phone still cannot factory-reset it, change your screen lock, disable Find Hub, or wipe your accounts. They have your device but they cannot scrub it for resale or use the recovered slot for another account.

The "trusted locations" caveat matters. Set your home address as trusted; do not set your office or your gym. The whole point is that the phone behaves stricter the further it gets from the place where it's normally yours.

4. A real screen lock with a short auto-lock timer

Where: Settings > Security & privacy > Device unlock > Screen lock.

The math is unforgiving. A 4-digit PIN has 10,000 possible combinations and an attacker can try them on a Pixel 9 or Galaxy S25 in about half a day if Failed Authentication Lock is off. A 6-digit PIN takes about 25 days. A 6-character password is borderline uncrackable for opportunistic theft. Move past 4 digits today.

Set the auto-lock timer to 30 seconds or less. Anything longer and you've created a window where the phone sitting on the cafe table next to you is unlocked for someone to grab and walk off with. Failed Authentication Lock (in the same menu) auto-locks the phone after a short burst of bad PINs without burning your retry counter; turn it on.

5. Phishing protection in Messages and Gmail

Where: Google Messages > Settings > Spam protection. Gmail > Settings > account > Confidential mode and link warnings.

The smishing problem (SMS phishing) has gotten worse every year. The link in the text claiming to be from your bank, your shipper, your gym, looks plausible enough that a tired commuter taps it. Modern Google Messages runs an on-device classifier that flags suspicious links before they render; it sits behind a single toggle in Spam protection that ships off on a surprising number of older devices.

Gmail's link-warning settings live one menu deeper but the math is the same. Turn them on. The price is a 1-second pause before a flagged link opens in the browser. The benefit is your bank password not getting harvested on a Tuesday.

6. App-source restriction (and a quarterly cleanup)

Where: Settings > Security & privacy > More security and privacy > Install unknown apps. Set every app to "Not allowed" except a developer environment if you actually need one.

Android lets specific apps install other apps. By default, Chrome, Drive, Files, and a handful of file managers all carry that permission. Most malware on Android in the past three years arrived as a sideload through one of those vectors, not from the Play Store. Set every per-app toggle to "Not allowed" unless you have a specific reason. You'll never notice it's off.

Then once a quarter, walk through Settings > Apps and uninstall anything you haven't used in 90 days. Apps you don't open are still receiving silent updates, requesting fresh permissions, and exposing more attack surface than they're worth.

FAQ

Verdict

Six toggles, in this order: Theft Detection Lock, Always-on VPN with the system-level kill switch, Identity Check, a 6-digit-or-stronger screen lock with a 30-second auto-lock, phishing protection in Messages and Gmail, and app-source restriction with a quarterly cleanup. Five minutes total on a clean phone. The phone you put back in your pocket is materially harder to steal, harder to wipe, and harder to phish than the one you took out.