The only device nobody set upon purpose

Your email address is the reset mechanism for every other account you own. Someone who controls it controls your bank, your practice-management login and your cloud storage, without needing any of those passwords. It should have a password used nowhere else and the strongest second factor the provider offers.

What it does not cover — It does nothing for accounts that do not use that address, and nothing at all if the second factor is a text message and your phone number is taken from you — which is the next item.

Codes sent by text are the weakest common second factor, because a phone number can be moved to another handset by convincing a carrier's support agent. An authenticator app or a passkey stays on your device. Where a provider only offers SMS, ask your carrier to put a port-out PIN or account lock on the line.

What it does not cover — Carrier protections vary and are enforced by people, so they reduce the risk rather than remove it. Authenticator apps are still lost with the phone unless the backup is set up deliberately.

Biometrics are the convenience layer; the passcode is the actual key, and it is what protects the encrypted contents of the device. Six digits is the sane floor and an alphanumeric passphrase is meaningfully better. A four-digit code on a phone that holds your email is not a lock, it is a gesture.

What it does not cover — It protects a device that is off or locked. It does nothing about a phone handed over unlocked, and nothing about what is already synced to a cloud account.

Both platforms include it and both need an account signed in for it to function. Test it once from a laptop so you know what the screen looks like, because the afternoon you actually need it is not the afternoon to learn the interface.

What it does not cover — A wipe needs the device to reach the network. A phone that is already switched off, or has had its SIM pulled, may never receive the command — which is why the passcode matters more than the wipe does.

The gap between a phone patch being published and being installed is the window that attacks are written for. Automatic updates close it without anyone having to notice. This is the single highest-value setting on the device and it takes one toggle.

What it does not cover — Only while the handset is still supported. A phone past its last security update cannot be made safe by any setting, and that is the point at which it should be replaced rather than configured.

Sideloaded applications and configuration profiles from a link are the most common way a personal phone ends up genuinely compromised. Worth doing once: read the list of apps with access to your location, microphone, contacts and photos, and remove the ones that no longer earn it.

What it does not cover — Store review catches a lot and not everything. A well-reviewed app can still collect more than you would like, which is what the permission list is for.

Passwords saved in a mobile browser sit in a place that malware is specifically written to read, and it takes everything at once — including the accounts used to reset the other accounts. A real encrypted password manager is a different category of thing and syncs across your machines properly.

What it does not cover — A password manager concentrates risk into one vault, so its own password has to be strong, memorised and different from everything else.

Most traffic is encrypted in transit now, so a hostile network learns less than it used to. It still learns which services you connect to and when, and it can interfere with anything not properly encrypted. Cellular data is the simplest answer. A tunnel is the other one — see below.

What it does not cover — Encryption in transit does not protect you from a convincing login page. The network is rarely the thing that catches people out; the page asking for a password is.