Phones and tablets

Six questions about mobile devices, where the honest answer is often different from the answer for a laptop, and where the most useful measures are free.

Do I need a security app on my phone?

For most people, no. The measures that reduce real risk on a phone are built in and cost nothing.

Why the answer differs from a computer. On a desktop operating system, a program you run generally has access to your files, and a scanner can examine other programs. On iOS and Android, each app runs in its own confined space, and apps are distributed through a store that reviews them. On iOS in particular, Apple does not permit an app to scan other apps or the file system, which means an iPhone security app is doing something different from what its name suggests — typically filtering web addresses, blocking message senders, or alerting you if an account's details appear in a published data set.

What to do first, at no cost.

• Turn on automatic operating system updates and install them when prompted.
• Install apps from the official store only, and read what an app asks for before agreeing.
• Set a passcode of six digits or more, and turn on the fingerprint or face unlock your device offers.
• Turn on the find-my-device feature, which also allows a remote erase if the phone is lost.
• Turn on multi-factor authentication for the account tied to the phone, since that account can usually reset a great deal.
• Review app permissions every few months and withdraw anything that no longer makes sense.

When to ask for official help. Both Apple and Google publish security guidance for their own platforms, and those are the accurate references for what a given version does. The eSafety Commissioner at esafety.gov.au publishes practical guidance for personal safety on devices, including for people concerned that someone else has access to their phone.

Where a paid product may or may not help. Paid mobile apps in this category are generally worth considering for specific features — filtering scam calls and messages, or managing a household's devices from one place — rather than for scanning, which on mobile is not what it is on a desktop. If a licence you are already paying for covers a phone, installing it costs nothing extra; buying one solely for a phone deserves a clear answer to the question of what it will actually do.

Why is the answer different for iPhone and Android?

Because the two platforms differ in how software is installed and in what one app may observe about another.

The practical difference. Apple distributes iOS apps through its own store and does not allow an app to scan the device. Android also has an official store with its own review and an on-device protection service, but it additionally permits installation from other sources if a user turns that on. That option is useful to some people and is also the route by which most genuinely harmful Android apps arrive. A device that only ever installs from the official store is in a considerably different position from one that does not.

What to do first, at no cost. On Android, leave installation from unknown sources switched off unless you have a specific reason, and leave the platform's built-in protection service enabled. On both platforms, check the developer name and the number of installs before downloading an app that imitates a well-known one. On both, review which apps have been granted accessibility or device-administrator permissions, since those are powerful and rarely needed.

When to ask for official help. Each platform's own support documentation is the right reference for where these settings live in your version. If a phone was provided by an employer, its configuration is theirs to advise on.

Where a paid product may or may not help. An Android security app can do more than an iOS one, because the platform permits it. Whether that additional capability is worth paying for depends on how the device is used: a phone that installs only from the official store gets less from it than one used to install software from elsewhere.

An app asked for permissions that seem excessive. What should I do?

Decline, and see whether the app still does what you need. Most permissions can be granted later if it turns out something genuinely requires one.

How to judge. Ask what the app is for and whether the permission follows from that. A camera app needs the camera. A torch does not need your contacts. A game does not need your location. Both platforms let you grant location only while an app is in use, and let you give an app access to selected photos rather than the whole library — those middle options are usually the right choice. Permission to display over other apps, and accessibility permissions, are the two that deserve the most scrutiny, because they are powerful by design.

What to do first, at no cost. Open the privacy or permissions section of your settings, which lists permissions by category and shows which apps hold each one. Work through the list and withdraw what you do not recognise. Both platforms also show recent access to the camera, microphone and location, which is a quicker way to find something unexpected than going app by app.

When to ask for official help. If you believe someone else has installed something on your phone to monitor you, the eSafety Commissioner at esafety.gov.au publishes guidance written for that situation, including advice on when changing settings might alert the other person. In an emergency, contact police.

Where a paid product may or may not help. Permissions are managed by the operating system and reviewing them needs nothing extra. Some paid apps present a tidier summary of the same information, which is a convenience.

My battery drains quickly. Is something running that should not be?

Almost always it is battery age or a recent update, not hidden software.

Likely causes. Lithium batteries lose capacity with each charge cycle, and a phone two or three years old will not last as long as it did when new. A major operating system update re-indexes content for a day or two afterwards, which is temporary. Screen brightness, a weak mobile signal that makes the radio work harder, and background refresh for a dozen apps all contribute. A navigation or fitness app left with always-on location is a frequent and easily missed cause.

What to try first, at no cost. Both platforms include a battery screen that lists usage by app over the last day or so — start there rather than guessing. iOS also reports battery health as a percentage of original capacity. Turn off background refresh for apps that do not need it, set location to "while using" where it is currently "always", and reduce screen brightness or use automatic brightness. Give it a couple of days after an update before drawing conclusions.

When to ask for official help. If battery health has fallen substantially, a battery replacement from the manufacturer or an authorised repairer usually restores the device. Within the warranty period, consumer guarantees under the Australian Consumer Law apply as well; the ACCC explains them at accc.gov.au.

Where a paid product may or may not help. Battery drain is not a security question, and a security app cannot change the chemistry. Be sceptical of any app promising to extend battery life; the controls that matter are already in settings.

My phone no longer receives updates. How much does that matter?

It matters more than any app you could install. Once security updates stop, flaws found later are not fixed on that device.

What it means in practice. Manufacturers publish how long a given model will receive updates, and the periods differ considerably between makers and between models from the same maker. When that period ends, the phone keeps working, and for a while nothing appears to change. The risk accumulates quietly, and it falls most heavily on what the phone is used for: banking, email and authentication codes on an unsupported device carry more consequence than music and maps.

What to do first, at no cost. Check the settings screen for the operating system version and whether an update is available; manufacturers publish their support periods on their own sites. If the device is out of support, move banking and authentication to a supported device if you have one in the household. Remove apps you no longer use. Keep the apps you do use updated, since app updates continue after system updates stop.

When to ask for official help. The manufacturer's published support policy is the authoritative source for your model. Telecommunications providers and councils run recycling programs for old handsets, and councils publish local drop-off points.

Where a paid product may or may not help. No security app replaces operating system updates. A product cannot patch a flaw in a system it runs on top of, and treating a subscription as a substitute for a supported device is the wrong trade.

What should I set up on a child's device?

The free parental controls built into the platform, plus a conversation about what to do when something goes wrong. The second part does more than the first.

What is available at no cost. Both Apple and Google provide family controls that let a parent set screen time limits, restrict content by age rating, require approval for downloads and purchases, and switch off in-app purchasing. Consoles and streaming services have their own equivalents. Turning off in-app purchases, or requiring a password for every one, prevents the most common unpleasant surprise.

On games and age ratings. In Australia, computer games are classified by the Australian Classification Board, and classification decisions are published at classification.gov.au — that is the place to check a specific title rather than relying on a storefront's own label. Some games include randomised purchasable items; whether those are suitable for a child is a judgement for a parent, and the classification information is the published starting point for making it.

What to do first, at no cost. Set up the family account properly rather than handing over an adult's account, so controls can be applied. Turn off in-app purchases or require authentication for each one. Set content restrictions to match the child's age. Agree that anything upsetting or confusing gets shown to an adult without the child being in trouble, which is the single measure most likely to be useful.

When to ask for official help. The eSafety Commissioner at esafety.gov.au is the Australian regulator for online safety and publishes material for parents and carers, as well as reporting routes for cyberbullying of a child and for seriously harmful content.

Where a paid product may or may not help. Some paid security packages include parental controls across devices, which can be convenient for a household with several. The platform controls are free and cover the main ground, so a purchase here is about central management rather than about capability that is otherwise unavailable.