The Device With Everything on It
The smartphone is the most information-dense personal device most people carry: banking apps, email, social media accounts, health information, location history, personal photographs, work communications, and in many cases the authentication methods (SMS codes, authenticator apps) that protect all other accounts. A compromised smartphone has access to more personal and financial information than any other device the user owns.
Despite this, mobile security is less systematically managed than desktop computer security. The assumption that ‘phones are safer’ is partly true (mobile operating systems have stronger sandboxing and app permission models than desktop systems) and partly a misconception (the threats that affect mobile devices are different from desktop threats, not absent). Understanding what actually threatens smartphones in 2026 — and what doesn’t — produces better mobile security decisions than the desktop security mental model applied to a phone.
The App Permission Threat That Most Users Miss
Every app installed on a phone requests permissions — access to camera, microphone, location, contacts, photos, and other sensitive data. Permissions granted at installation persist until explicitly revoked, and the app that requested location permission for a plausible reason (a weather app, a map app) may be using that permission to track location continuously for advertising targeting purposes far beyond the stated use.
The quarterly app permission audit is the most impactful single mobile security practice: review every app’s permissions in Settings > Privacy & Security (iOS) or Settings > Privacy (Android) and revoke any permissions that aren’t necessary for the app’s core function. The flashlight app with microphone permission, the game with contacts access, the social media app with ‘always on’ location — these are the permissions that accumulate silently and are worth reviewing regularly rather than assuming they remain appropriate over time.
Sideloading and App Store Security
Installing apps from outside the official app store (sideloading on Android; available in the EU for iOS under the Digital Markets Act) bypasses the review process that app stores apply to detect malicious code. The official app stores aren’t perfect security guarantees — malicious apps have passed review — but they provide a meaningful filtering layer. Sideloaded apps from unknown sources have no equivalent filtering.
The sideloading risk profile: apps from reputable sources (developer preview versions from known companies, apps from official developer websites for specific legitimate use cases) carry lower risk than apps from unofficial app distribution sites promising premium features for free. The specific high-risk pattern: APK files for Android promoted as providing ‘unlocked’ or ‘modded’ versions of paid apps — these are a common delivery mechanism for mobile malware.
Phishing on Mobile: The Different Attack Surface
Mobile phishing differs from desktop phishing in format: SMS phishing (smishing), messaging app phishing through WhatsApp, Telegram, and similar platforms, and phishing delivered through social media direct messages reach mobile users through channels where the ‘is this URL safe?’ instinct is less developed than for email.
The specific mobile phishing pattern that’s most effective: a message (SMS, WhatsApp, iMessage) containing a shortened URL or an urgent message about a package delivery, account problem, or prize claim. Short URLs conceal the destination domain, and mobile browsers often show abbreviated URL bars that hide the full domain. Before acting on any unsolicited message containing a link, expand shortened URLs using a URL expander service, verify the actual domain in the browser’s full URL bar before entering any credentials, and remember that legitimate organisations don’t initiate contact through messaging apps asking for account information.
Physical Security: The Lock Screen and What It Doesn’t Protect
The lock screen PIN, password, or biometric is the first line of mobile security defence and the one most commonly defeated by the simplest attack: the person who observes your PIN entry (shoulder surfing) in a public space. Using a six-digit PIN rather than a four-digit one significantly increases the brute-force resistance; using an alphanumeric password rather than a PIN provides more resistance still for the truly security-conscious user.
What the lock screen doesn’t protect: notifications that display sensitive message content on the lock screen without authentication, smart home controls accessible from the lock screen, and Siri or Google Assistant commands accessible without unlocking. Reviewing what’s accessible without unlock in Settings > Face ID/Touch ID & Passcode (iOS) or Settings > Lock Screen (Android) and disabling access to anything that shouldn’t be accessible to someone who found your phone ensures the lock screen provides the level of protection its existence implies.
