Phones, Tablets and Apps

Why the phone matters more than the computer now

Many people do more on a phone than on a computer. Banking, photos, maps, texts with the grandchildren, the pharmacy refill. And the phone gets the codes that protect your other accounts (lesson 3 explains two-step sign-in). A thief who holds your phone with the screen open, or controls your phone number, can often get into more than a thief who steals your laptop.

The FBI's Internet Crime Complaint Center (IC3) says people 60 and older filed 201,266 complaints in 2025, up 37 percent from 2024, with reported losses of about $7.748 billion, up 59 percent (as of October 2026, from the IC3 2025 report). Across all ages the FTC counted about 3 million fraud reports and $15.9 billion in reported losses in 2025 (as of October 2026, from the FTC's March 2026 testimony). Many of those scams reached the victim by phone call or text. The numbers are not meant to scare you. They explain why a few settings are worth ten minutes today.

Step one: a lock that works

A screen lock is the PIN, password, pattern, fingerprint or face scan that keeps a stranger out of your phone. A phone without a lock hands over everything to whoever finds it.

The FTC advises a passcode of at least six digits and automatic locking. Avoid 123456, your birth year, your street number and the last four digits of your phone number. A longer passcode, or a short password of letters and numbers, is stronger still. Face ID, Touch ID and fingerprint sign-in are fine for daily use. They are a convenience on top of the passcode, not a replacement for it.

Protect the phone if someone watches you type your code

One real theft pattern goes like this. A thief watches you enter your passcode in a restaurant or bar, snatches the phone, and uses the passcode to change your account password and lock you out. Apple built a feature for it. Stolen Device Protection, on iPhones with iOS 17.3 or later, adds extra checks when the phone is away from familiar places like home or work. Apple says that away from those places, things like using saved passwords, or turning off Lost Mode require Face ID or Touch ID with no passcode fallback. Big changes, such as changing your Apple Account password, require Face ID or Touch ID, a one-hour wait and another check.

Android makers have their own versions of theft protection, and the names differ by phone. Search Settings for "theft" and read what your phone offers. Whatever the phone, the habit is the same: when you must type a passcode in public, cup your hand over the screen.

Your phone number is a key too

Your phone number is the address where codes, calls and texts arrive. A SIM card is the small chip that ties your phone to that number. Many newer phones use an eSIM instead, which does the same job as software with no plastic card. In a SIM swap, a thief persuades your carrier to move your number onto a SIM or eSIM the thief controls. Once that happens, your calls and texts, including sign-in codes, go to the thief. Port-out fraud is a close cousin: the thief has your number moved to a different carrier.

The FBI counted 971 SIM swap complaints in 2025, with reported losses of about $17.4 million (as of October 2026, from the IC3 report). That is small next to investment fraud, but the damage per victim can be large because the thief can reset passwords that rely on a text code. Signs: your phone suddenly says "No Service" or "SOS only" when others nearby have bars, you get notices about a SIM or number change you did not ask for, or you cannot make calls.

Where available, use something better than text codes

Because text messages can be hijacked by a SIM swap, a sign-in code sent by text is weaker than a code from an authenticator app or a passkey. Lesson 3 explains the choices. For your email, bank and Apple or Google account, switch off text codes when a better option exists.

Apps: only from the official store, and fewer of them

An app is a program on your phone. The official store for iPhone is the App Store, and for most Android phones it is the Google Play Store. Both check apps before they appear, and neither catches everything, but they catch far more than a random website does. Installing from anywhere else is called sideloading. A link in a text, a pop-up that says your phone is "infected," or a website that offers a paid app for free are the usual doors for malware, which is software built to harm your device or steal from you.

On Android, Google says Google Play Protect checks apps from the Play Store before you download them and scans your device for harmful apps from other sources. It is on by default. You can check it yourself.

Check what each app can see

An app permission is a setting that lets an app use part of your phone: camera, microphone, contacts, photos, location. A flashlight app has no need for your contacts. A coupon app does not need your microphone. Most phones let you grant a permission only while you are using the app, or turn it off.

Find My and Find Hub: set them up before you need them

Every year, people lose a phone in a car, a shopping cart or a church pew. A lost-phone service can show it on a map, make it ring, lock it or erase it from afar. These only work if you turned them on beforehand.

On an iPhone the service is Find My. Apple says you can see the phone in the Find My app on another Apple device or at iCloud.com/find, play a sound, and turn on Lost Mode. Lost Mode locks the phone with your passcode or Apple Account password, lets you show a message and phone number on the screen, and suspends Apple Pay cards. If the phone is off, Find My can show its last known location for up to seven days, according to Apple. Erasing is a last resort because it cannot be undone.

On Android the service is Find Hub, which you can reach in the Find Hub app or at android.com/find. Google says that when it is on, you can ring, locate, secure and erase a lost device. It needs a Google Account on the phone and location turned on, and Google recommends keeping backup codes for 2-Step Verification so that you can still sign in from a different device.

What to do in the first hour if the phone is gone

1. Use Find My or Find Hub from a computer or another phone to see where it is. Do not go to a stranger's address alone. Call the police non-emergency line if you think it was stolen.
2. Turn on Lost Mode (iPhone) or use Secure Device (Android). Put a phone number you can answer on the screen.
3. Call your carrier to suspend the line, or ask for the number to be locked. Ask them to watch for a SIM change.
4. Change the password on your Apple Account or Google Account, then your email and bank, from a computer you trust.
5. Tell your bank if you use its app. Lesson 9 gives the full order of steps for a lost or stolen phone.

Backups: so a lost phone is an annoyance, not a disaster

A backup is a second copy of your photos, contacts and settings kept somewhere else. The FTC advises backing up on a regular schedule to the cloud or to a computer so that you do not lose your information if a phone is lost or stolen. iPhones can back up to iCloud, and Android phones to your Google Account. Both can be set to run overnight while the phone charges.

Lesson 11 covers backups for the whole house, including how to test that one works.

Texts, calls and links: the scams that arrive on the phone

The scam usually does not need to break your phone. It only needs you to tap, call or tell it a code. Smishing is phishing sent by text. Typical ones: a delivery notice about a package you never ordered, an unpaid toll, a bank "fraud alert," a message that says "Hi, is this Susan?" from a stranger, or a job offer. Lesson 7 walks through the common scams one by one. Four rules cover most of them:

• Do not tap links in texts you did not expect. The FTC says legitimate companies do not ask for account information by text.
• If a message might be real, look up the company yourself and call the number on your card or statement, or type the website address in your browser.
• Never read a sign-in code to anyone who calls you, even a person who says they are from your bank. A code is a key, and your bank never needs the key you were just sent.
• Do not reply, even with STOP, to a text from an unknown sender. A reply can tell the sender your number is live.

What you see	What is probably happening	What to do
Text: "Your package could not be delivered, confirm your address" with a link	A fake delivery notice built to collect card details or a password	Do not tap. Check your real orders in the store's app. Forward the text to 7726, then delete it
Call or text: "This is your bank's fraud department, read me the code we just sent"	The crook is signing in as you right now and needs the code	Hang up. Call the number on the back of your card
Pop-up on the screen with a phone number to call	Tech-support scam	Close the browser. Never call. Never give remote access
Text from a number you do not know: "Hi Grandma, I got a new number"	A family-emergency scam starting	Call your grandchild at the old number you know. Use your family code word (lesson 7)
Phone suddenly shows "No Service" and you get account-change emails	Possible SIM swap	Use another phone to call your carrier at once and change your bank passwords

You can make the phone itself do some of the work. On an iPhone, look in Settings for Messages (on recent versions it sits under Apps), then Unknown & Spam, then turn on Filter Unknown Senders. It sorts texts from numbers outside your contacts into a separate list. On Android in the Google Messages app, tap your profile picture, then Messages settings, and look for spam protection. You can also ask your carrier about free call and text blocking.

Bluetooth, AirDrop and nearby sharing

Bluetooth is the short-range wireless link to headphones, a car or a watch. Leave it on if you use those, and turn it off in a crowded public place when you are not using anything. Nearby sharing tools, such as AirDrop on iPhone and Quick Share on Android, let strangers within a few feet send you a photo or file. Set them to receive from contacts only, or turn off. Never accept an unexpected file. If a picture or document pops up from someone you do not know, tap Decline.

Messaging apps and video calls

Texting apps such as iMessage, WhatsApp and Signal protect messages with end-to-end encryption between users of the same app, a term defined in lesson 5. Ordinary SMS text messages do not have it. That does not mean you should avoid SMS. It means do not text a Social Security number or a bank password to anyone, on any app. The bigger risk in messaging apps is the stranger who writes first. A friendly "wrong number" message that turns into a chat, a new friend who wants to move to a different app, or a stranger who mentions an investment are all common starts to romance and investment scams, covered in lesson 7.

When you use a messaging or social app, check its privacy settings. Choose who can add you to groups and who can see your profile photo and phone number. Turn on its two-step sign-in too.

Kids, grandkids and shared tablets

If you hand a grandchild your phone or tablet, you hand over what is on it. A few simple habits help:

• Keep your bank, email and shopping apps behind a separate lock or sign out of them before a child plays with the device.
• Turn on purchase approval so a child cannot buy things in a game with your card. On iPhone this is Ask to Buy under Family Sharing. On Android it is the purchase authentication setting in Google Play, and Family Link adds more controls for a child's own account.
• Give the child a separate profile or their own device if you can. Both Apple and Google offer child accounts with limits on time, apps and contacts.
• Talk to them. Tell them never to share a password, code or address with someone they met in a game, and to tell you if a stranger asks for something or scares them.
• Ask the grandchild to show you the settings you cannot find. It is a good use of a visit, and they like it.

Retiring a phone: erase it the right way

A phone holds your photos, texts, saved passwords, bank app and more. Before it leaves your hands, whether you sell it, trade it in, give it to a grandchild or recycle it, erase it. A factory reset erases everything on the phone and returns it to the state it was in when it left the factory.

If a phone is broken and will not turn on, a recycler or the carrier store may not be able to wipe it. Ask them how they handle data. If the phone held banking apps, it is fair to ask the store to destroy the storage, or you can keep it in a drawer. Erase first whenever the phone works.

Questions and answers

Is a four-digit PIN good enough?

The FTC advises at least six digits. A four-digit code has 10,000 possible combinations and a six-digit code has 1,000,000. A longer code also holds up better if someone watches you type it. Change it today; it takes a minute.

Should I use my fingerprint or face to open the phone?

Yes, for most people. It is quick, which means you will keep the lock on. Keep a strong passcode behind it, because the phone asks for the passcode after a restart.

How do I know if a text is real?

Do not judge by the look. Crooks copy logos well. Judge by the request. An unexpected link, a deadline, a payment, a code or a request to call a number is the signal. Go to the company by your own route.

Do I need antivirus on my phone?

Not for the usual phone. The phone's own protections (the app store checks, Play Protect, automatic updates) do most of the work. Spend your effort on updates, a lock, official stores and careful clicking. Lesson 2 covers the computer side.

Should I turn off location services entirely?

No. Maps and Find My need it. Set most apps to "While using" and turn it off for apps that have no reason to know where you are, such as a calculator or a game.

What happens to my number when I get a new phone?

Your carrier moves it for you, either with a new SIM or an eSIM. Have your account PIN handy and turn your number lock off for the change, then on again. Be wary of anyone who calls you offering to "transfer" your phone for you.

Is it safe to charge my phone at the airport or in a car?

Use your own plug and cable when you can. Public USB ports are covered in lesson 10.

Is it all right to let a grandchild set up my phone?

Yes, if you stay beside them and keep the account in your name. Ask them to explain each step, and keep the account password and passcode in your own hands, written down somewhere safe at home.

What is an eSIM and is it safer?

An eSIM is the same as a SIM card but built into the phone as software, so there is no little plastic card to lose or steal. It can be moved to a new phone with the carrier's help. It does not remove the SIM swap risk, because the thief still has to talk the carrier into the change. That is why the carrier lock matters.

Hard questions

Is it safe to bank on my phone?

Generally yes, if the phone is locked, updated, and you use your bank's real app from the official store. The risks are a stolen phone with a weak code, a fake app or a fake text. Turn on the bank's alerts so you hear about every transfer, and see lesson 8.

Is a VPN worth it on my phone?

For most people, no. A VPN routes your internet traffic through another company's computers. It can help on public Wi-Fi. It does nothing against a fake text, and you are trusting the VPN company with your traffic. Free VPN apps are a common source of trouble. Lesson 4 gives the longer answer.

What if I cannot afford a new phone and mine no longer gets updates?

An old phone that no longer gets security updates is riskier, because known holes stay open. Check Settings, then Software Update (iPhone) or System, then System update (Android), to see what is available. If the phone has reached the end of updates, use it for calls and texts, do no banking on it, and ask your carrier about low-cost or trade-in offers. Some libraries and senior centers also run phone help days.

Should I give up on apps and use only a flip phone?

That is a legitimate choice. A basic phone avoids app scams, though it does nothing against calls and texts, and some banks and doctors now need an app for sign-in. Make the choice based on what you do. Many people keep a smartphone for photos and maps and decline everything else.

My phone does not have Find My or my setup is a mess. Where do I get help?

Your carrier's store, an Apple Store, a library or a senior center technology class can help, and many do it free. Bring your account passwords and your ID. Be careful with anyone who calls you offering help, and with search results that show a "support" number. Go to the store in person or use the number on your bill.

Why not just trust the phone company to stop all this?

Carriers block many nuisance calls and texts, and plenty still get through. They also cannot see that a text you tap is a trick. The locks they offer are valuable, and you have to turn them on.