Essential steps for securing your phone, and what else can be done to foil thieves

As smartphone theft grows, handset owners need to do all they can to secure their devices. Read the steps you can take and find just what else the industry is, and is not, doing.

It could happen to you any time, or maybe it already has: You're on the bus playing Angry Birds or browsing Facebook on your phone, when someone snatches your handset, sliding out the closing doors and slipping away into the crowd. Or, worse, a thief takes your phone from you at gunpoint. However it happens, there's no recourse. Your phone is gone, and while you always can buy another handset, all your personal information now lives in the hands of a criminal, petty or otherwise.

According to the San Francisco Police Department, more than 50 percent of the robberies that occurred in the city in 2012 involved the theft of a smartphone (the robberies are referred to as "Apple Picking"). That's nothing to discount, and remember that the SFPD only tracks data for crimes that were reported. The fate of your phone after it's stolen could be just about anything. A thief may keep it himself, she may sell it to a friend or an unsuspecting buyer on eBay, or it may have been stolen only for the parts. Other phones may even be smuggled out of the country where they can fetch a premium price in developing markets. For more on that market, check out this comprehensive story from Huffington Post.

How to protect your smartphone and its data (pictures)

1-2 of 11

Scroll LeftScroll Right

• 
• 
• 
• 
• 
• 
• 
• 
• 
• 
• 

That's why if you own a smartphone and bravely brandish it on the street or the train, it's essential that you take every step necessary to protect your data from thieves, and to track and manage your smartphone once it's gone. In this feature, I've described the essential security features available for each smartphone operating system and the major US carriers. Also, read Jessica's Dolcourt's smart tips for safe phone use in public. The wireless industry is taking some steps to confront phone theft like the creation of a national phone "blacklist," but that's as far as it's willing to go for now. Some law enforcement agencies, particularly those in San Francisco and New York state, want a "kill switch" that would essentially brick a phone, but carriers and OEMs are balking at that idea. I'll discuss both issues in more detail below.

Before I begin
First, there are a few things that you should know. In the first section, I've divided each operating system into two parts: the basic security features that come on the smartphones for preventing data theft that use an OS, and the more sophisticated app-based services available for tracking and wiping a device. Note also, I purposely did not include any third-party security apps. Though such titles exist, and many will do the job quite well, my intent is to focus on the default solutions that are either already on a handset, or officially endorsed by an OS provider.

Also, keep in mind that no security feature is completely foolproof. A sophisticated thief with the right equipment may be able to bypass any security measure. What's more, there's always the chance that a thief is stealing your phone just for parts, and has no intention of reusing it. In that case, a password isn't going to stop him from just taking it apart.

iOS

Preventing data theft and casual hacking

Lock code
You can use either a four-digit number (a "simple passcode") or a longer "complex passcode" of case-sensitive letters, numbers, spaces, and characters. And if you prefer, you can activate a feature where entering a passcode incorrectly 10 times will wipe the phone. The iPhone 5S has the same passcode features, with an added Touch ID fingerprint scanner.

Lock screen features
This is important. iOS can give you access to some features without entering your lock code. Though sensitive personal information is not accessible, you can use some functions of Siri, such as placing a voice call or sending a text message, as well as reply to a missed call with a canned text message. Though you might find those shortcuts convenient, your handset will be more secure if you turn them off. Go to Settings > General > Passcode Lock.

Similarly, you'll also need to turn off access to the Control Center and the Notification Center from your lock screen. To get there, go to Settings > Control Center, and Settings > Notification Center.

Tracking and wiping your phone

Find My iPhone
This feature enables you to track, manage, and secure your phone once it's missing. To use it, you'll first need an iCloud account, though you do not need to sync any of your data, like e-mail and contacts, to the cloud. After you're set up, then go to the iCloud page of your iPhone's Settings and slide the Find My iPhone toggle to on.

After you sign into your iCloud account, click on the Find My iPhone option.

(Credit: Screenshot by Kent German/CNET)

Once your phone has been stolen, the first step is to sign on to iCloud.com or use the free Find My iPhone app on another iOS device. Once in, you'll be able to find your device on an Apple map, but only if it is connected to a cellular or public Wi-Fi network (both secure and not). If the phone is connected just to a hidden Wi-Fi network (that is, one that does not appear in your handset's list of available networks), you may not be able to track it. Other restrictions also apply, but I'll get to those later.

After locating your phone and clicking on the icon, you can do a number of things. The first is to make the phone make play a sound at full volume for 2 minutes (even if it's in silent mode). As this step is more useful if you just happen to lose your phone in your sofa cushions, I'd advise not using it if you're certain that your handset is stolen. It just won't do a lot of good except annoy a thief. You also can erase your handset completely, but this step is rather premature. Instead, first try activating Lost Mode as soon as you as you can. Not only does it give you more options for controlling your phone, it also adds a stricter level of security.

The online interface for Find My iPhone.

(Credit: Screenshot by Kent German/CNET)

Lost Mode
Lost Mode does a couple of things, the first of which is give you more features for controlling your device. To begin, if you haven't yet secured your device with a passcode (and, really, there's no reason why you shouldn't), you'll be able to select a four-digit simple passcode and lock the screen remotely. At the very least, that will prevent all but the most sophisticated thieves from accessing your personal information. Remember, though, that to make your phone as secure as possible, you should have already deactivated lock screen access to the features I mentioned previously.

The next step is to send a custom message to your handset's lock screen that can't be erased. You can write whatever you want, from your name or phone number, to a plea to contact you, to a more colorful message telling thieves what you really think of them. The latter, however, probably isn't the wisest course of action.

Lost Mode also lets you see a history of your phone's location over the last 24 hours with points displayed as pins on the aforementioned map. Finally, if all hope is gone, you can erase your device completely. Once you erase it, you'll lose the ability to track it further, but your lock code and onscreen message will remain.

Comparing Security features by OS

Feature	iOS	Android	Windows Phone
Mobile app	Yes	Yes	No
Device tracking	Yes	Yes	Yes
Remote wipe	Yes	Yes	Yes
Remote screen lock	Yes	Yes	Yes
Play a sound	Yes	Yes	Yes
Onscreen message	Yes	No	Yes
Prevent new activations	Yes	No	No
Lock code choices	4-digit PIN or password	4- to 17-digit PIN, password, pattern, or face unlock	4- to 16-digit PIN only
Features accessible from lock screen	Siri (including placing a call, or sending a text), Notification and Control centers	Missed calls & text messages	None

Activation Lock
Lost Mode also plays a role in Activation Lock, which is a new feature added in iOS 7. Built after Apple users rightfully complained that Find My iPhone wasn't comprehensive enough, Activation Lock tries to close the loop by preventing a thief from reusing your device after you've accepted that it's gone for good.

Running in the background from the moment you turn on Find My iPhone, Activation Lock pairs your Apple ID and password with the serial number of your handset in Apple's servers. Your ID and password are then required before anyone can turn off Find My iPhone on your handset, attempt to erase any data (that's assuming they aren't stopped by your password), reactivate your phone under a different account, or claim a new phone under your warranty. Activation Lock also remains in place if a thief tries to swap out your SIM card. If you happen to get your phone back and can't remember your password, you can retrieve it by calling Apple support and properly identifying yourself.

The bottom lineNow, the fine print
Don't forget that Find My iPhone only works as long as your device is online through your carrier's cellular network or Wi-Fi. If a thief turns off your phone or manages to activate Airplane Mode, you won't be able to track it. You can send commands to erase the phone, lock it, and add an onscreen message, but those commands won't be carried out until the phone reconnects. There may be a short gap between when a phone comes back online and when your request to erase it comes through, but setting a passcode ahead of time will keep a thief from accessing anything during that period.

Between Find My iPhone and Activation Lock, iOS has the most comprehensive solutions for protecting your phone (iPhones also are the most popular smartphone targets for thieves). As a result, though, you need to spend more time getting everything set up and running. And with so many features accessible from the lock screen at default, there's more responsibility on the user to lock down the phone as tightly as possible.

Android

Preventing data theft and casual hacking

Lock code
You can secure your handset with either a numerical PIN of four to 17 digits, a password of case-sensitive letters, numbers, and characters (but no spaces), or a pattern. If you use the latter, though, remember that a thief may be able to see your unlock pattern by following the finger smudges on your display. That's another reason why it's a good idea to wipe your handset's screen often. Android phones that run Jelly Bean and above also have the face unlock feature. That feature can be a kick, but it's definitely the less secure option. Beyond a lock code, the new HTC One Max has a fingerprint scanner.

Lock screen features
Like with iOS, Android will let you access some features from the lock screen. The list here is smaller -- just your missed calls and a preview of any missed texts -- but you must disable access by going to the Security page of the Settings menu.

Tracking and wiping your phone

Android Device Manager
Similar to Find My iPhone, Android Device Manager lets you control access to your phone if it's stolen. Activate the feature by going to the Google Settings menu and choosing Android Device Manager option. Then, check the boxes for remotely locating, locking, and resetting your phone.

Locate your phone with Android Device Manager

(Credit: Screenshot by Kent German/CNET )

To locate a lost device, you'll first need to sign on to the Android Device Manager site using your Google ID and password. Initially, Google didn't have a corresponding mobile app, but the company added one to Google Play on December 11, 2013. On both the Web site and the app, you'll see a list of all devices connected to your account. Clicking on each device will show you its location on a Google Map. Of course, the device must be connected to a cellular network or a public Wi-Fi or you won't be able to locate it.

Setting up Android's Face Unlock feature

(Credit: Screenshot by Kent German/CNET)

The next set of options includes the ability to lock the your phone with a new lock code, make it ring for 5 minutes at full volume (even if it's set to silent), and erase your handset completely. Though Android Device Manager does not have an official "Lost Mode," you still can take most of the same preventive measures that you can with iOS, except adding a message to your device's home screen (that option isn't available here). Android does not have its own version of Activation Lock, either, but such features are available through third-party apps.

Now, the fine print
Like with iOS, you won't be able to track a device that is powered down or offline. If you send any commands to the phone during that period, though, they also will be carried out when the handset reconnects. You will not be able to track a device after you wipe it, but you will be able to track it if the thief swaps out the SIM card. Also important: you can't wipe microSD cards remotely, only the phone's internal memory. So be careful what you store on a memory card.

The bottom line
Android delivers the essential protection features in an attractive, easy-to-use interface and it runs circles around its rivals with lock code options. Also, the later addition of the mobile app was a welcome change. On the other hand, the ability to add an onscreen message and a service comparable to Apple's Activation Lock would make Android Device Manager even more useful.

Windows Phone

Preventing data theft and casual hacking

Lock code
Though you can lock your phone only with a four to 16-digit PIN, Exchange users can add a separate code to access their e-mail. Windows Phone does not make features accessible from the lock screen.

Tracking and wiping your phone

Find My Phone
As this feature is active from the moment you start using your handset, there's no separate setup process. Yet, you can choose to save your handset's location periodically on Microsoft's servers under the Find My Phone option in the Settings menu. Doing so will make it easier to find your device and track its movements. If your device is stolen, sign in toWindowsPhone.com using your Microsoft ID, select your handset from the drop-down menu at the top right of the page, and choose the "Find My Phone" app. Microsoft does not offer a companion Find My Phone mobile app.

Find My Phone has a plainer interface, but it's just as useful.

(Credit: Screenshot by Kent German/CNET)

As long as your device has a cellular or public Wi-Fi connection, you'll see a Bing Map with your device's approximate location and three options. They include making it ring (even if it's in silent mode), erasing it completely, and locking it with a PIN. If you choose the latter, you also have the option to make the phone ring as it locks and add a message on the screen. Windows Phone does not have anything directly comparable to Apple's Activation Lock.

Now, the fine print
Here again, you won't be able to track a device that that's off or not connected to the network. But, if you send any commands to the phone during that period, they will be carried out when the handset reconnects. Also, if you can't find your device right away, Microsoft's system will keep trying to locate it, which saves you from constantly refreshing the page. And if you wish, Microsoft will send you an e-mail when it pinpoints your device's location. Like with iOS and Android, you won't be able to track a device after you wipe it, but you will be able to track it if the thief swaps out the SIM card.