Questions readers ask about mobile security

There is no legal requirement to buy security software in Australia, and no honest way to answer this for every reader at once. A current handset that still receives operating system updates, installs apps only from the official store, has a screen lock and is backed up covers a large share of the risk on its own. A paid product earns its place where one of those conditions is missing — most often on an Android device outside its update window — or where the bundled extras, such as a password manager or link filtering, are the actual reason for buying. The choosing guide works through the decision.

Not in the sense the word usually means. iOS keeps apps separated from one another by design, so a third-party app cannot scan the rest of the device the way desktop antivirus scans a computer. What a security subscription can do on an iPhone is work at the browser and network level — blocking known fraudulent addresses, screening some messages and calls — and provide services that operate on data rather than the device, such as password management and breach notifications. Those are real features; they are simply not virus scanning. See the platform comparison.

It depends what you are comparing it with. The protections built into both mobile platforms are free and do the structural work: sandboxing, store review, permission controls, encryption and remote erase. Free tiers from security vendors usually add on-demand scanning on Android and little else, with the continuous components reserved for paid subscriptions. The honest framing is that free covers the baseline well and paid adds convenience features and a second opinion on Android, rather than free being a cut-down version of something essential.

No. A web page cannot inspect the apps or files on your phone, and any page that appears to scan your device and report a problem is running an animation, not a scan. The same applies to pop-ups that claim your device is infected and offer a phone number to call. Close the page. This pattern is common enough that Scamwatch lists variations of it among current approaches.

They solve unrelated problems. Antivirus looks for malicious software on the device. A VPN encrypts the traffic between your device and a server run by the VPN provider, which hides your browsing from whoever operates the local network and from your internet provider. A VPN does not detect malware, does not stop scams, and does not make you anonymous — services you are signed in to still know who you are. Both are frequently sold in the same bundle, which is convenient and also a common source of confusion about what has been purchased.

Partly, at best. Some products screen messages and can flag a link that already appears on a list of known fraudulent addresses. Newly created addresses are not on any list yet, and the largest losses in Australia come from conversations rather than clicks — a call that persuades someone to transfer money or install remote access. The defence for that is procedural: end the contact and call the organisation back on a number you looked up yourself. The scams page covers it in detail.

Cancel wherever the billing lives. If you bought from the vendor directly, cancel in your account on the vendor’s site or by contacting their support in writing. If you bought inside the Apple App Store, cancel in the subscriptions section of your device settings. If you bought through Google Play, cancel in the subscriptions section of the Play Store app. Keep the confirmation, and check the statement covering the original renewal date to confirm nothing was taken. The subscriptions page has the full routes.

No. Removing the app from your phone stops the software running; it does not end the billing arrangement, and the renewal charge will still be made. This is the most common reason people find themselves charged for a product they thought they had abandoned months earlier. Cancellation is a separate action in the vendor account or the app store account that holds the subscription.

Not automatically, and this varies by vendor and by plan. Licences state a number of devices and sometimes the device types they apply to, and a tablet may count differently from a phone or may not be included at all. The feature set available on a tablet can also differ from the phone version. If a tablet is part of the reason you are buying, confirm the licence terms at the point of purchase rather than assuming.

Scam reports go to the National Anti-Scam Centre through Scamwatch, whether or not money was lost. Cybercrime such as hacking or account takeover is reported through ReportCyber at the Australian Cyber Security Centre. Online abuse, cyberbullying of a child and image-based abuse go to the eSafety Commissioner. Mishandling of your personal information by an organisation goes to the Office of the Australian Information Commissioner.

If you entered card or banking details, call your bank immediately on the number from your card or banking app; Australian banks run fraud lines outside business hours. Then change the password on your email account before anything else, because email is the reset path for your other accounts, and turn on multi-factor authentication. Remove anything you were asked to install, restart the device, and change the password anywhere else you used the same one. Then report it.

No. Avalon Base does not run laboratory testing, publishes no scores, and is paid a commission when a reader subscribes to TotalAV through its links. A rating produced under those conditions would be a commercial preference dressed as a measurement. The contribution here is category guidance detailed enough that you can evaluate a vendor’s own documentation, plus a clear statement of what the commercial relationship is. The disclosure page sets it out in full.