Loading page
Hardcase is a private demonstration page, not a security product or device manufacturer, and is not affiliated with any company named on it.
Device security
Your phone is a key to your email
Almost nothing that goes wrong with a device starts with malware. It starts with the device being in someone else's hand, and the account it is signed into being the reset route for everything you own. Five switches already on the device close most of that, and none of them cost anything.
The panel below describes settings that exist on both major mobile platforms. The exact wording differs by version, so they are named for what they do.
Five switches, not a product
What is already on the device
Ranked by how much each one actually does. The first two are most of the answer, and the fifth is the one almost everyone has left in the wrong position.
None of the five is a purchase. If a page about device security tries to sell you something before it tells you where the settings are, that is the tell.
A six-digit passcode, not four
usually onEncryption on a modern phone is keyed to the passcode. A four-digit code is ten thousand guesses; six is a million. This single change is the difference between storage that is encrypted in theory and storage that is encrypted in practice.
Settings → Face ID / biometrics & passcode → change passcode → options
Automatic updates
usually onNearly every real attack uses a flaw that was already patched. The gap between a fix shipping and a device taking it is where the damage happens, and leaving updates automatic removes the decision from the moment you are busy.
Settings → General → Software update → automatic updates
Find my device, with remote erase
usually onLocating it matters less than locking it. The useful part is marking the device lost, which locks it to your account and makes it worthless to resell. Confirm it is on now — you cannot turn it on after the device is gone.
Settings → your name → Find My → enable and allow offline finding
Screen lock after 30 seconds
often too longEvery other setting here assumes the screen is locked. A five-minute timeout means a device left on a table is an unlocked device for five minutes, which is longer than anything on this page takes.
Settings → Display & brightness → auto-lock
Lock-screen previews and shortcuts, off
usually wrongThis is the one people leave. A locked phone showing message previews is showing the one-time codes sent to it. The same screen often allows the control centre and replies without unlocking — all of it should be switched off there.
Settings → Notifications → show previews → when unlocked
One notification
The settings list, for a phone and a laptop
The five switches below with where to find each one, plus the three that matter on a laptop and the one people always leave until it is too late.
The gap between fear and risk
What actually happens to devices
Worth knowing which threats are real for an ordinary person, because the money and attention usually go to the wrong one.
Most common
It is simply taken
Theft and loss dwarf every other route. The value to the taker is not the hardware, which is locked to your account, but the ninety seconds before you realise — which is why the lock timeout matters more than any app.
Most damaging
The account, not the device
A signed-in browser or mail app is a door to everything that uses email for password resets. Someone who has the device does not need to break it; they need it to stay unlocked.
Overrated
Phone viruses
App-store review and sandboxing make traditional malware rare on a phone that only installs from the store. Antivirus subscriptions for phones sell a threat that mostly does not reach you.
Underrated
The device you sold
A phone or laptop passed on without a full erase and a sign-out carries accounts with it. Factory reset from within settings, and check the device has been removed from your account afterwards.
Order matters more than speed
If the device is gone, in this order
The instinct is to look for it. The first two steps below are worth more than an hour of searching, and both take under a minute.
Mark it lost from another device
This locks the device to your account, displays a message, and disables payment cards on it. Do it before reporting anything else — it is the only step that stops working once someone wipes the device.
Change the email password
The inbox is the reset route for every other account you hold. Change it from a device you trust, then sign out of all sessions, which ends any session already open on the missing device.
Remove the device from your accounts
Banking and payment apps, the password manager, and anything holding a second factor. Each has a sessions or devices list, and removing the entry ends its access whether or not the device is ever unlocked.
Ask the carrier to suspend the number
A number is a second factor for a great many services, and it can be moved to another SIM. Suspending it removes the route while you sort out the rest.
Then report the theft
Report to the police for insurance and to the carrier for the hardware. This is last on purpose — it protects the device, and the four steps above protect what the device could reach.
Straight answers
Questions people actually ask
- Do I need antivirus on my phone?
- Almost certainly not, if you install only from the official store. The platform already sandboxes apps and reviews them. The money is better spent on a password manager, which addresses something that genuinely does happen.
- Is a fingerprint or face safer than a passcode?
- More convenient, and safe enough for daily use — but the passcode is the real key, because it unlocks encryption and can be used to change settings. Biometrics are a shortcut to it, which is why the passcode length still matters.
- Is public Wi-Fi dangerous?
- Far less than it was. Nearly all traffic is encrypted in transit now, so the classic coffee-shop interception is largely a solved problem. Treat it as ordinary, and keep the caution for what you install and what you sign into.
- Should I still update an old device?
- Yes, and check whether it still receives updates at all. A phone past its support window stops getting fixes for flaws that are public, which is a slow and quiet way to become the easiest target available.
- What about my laptop?
- The same shape: full-disk encryption on, automatic updates on, a real login password, and a short screen-lock timeout. The browser signed into everything is the laptop's equivalent of the lock screen problem.
- Is “erase after ten failed attempts” worth turning on?
- For most people, no. Backups fail more often than thieves guess passcodes, and a six-digit code already makes guessing hopeless. Turn it on only if you back up reliably and carry something genuinely sensitive.
Go straight to the source
Official references, none of them selling a product
- CISA — Secure Our WorldFederal baseline guidance on updates, passwords and second factors.
- NIST — digital identity guidelinesThe standard behind modern password and authentication advice.
- FTC — lost or stolen devicesConsumer guidance on what to do first when a device is gone.
- IdentityTheft.govIf accounts were reached through the device rather than only the device lost.
- FIDO Alliance — passkeysHow device-bound sign-in works, from the body that defines the standard.
- FCC — device theft and your numberOn protecting the phone number that so many services treat as proof.
One email, then we leave you alone
Check the five before you need them
Where each switch lives, the three that matter on a laptop, and the lock-screen setting almost everyone has in the wrong position.
One notification
The settings list, for a phone and a laptop
The five switches below with where to find each one, plus the three that matter on a laptop and the one people always leave until it is too late.