Free security app for iPhone? What iOS already does

iPhoneUpdated

You probably don't need to download a security app for your iPhone. The UK's National Cyber Security Centre (NCSC) says you don't need antivirus on a smartphone, provided you only install apps from official stores such as the Apple App Store. The protection that matters is already in iOS, and most of it is a setting to check.

Quick answer

The NCSC says a phone doesn't need antivirus if your apps come from official stores and update automatically. Apple reviews every App Store app, and iOS keeps each app in a sandbox. Turn on automatic updates, Stolen Device Protection and, if you need it, Safety Check. Apple says not to believe pop-ups that warn of viruses on your device.

Does an iPhone need antivirus?

No, according to the NCSC, provided you only install apps from official stores and set your apps and the phone itself to update automatically. Its guidance for organisations says the same: you should not need antivirus products on iOS in its default configuration. The US Cybersecurity and Infrastructure Security Agency (CISA) says iOS runs antivirus and anti-malware software by default.

What protection is built into iOS?

Apple describes several layers that work without you doing anything.

  • App Review. Apple says every app and each app update on the App Store is reviewed for privacy, security and safety. That includes automated scans for known malware and human review of the app description, marketing text and screenshots for accuracy.
  • Removal. In cases involving fraud and malicious activity, Apple says the app is immediately removed from the App Store, and people who downloaded it can be notified.
  • One source of apps. Outside the EU, all apps must be downloaded from the App Store, where they come from identified developers. iOS doesn't let you install unsigned apps from websites.
  • The sandbox. All third-party apps are sandboxed. Apple says this is designed to prevent apps from gathering or modifying information stored by other apps, or from making changes to the device.

How do I keep iOS up to date?

Apple calls keeping your software up to date one of the most important things you can do for your device's security.

  1. Open Settings, then tap General.
  2. Tap Software Update. Your current version of iOS is shown, and whether an update is available.
  3. If one is, tap Download and Install.
  4. Tap Automatic Updates and turn on Automatically Install. Apple says your iPhone then installs updates overnight while it's charging and connected to Wi-Fi.

The NCSC adds that older devices eventually stop receiving updates, and a phone that no longer gets security updates is less secure.

Which built-in settings are worth turning on?

Two settings cover the cases where someone has your phone or your account.

Stolen Device Protection (iOS 17.3 or later) adds checks when your iPhone is away from familiar places such as home or work. Accessing stored passwords and cards then needs Face ID or Touch ID, with no passcode fallback.

  1. Go to Settings, then tap Face ID & Passcode.
  2. Enter your device passcode.
  3. Tap Stolen Device Protection and turn it on. Apple says it may already be on.

It needs two-factor authentication, a passcode, Face ID or Touch ID, Significant Locations and Find My. There's more in how to protect your phone from theft.

Safety Check (iOS 16 or later) lets you review who has access to your information, including your location, review the devices connected to your Apple Account, reset privacy permissions for apps and change your passcode or Apple Account password.

  1. Go to Settings > Privacy & Security > Safety Check. You may need to scroll down.
  2. Choose Manage Sharing & Access to review people and apps one at a time, or Emergency Reset to stop sharing with everyone at once.

How do I spot a fake "virus scan" warning on iPhone?

Don't believe it. Apple says that if a pop-up or alert warns you about security problems or viruses on your device while you're browsing, it's usually a fraudulent advert, designed to trick you into downloading damaging software or handing over personal information or money. Don't call the number or follow the links. Navigate away, or close the whole tab.

Apple also warns that some pop-ups and ads have fake buttons that look like a close button. If you're not sure, close the Safari tab rather than tapping anything on the pop-up.

To set Safari up against them:

  1. Open Settings, tap Apps, then tap Safari.
  2. Turn on Block Pop-ups.
  3. Turn on Fraudulent Website Warning.

Apple describes a related trick: some downloads ask to install a configuration profile, which can then control your device. Apple says a profile downloaded from a website or email has to be installed in the Settings app, and is deleted if it isn't installed within 8 minutes. To check for one you don't recognise, go to Settings > General > VPN & Device Management. If you don't see any profiles, none are installed. If the iPhone belongs to a school or employer, ask them before deleting anything.

What if I already installed a scan app or subscribed?

Deleting an app doesn't cancel its subscription. Apple says to cancel any in-app subscriptions you don't need first.

  1. In Settings, tap your name, then tap Subscriptions.
  2. Tap the subscription, then tap Cancel Subscription.
  3. Then delete the app: touch and hold it, tap Remove App, tap Delete App, then tap Delete.

If you gave a password to anyone along the way, change it. Apple will never ask you to log in to a website or give it your password, passcode or two-factor authentication code, and it will never ask you to turn off a security feature. More on that in security update scam emails.

Where Failshot fits

Your password is the first layer. Failshot is the second: second layer device security, for the moment someone sits down at your device and unlocks it.

Failshot for iPhone and Android is coming soon. Failshot for Mac is out now, and while it's on, it photographs whoever unlocks your Mac, then, with Pro, records a 5-second video.

  • With the Mac's built-in camera, the green light comes on, and Failshot's window tells whoever unlocked the Mac that the unlock was photographed.
  • With Pro, turn on alerts and Failshot emails you about an unlock you don't confirm as yours, a wrong Failshot PIN or answer, or its camera access being switched off while it's on.
  • Switching it off, or quitting it from its menu, takes Touch ID or your Failshot PIN and answer, never your Mac password.

Get Failshot for Mac (macOS 14 or later) from failshot.app. Free to download. It's free to use. Pro adds video, email alerts and the encrypted vault, and you can try Pro free for 7 days. Your card is taken at sign-up and charged on day 8 unless you cancel.

More questions

Is there a free virus scan for iPhone?

Apple doesn't describe one, and the NCSC says a phone doesn't need antivirus if you only install apps from official stores and keep it updated. Apple scans every App Store app for known malware as part of its review, and iOS sandboxes every third-party app.

What should I do if my iPhone says it has a virus?

If it appeared while you were browsing, Apple says don't believe it. Don't call the number or tap the links. Close the Safari tab. Then check Block Pop-ups and Fraudulent Website Warning are on in Settings > Apps > Safari.

Are apps on the App Store safe?

Apple reviews every app and app update, with automated malware scans and human checks, and removes fraudulent or malicious apps. It also says App Store security alone can never be perfect, which is why updates and your own settings still matter.

Will Apple ever ask me to turn off a security feature?

No. Apple says it will never ask you to disable any security feature on your device or account, such as two-factor authentication or Stolen Device Protection. Scammers ask for this to lower your security.

Does deleting an app cancel its subscription?

No. Apple says deleting an app doesn't automatically cancel in-app subscriptions. Cancel it in Settings: tap your name, then Subscriptions, choose the subscription and tap Cancel Subscription.

Sources