Three quarters of Americans have been hit by some form of online scam, according to a 2025 Pew Research Center study. And the problem is getting worse. AI tools have made attacks cheaper to run and harder to spot, from voice deepfakes impersonating family members to malware that adapts as it spreads. So it’s worth asking: is your Android phone actually configured to protect you, or is it just running on its defaults?
As Engadget reported, Android has a fairly serious set of security and privacy features built in. The problem is that many of them are either turned off by default, buried in menus, or quietly working against your interests without you knowing it. Here’s what actually matters and what you should do about it.
Start with software updates. It sounds obvious, but a surprising number of people run outdated Android versions. Go to Settings, tap About Phone, and check your Android version and security patch status. When an update notification appears, don’t dismiss it. If you already did, go to Settings, then System, then Software Updates. For apps, open Google Play, tap your profile picture, go to Settings, then Network Preferences, then Auto-update apps. Keeping everything current closes the vulnerabilities attackers actively target.
Next, lock down your Google account. Two-factor authentication is not optional at this point. Visit your Google Account page, go to Security and sign-in, find the section labeled How you sign in to Google, and enable 2-Step Verification. Your Google account controls your email, contacts, app purchases, and a lot more. Losing access to it is a serious problem.
Android’s Find Hub app also deserves attention. It can locate your device, ring it remotely, or wipe it if stolen. Check that location permissions are on under Settings, then Location, then Use location. Then confirm Find Hub is active under Settings, then Security, then Find Hub.
On the scam detection side, Android now uses Gemini AI to flag suspicious phone calls in real time. The feature is off by default, which is at least honest given how sensitive call audio is. To turn it on, open the Phone app, go to Settings, and find Scam Detection. Google says audio is processed on-device, not sent to a server. That claim is worth holding them to. A similar tool scans text messages from unknown contacts for suspicious patterns. You can disable it under Messages, then Protection and Safety, then Spam Protection.
The privacy settings that matter most are app permissions. Go to Settings, then Apps, select any app, and tap Permissions. Better still, use the Permission Manager under Settings, then Security and Privacy, then Privacy. This view groups permissions by type, so you can see exactly which apps have access to your microphone, location, call logs, or camera. Be honest with yourself here. A flashlight app does not need your location.
Finally, and this part tends to surprise people: your phone usage is being shared with advertising partners by default. Go to Settings, then Google, then All Services, then Privacy and Security, then Ads, then Ads Privacy. There you’ll find Ad Topics, a feature that shares your interests with advertisers in rotating batches of three. You can turn it off entirely or remove specific topics. You can also block apps from sharing ad signals with other apps under App Suggested Ads in the same menu.
None of these steps require technical expertise. But they do require about twenty minutes and a willingness to actually look at what your phone is doing. Given the current state of online threats, that’s a reasonable investment.