Secure phones accounts and communications
CISA’s Mobile Communications Best Practice Guidance version 2, dated 24 November 2025, adds protections for private messaging apps. Do not scan group-invitation links or QR codes from unknown sources; verify an invitation with the group creator or administrator through a separate channel; treat unexpected in-app alerts that request a PIN or one-time code as suspicious; and review linked devices, keeping only those needed and removing unintended devices. End-to-end encryption still does not protect an account or endpoint that has been taken over.
See evidence →Your phone may combine identity, location, email, banking, authentication and recovery. Treat that concentration as a design problem.
Establish a strong baseline
- Use a long, unique device passcode, a short automatic lock period and discreet lock screen notifications. Keep the screen private when entering credentials.
- Update the operating system and apps. Remove unused apps, extensions, remote access tools and unexpected management profiles.
- Protect primary email, cloud accounts and your password manager with phishing resistant FIDO security keys or suitable passkeys where supported. Enrol a secure backup and test recovery before travelling. SMS codes are a weaker fallback. [S09]
- Ask the mobile carrier about account PINs, port out restrictions and procedures for a lost SIM. Keep carrier recovery details available without the phone.
- Use legitimate end to end encrypted communications for sensitive conversations where lawful and available. Verify contact identity independently; encryption does not protect an already compromised endpoint. [S10]
Use the protections your device actually supports
On supported iPhones, enable Stolen Device Protection before loss. Consider the Always setting so the additional controls apply at home too. Understand biometric requirements, recovery and delays before relying on it. [S11]
On supported Android devices, review Theft Protection, Remote Lock and Identity Check. Availability and prerequisites vary. Test the legitimate recovery route and keep it in your private plan. Neither platform's theft controls protect every app or prevent physical coercion. [S12]
Prepare a travel setup
Carry only devices and data needed for the trip. A minimal device is only minimal if you have checked what cloud synchronization, password recovery and installed accounts can restore. Keep a separate, secure way for your support person to reach you.
Prefer your own cellular connection or a trusted network for sensitive work. A VPN does not make a phishing site trustworthy, protect an infected device or override local restrictions. Use your own charger and cable; decline unexpected pairing, configuration profiles, app installations and device access requests.
Test connectivity in advance using the carrier's information, including voice calls, SMS, roaming and lawful app availability. Store maps and essential contacts offline. Two SIMs may share the same underlying network or account, so do not assume they provide independent resilience.
A useful drill: without your main phone, reach your emergency contact, lock the phone and access ordinary travel funds. Do this without changing live custody settings.