Android gives you more control than most people use. Start with the basics: turn on a screen lock — fingerprint or PIN at minimum. Enable Find My Device so you can locate or wipe a lost phone. Keep automatic security updates on when your manufacturer offers them.
Check app permissions regularly. Settings shows which apps can use your camera, microphone, location, and contacts. If a flashlight app wants your contacts, that is a red flag. Android now lets you grant location "only while using" instead of all the time — use that for maps and delivery apps, not for games.
Install apps from trusted sources. Google Play scans apps, but nothing is perfect. Read reviews, check the developer name, and be wary of clones that mimic popular apps. Sideloading APK files from random websites is how many people pick up malware — skip it unless you really know what you are doing.
Use a password manager and two-factor authentication on important accounts — email, banking, social media. Your Google account is the master key for many Android features. Turn on Google's two-step verification and review devices logged into your account once in a while.
Public Wi-Fi at cafes and airports is convenient and risky. For banking or work email, use mobile data or a VPN you trust. Avoid joining networks with vague names like "Free_WiFi" that could be someone's laptop fishing for data.
Back up what matters. Google can back up app data, contacts, and photos. Samsung and other brands add their own backup tools. Before a factory reset or phone upgrade, confirm backups finished. Security is not paranoia — it is reducing the damage when something eventually goes wrong.