Free security app for Android? Start with Google Play Protect

AndroidUpdated

Before you download a security app for Android, check what's already on the phone. Google Play Protect is on by default and checks your apps for harmful behaviour. The UK's National Cyber Security Centre (NCSC) says you don't need antivirus on a smartphone, provided you only install apps from official stores such as Google Play.

Quick answer

Android includes built-in antivirus, according to the NCSC, and Google Play Protect is on by default. Check it in the Play Store under your profile icon > Play Protect. Keep Android updated, turn on Find Hub and theft protection, and review app permissions. Google lists alerts about a virus or infected device as a sign of unwanted software.

Does an Android phone need antivirus?

The NCSC's answer is no, provided you only install apps from official stores such as Google Play, and set your apps and the phone to update automatically. Its guidance for organisations says Windows, macOS and Android include built-in antivirus by default, and that you should not need antivirus products on Android in its default configuration.

What does Google Play Protect do?

Google says Play Protect checks your apps and device for harmful behaviour. It runs a safety check on apps from the Play Store before you download them, checks your device for potentially harmful apps from other sources and warns you about them. It may switch off or remove a harmful app. It also periodically scans your device.

To check it's on:

  1. Open the Google Play Store app.
  2. At the top right, tap your profile icon.
  3. Tap Play Protect, then Settings.
  4. Turn on Scan apps with Play Protect.

Google recommends you always keep it on. If you install apps from outside Google Play, you can also turn on Improve harmful app detection in the same place, which lets Play Protect automatically send unknown apps to Google.

How do I keep Android up to date?

The NCSC says updates include protection from viruses and other malware, and to apply them as soon as they're available. Google says most system updates and security patches install automatically.

  1. Open your phone's Settings app.
  2. Tap System > Software updates.
  3. Follow the on-screen instructions.

To see your Android version and security update level, go to Settings > About phone > Android version. Google says update schedules vary by device, manufacturer and mobile operator, and older devices can't always run newer Android versions. The NCSC advises avoiding phones that no longer get security updates, if you can.

Which built-in settings are worth turning on?

Find Hub lets you ring, locate, secure and erase a lost phone. Google says to set it up so you're prepared in case you lose the phone.

  1. Open Settings, tap Security > Find Hub.
  2. Check that "Allow device to be located" is on.
  3. Make sure Location is on and you're signed in to your Google Account.

Theft protection (Android 10 and up for some steps) is in Settings > Google > All services > Theft protection. Theft Detection Lock uses your phone's motion sensors, Wi-Fi and Bluetooth to spot someone taking the phone and running, then locks the screen. If the switch is greyed out, your phone doesn't support it. There's more in how to protect your phone from theft.

What might a free security app ask for?

Permissions. Google's list shows what each one allows: Files can access all files on your device, SMS can send and check text messages, Call logs can read and write your call history, and Camera and Microphone can take pictures and record audio. Before you allow one, ask whether the app needs it.

Play Protect sends privacy alerts about apps that can get permissions to access your personal information in breach of Google's developer policy. It may also stop an unverified app being installed if it uses sensitive permissions that Google says scammers commonly target for financial fraud.

To review what you've already allowed:

  1. Open Settings, then tap Security and privacy > Privacy > Permission manager.
  2. Tap a permission type, such as SMS or Files, to see which apps have it.
  3. Tap an app and choose Don't allow for anything it shouldn't have.

For any single app, Settings > Apps > the app > Permissions shows the same, and under "Unused app settings" you can turn on Pause app activity if unused.

How do I spot a fake virus alert on Android?

Google's Chrome help lists alerts about a virus or an infected device among the signs that unwanted software or malware may be installed, along with pop-ups that won't go away and pages that redirect you to ads. It says to beware of warnings about viruses or infected devices, especially if you haven't recently used a virus scanner. If a pop-up about an update or download seems suspicious, don't tap it. Go to the program's official website instead.

If the alerts keep coming, Google's steps are:

  1. Press and hold the power button, then touch and hold Power off and confirm a restart in safe mode.
  2. Remove recently downloaded apps one at a time, restarting normally after each, until the problem stops.
  3. In Chrome, if a site keeps sending notifications, open the site, tap Page info > Permissions > Notifications and turn off Show notifications.
  4. Check Play Protect is on.

What if I already subscribed to a scan app?

Uninstalling an app doesn't cancel its subscription, Google says. Open subscriptions on Google Play on your phone, select the subscription, tap Cancel subscription and follow the instructions. Then uninstall the app. If anything still seems wrong, our guide on how to tell if your Android is hacked covers the next checks.

Where Failshot fits

Your password is the first layer. Failshot is the second: second layer device security, for the moment someone sits down at your device and unlocks it.

Failshot for iPhone and Android is coming soon. Failshot for Mac is out now, and while it's on, it photographs whoever unlocks your Mac, then, with Pro, records a 5-second video.

  • With the Mac's built-in camera, the green light comes on, and Failshot's window tells whoever unlocked the Mac that the unlock was photographed.
  • With Pro, turn on alerts and Failshot emails you about an unlock you don't confirm as yours, a wrong Failshot PIN or answer, or its camera access being switched off while it's on.
  • Switching it off, or quitting it from its menu, takes Touch ID or your Failshot PIN and answer, never your Mac password.

Get Failshot for Mac (macOS 14 or later) from failshot.app. Free to download. It's free to use. Pro adds video, email alerts and the encrypted vault, and you can try Pro free for 7 days. Your card is taken at sign-up and charged on day 8 unless you cancel.

More questions

Is Google Play Protect enough?

The NCSC says Android includes built-in antivirus that meets many organisations' needs, and that a phone doesn't need antivirus if you only install apps from official stores and keep it updated. Play Protect is on by default, and Google recommends keeping it on.

How do I scan my Android phone for viruses?

Play Protect checks apps when you install them and periodically scans your device. If it finds a potentially harmful app, Google says it may notify you, disable the app or remove it automatically.

Can I run two antivirus apps on Android?

The NCSC doesn't recommend more than one antivirus product on any device. It says the security benefit is minimal and the products may conflict with each other, which can cause stability problems.

Is it safe to install apps from outside Google Play?

The NCSC's advice that a phone doesn't need antivirus depends on installing apps only from official stores. Google says Play Protect also checks your device for harmful apps from other sources, and may ask to send unknown apps to Google.

Why does Chrome keep showing virus warnings?

Google lists alerts about a virus or an infected device as a sign of unwanted software or malware. Don't tap them. Remove recently installed apps in safe mode, and turn off notifications from the site in Chrome's Page info.

Sources