How to Lock Down the Google Account on Your Android Phone
On most Android phones, the Google account is the master key: it controls Google Play installs, email, photos, backups and the ability to find the phone. If someone gets into it, they get a lot more than one app. A handful of checks, most of which take a few minutes, make a takeover much harder and make recovery easier if something does go wrong.
- Turn on 2-Step Verification, and prefer a passkey or security key where you can.
- Keep recovery email and phone details current so you can get back in.
- Run Google's Security Checkup to review devices, third-party access and saved passwords.
- Family-shared phones need extra care: each person should use their own account.
Why the account matters so much
Signing in on a phone ties it to your account. That account can approve installs, restore your data to a new phone, and reset passwords for other services through your email. A weak password reused elsewhere, or a phishing page that captures your login, can hand an attacker all of it. See our guide to scam texts for how those pages reach people.
A checklist worth doing
| Step | Why |
|---|---|
| Use a strong, unique password | A password reused on another site is only as safe as that site. |
| Turn on 2-Step Verification | A password alone is not enough to sign in.[2] |
| Add a passkey | A passkey lets you sign in with your screen lock instead of a typed password and resists phishing pages.[3] |
| Update recovery options | An up-to-date recovery email and phone help you regain access. |
| Run a Security Checkup | Review signed-in devices, apps with account access and saved passwords.[1] |
| Lock the screen | A PIN, pattern or biometric stops casual access to the unlocked account. |
What a Security Checkup shows
Google's Security Checkup lists devices signed in to your account, third-party apps and services you have given access, and recent security activity.[1] Remove devices you no longer use and any app with access you do not recognise. Signing out of an old phone you have sold or lost is a good habit.
Beware of sign-in pages and approvals
- Do not enter your Google password on a page you reached from a text, an email or a QR code. Go to the app or site yourself.
- Never share a verification code, even with someone who says they are from support.
- If you get a sign-in prompt you did not trigger, deny it and change your password.
- Be careful with "Sign in with Google" on unfamiliar apps; check what they ask for first.
For families and shared phones
Each person should have their own account on a shared device, so one person's mistake does not expose another's. For younger children, a supervised account is managed by a parent through Google Family Link.[4] Keep your own account's recovery details secret from children if a password is shared between you, and revisit sign-ins when a child changes phones.
Common mistakes to avoid
- Reusing one password. A breach on a small site can open your Google account.
- Relying on SMS codes alone. Where possible, use a prompt, passkey or security key instead.
- Ignoring a sign-in alert. If you did not do it, treat it as real.
- Leaving old phones signed in. Remove devices you no longer use.
- Using a shared family account. Give each person their own.
Frequently asked questions
What is 2-Step Verification?
It adds a second check, such as a prompt on your phone or a security key, so a stolen password is not enough to sign in.
What is a passkey?
A passkey is a sign-in method that uses your device's screen lock instead of a password. It is designed to resist phishing pages.
How do I see which devices use my Google account?
Open your Google Account's security page or run the Security Checkup, where signed-in devices are listed and can be removed.
What should I do if my Google account is hacked?
Follow Google's account recovery steps, change the password from a trusted device, review recent activity and update recovery details.
Is it safe to use one account on two phones?
Yes, many people do. Keep both phones locked and updated, and remove any you no longer use from the account.
- Google Account Security Checkup — review devices, third-party access and security activity.
- Turn on 2-Step Verification — Google Account Help — how 2-Step Verification works.
- Sign in with a passkey instead of a password — Google Account Help — what passkeys are and how to use them.
- Get started with Family Link — Google For Families Help — supervised accounts for children.