Your phone holds the keys to everything else
Email, banking and sign-in codes all live on your phone. A few settings decide what a thief or a bad app can reach.
Lock it properly
Set a PIN of at least six digits, or a passphrase, and let fingerprint or face unlock sit on top of it. Set the screen to lock after a minute or less. A four-digit PIN can be guessed by someone who watched you enter it once.
Hide message previews on the lock screen, so that sign-in codes cannot be read from a locked phone.
Install less, allow less
Install apps only from the official store, and remove the ones you no longer use. When an app asks for access to your contacts, location, microphone or accessibility features, ask what it needs them for. A torch does not need your contacts.
Prepare for losing it
Turn on the find-my-device feature (Find My on an iPhone, Find Hub on Android), so that you can lock or erase the phone remotely, and check that the phone backs itself up. Ask your mobile operator for a PIN on your account: it makes it harder for someone to move your number to their own SIM card.
Before you sell or give away a phone, sign out of your accounts and use the factory reset.
This note is our own plain-language summary. For the full guidance, read the original: https://www.cisa.gov/secure-our-world
A torch app does not need your contacts.