Every so often the same question comes round: does a phone need antivirus, the way a computer used to? The adverts for apps that promise to "protect your smartphone" are hard to miss, so the doubt is fair enough. The answer starts with something few people realise, though: your phone, whether it is an iPhone or an Android, already runs a string of security checks every day without telling you. Before you sign up to a monthly subscription, it is worth understanding what it does on its own, and where an extra layer genuinely helps.

What your phone already does to keep you safe

Both iOS and Android are built with security stitched into the system. Every app runs walled off from the others, in a sealed box that stops it reading the data belonging to neighbouring apps or reaching into the system itself. That is the sandbox principle, and it applies on both platforms.

On top of that sits the official-store vetting. Apple reviews apps before they go live; on Android it is Play Protect that combs through them, both before you download and after you install. In 2024 that built-in shield scanned more than 200 billion apps a day and blocked around 2.36 million rule-breaking apps before they even reached the store.

Finally there is you. Permissions such as location, camera and contacts are yours to grant and withdraw whenever you like, and Android automatically strips them from apps you have not opened in a while.

iPhone and Android: two very different models

The gap between the two matters more than it looks. iOS is a very closed system: because apps are kept so strictly apart, an "antivirus" installed on an iPhone cannot inspect the other apps the way it would on a PC. At most it filters dodgy websites or flags scam links in the browser.

Android gives you more freedom, including the option to install apps from outside the store, and that is exactly where most of the real risk lives. On Android, a third-party antivirus adds a useful layer of scanning, above all for anyone who downloads files from beyond the Play Store.

The protections already built in, side by side
Built-in protection iPhone (iOS) Android
App isolation (sandbox) Yes Yes
Official-store vetting Apple review Play Protect
Scanning of already-installed apps Limited Yes, even outside the store
Installing from outside the store Not allowed Allowed, at your risk
Auto-removal of unused permissions Yes Yes
Value of a third-party antivirus Very limited Useful in specific cases

The real danger is not a virus

There is a basic misunderstanding here: on a phone the most concrete threat is not the "virus" that infects a PC, but the con that targets you rather than the system. It is the text pretending to be your bank, the fake delivery message with a link to tap, the cloned login page. Fraud is now the most common crime in England and Wales, making up roughly 41% of all offences, and most of it begins with a message. No antivirus can stop you typing your password into a fake site, because that decision stays with you.

Good to know: a real courier will never ask for your card details by text to "release" a parcel. If in doubt, do not tap the link: open the courier's official app or type the website address in yourself.

This is why alertness matters most, and why an ageing handset deserves a second look: if yours no longer gets updates, our take on the pros and cons of refurbished phones is a sensible place to start.

When antivirus is actually worth it

A third-party security app earns its place in a few specific cases:

  • Phones that no longer receive updates: older models the maker has dropped, where security holes are never patched.
  • Work requirements: when your employer insists on a security app on any device that reaches company email.
  • Installing apps from outside the official store: if you download APK files from the web, an extra layer of scanning lowers the risk.

Outside those situations, on a recent, up-to-date iPhone or Android used only with official-store apps, a subscription adds little to what the phone already does.

The habits that beat any antivirus

What makes the difference in the end is not the app you install but how you look after the phone. A handful of habits outperform any scan:

  • Install system and app updates straight away: they close security holes as soon as they are found, which is the single most important barrier.
  • Turn on two-factor authentication for email and banking: even with a stolen password, the account stays locked.
  • Set a long screen-lock code and keep the find-my-phone feature ready in case it is lost or stolen.
  • Do not install apps from unofficial stores or files sent in chats: that is the main way real malware gets in.
  • Do not tap unexpected links in messages, even when they look like your bank or a courier.
  • Do not sign in over open public Wi-Fi unless you are sure of the network.

If you want to put your first line of defence in order in a few minutes, here is the right order to do it in:

  1. Update the operating system and your apps from settings, then switch on automatic updates.
  2. Switch on two-factor authentication on your important accounts, starting with your main email.
  3. Go through the permissions you have granted and revoke location, microphone and contacts from apps that do not need them.
  4. Set a long screen-lock code and check that find-my-phone is turned on.
  5. Review your passwords and change any that are weak or reused across accounts.

An up-to-date phone, locked, with its accounts protected, is already better defended than the same handset left neglected with a monthly subscription bolted on. Updates do the heavy lifting, so it is worth keeping an eye on the latest phone technology and how to keep yours current.