Mycal's Phone Armor for iPhone

Tinkering with Time, Tech, and Culture #69

I've been writing networking and security code since 1981, and I build remote-access security for a living. The device I worry about most isn't a server. It's the phone in your pocket.

Your phone is the second factor for everything else: your bank, your email, your work. If someone gets the phone, or gets your number, they get the rest. The good news is that the iPhone already has the defenses. Most of them are just switched off, or left on the convenient setting.

This is the full checklist, with the exact path to each setting. Grab your phone and work down the list. I'm also posting a short video for each one over the next few weeks, under the name Phone Armor.

[Watch the playlist](https://www.youtube.com/playlist?list=PLHJWaxbx6LyI); it grows as each one goes up.

Paths are for iOS 27 (November 2026). Apple moves settings between versions, so if something isn't where I say, search for it in Settings.

Start here: five settings, two minutes

If you only do five, do these:

1.         Control Center off on the Lock Screen, so a thief can't switch on airplane mode. Settings › Face ID & Passcode › Allow Access When Locked

2.         Wired Accessories set to Ask, so a locked phone won't trade data over a cable. Settings › Privacy & Security › Wired Accessories

3.         Stolen Device Protection set to Always. Settings › Face ID & Passcode › Stolen Device Protection

4.         A SIM PIN, or a number lock with your carrier. Settings › Cellular › SIM PIN

5.         Lock Screen previews set to When Unlocked, so your codes don't show on a locked phone. Settings › Notifications › Show Previews

The rest of the list goes deeper, layer by layer.

1. The lock screen

A thief has your locked phone in their hand. Make it useless to them.

Control Center off when locked

The first thing a thief does is swipe down and turn on airplane mode, so your phone drops off Find My before you know it's gone. Take that away.

Settings › Face ID & Passcode › Allow Access When Locked › Control Center: off. You still get Control Center; just look at your phone first.

▶ Watch the short

Turn off the rest of what works while locked

By default, Siri, Wallet, Reply with Message and Home controls all work without unlocking. Nobody should be opening your front door, or replying as you, from a phone they just picked up. On the same screen, turn off anything you don't need from a locked phone.

Hide Lock Screen previews

Someone grabs your phone, starts a password reset on your bank, and the code pops up on the locked screen.

Settings › Notifications › Show Previews › When Unlocked. Notifications still arrive; the words stay hidden until Face ID sees you.

Decide what a cable can do

Forensic boxes and rigged chargers talk to your phone over USB. Since iOS 26, you choose who gets to.

Settings › Privacy & Security › Wired Accessories › Always Ask (or Ask for New Accessories). Charging still works either way.

Use a longer passcode

A six-digit passcode is one million combinations. That sounds like a lot until a machine does the guessing. With Face ID you'll hardly ever type it, so make it long.

Settings › Face ID & Passcode › Change Passcode › Passcode Options › Custom Alphanumeric Code. Ten lowercase letters and numbers is 3,656,158,440,062,976 combinations. Your iPhone also slows down and limits guesses on its own; a long passcode is what's left if someone's tools get around that.

2. When they know your passcode

The common move now is to watch you type your passcode at the bar, then take the phone.

Stolen Device Protection: Always

With your passcode, a thief can change your Apple Account password, turn off Find My and lock you out of your own life. Stolen Device Protection makes those big changes need Face ID, an hour's wait, then Face ID again.

Settings › Face ID & Passcode › Stolen Device Protection: on, with the security delay set to Always, not just away from familiar locations.

3. Your phone number

So many logins still text you a code that your number is a target of its own.

SIM PIN

With a physical SIM, anyone holding your phone can put the card in another phone and start receiving your login codes.

Settings › Cellular › SIM PIN. Your carrier sets the starting PIN, so look it up first: three wrong tries locks the SIM. Then change it to something only you know.

Lock your number at the carrier

In a SIM swap or port-out scam, someone calls your carrier pretending to be you and moves your number to their phone. Every text code and reset link goes to them. The fix isn't on your iPhone; it's in your carrier account.

The names differ by carrier. Verizon has Number Lock and SIM Protection. AT&T has Wireless Account Lock. T-Mobile has SIM Protection plus Port Out Protection, and you want both. Set a port-out PIN too if your carrier offers one, and do it in their app today.

Move off text-message codes

Wherever a site offers a passkey or an authenticator app instead of a text code, switch. Text codes are the weakest second factor you've got.

4. Your Apple Account

Your Apple Account is the master key. Whoever owns it owns every device on it.

Security keys

If someone can talk support into resetting your account, your codes aren't the last line anymore. Security keys are: small FIDO keys you physically hold.

Settings › your name › Sign-In & Security › Security Keys. You need two FIDO Certified keys. Keep one somewhere safe: if you lose every key and every trusted device, you can be locked out for good.

Recovery Contact and Legacy Contact

All this security means one forgotten password can cost you everything. A Recovery Contact is someone you trust who can give you a code to get back in; they never see your data. A Legacy Contact can reach your data if something happens to you.

Settings › your name › Sign-In & Security › Account Recovery, then Legacy Contact on the same screen.

Advanced Data Protection

By default, Apple holds the keys to most of your iCloud data: backups, photos, notes. Advanced Data Protection makes it end-to-end encrypted, so only your devices can read it. Not even Apple.

Settings › your name › iCloud › Advanced Data Protection. It has you set up a recovery contact or recovery key first. It isn't available to new users in the UK, and iCloud Mail, Contacts and Calendars stay under standard protection either way.

Clean up your trusted devices

Every device signed in to your account is trusted, and it can receive your verification codes. That includes the old iPad in the drawer.

Settings › your name, scroll to your devices, tap anything you don't own or don't use, and Remove from Account.

Find My: all three switches

Settings › your name › Find My › Find My iPhone: turn on Find My iPhone, Find My network and Send Last Location.

The Find My network lets nearby Apple devices report where your phone is, even when it's offline. On iPhone 11 and later (not SE or "e" models) it can still be found for about 24 hours after it's switched off. Send Last Location reports in one last time when the battery is about to die.

5. Updates

Automatic updates

Plenty of attacks hit bugs that are already fixed, on phones that never updated.

Settings › General › Software Update › Automatic Updates: turn on both automatic download and automatic install. Then leave the phone charging overnight.

Background Security Improvements

Since iOS 26.1, urgent security fixes can install between full updates.

Settings › Privacy & Security › Background Security Improvements › Automatically Install: on.

6. Everyday exposure

AirDrop: Contacts Only

Set to Everyone, AirDrop lets anyone nearby drop pictures on your screen.

Settings › General › AirDrop › Contacts Only. Need a stranger to send you something? Pick Everyone for 10 Minutes. It switches itself back.

Safari: fingerprinting protection for all browsing

Websites can track you without cookies by fingerprinting your device's quirks: screen, fonts, settings.

Settings › Apps › Safari › Advanced › Advanced Tracking and Fingerprinting Protection › All Browsing. Make sure it isn't set to Private Browsing only.

Messages: unknown senders and Contact Key Verification

Settings › Apps › Messages › Screen Unknown Senders (iOS 26 and later) puts texts from strangers in their own list instead of your inbox.

Settings › your name › Contact Key Verification › Verification in iMessage warns you if someone gets between you and the people you iMessage. Then compare verification codes once, in person, with the people who matter. It needs iOS 17.2 or later on every device signed in to iMessage, plus two-factor authentication and iCloud Keychain.

7. The quarterly check

Put a reminder in your calendar for every three months, and do these three.

Safety Check

Settings › Privacy & Security › Safety Check › Manage Sharing & Access walks you through who sees your location and photos, which apps can see what, and which devices are signed in. Things pile up. If stopping sharing with someone could put you at risk, plan for that first; Apple's [Personal Safety User Guide](https://support.apple.com/guide/personal-safety/welcome) covers it.

Profiles

A configuration profile can route your traffic through someone else's server, trust new certificates and change settings.

Settings › General › VPN & Device Management. On a personal phone where you didn't install anything on purpose, this list should be empty. Remove anything you don't recognize. If it's from work, leave it and ask IT.

Restart

Some of the most advanced spyware lives only in memory, and a restart wipes it. Since iOS 18.1, an iPhone that stays locked for about three days restarts itself into its most locked-down state. Restart yours every week or so anyway: hold the side button and either volume button, then slide to power off.

8. Do you need Lockdown Mode?

Lockdown Mode is Apple's most extreme protection. It blocks most message attachments and link previews, limits complex web features, and blocks FaceTime calls from people you haven't called in the past 30 days. It's built for the very few people who might be personally targeted by mercenary spyware: journalists, activists, executives.

Settings › Privacy & Security › Lockdown Mode. If that's you, turn it on. If not, everything above is what you need.

The whole list

Sources

•           Apple: About Lockdown Mode

•           Apple: About Background Security Improvements

•           Apple: View conversations from unknown senders in Messages

•           Apple: About iMessage Contact Key Verification

•           Apple: Advanced Data Protection in the United Kingdom

•           Techlicious: How to lock your SIM card to prevent SIM swapping

•           Engadget: How to find your iPhone even when it's off

This post is licensed CC BY-SA 4.0.