identity.org.au

Security

Device security checklist

Practical steps to keep the phone that holds your Identity Wallet safe — most take under a minute.

Last updated 20 July 2026

Your wallet's security is anchored in your phone's secure hardware, but good device habits still matter. Work through this checklist — most items take less than a minute.

Essential

  • Set a screen lock — a PIN of 6+ digits, or fingerprint/face unlock. The wallet relies on your device lock as its first barrier.
  • Keep your operating system updated. Install system updates when offered; they carry security fixes the wallet depends on.
  • Install the wallet only from source you trust. The reference app is open source; there are no official app-store listings, so treat any store listing claiming to be this wallet as suspect.
  • Turn on your platform's find-my-device feature so you can remotely lock or wipe a lost phone.

Strongly recommended

  • Use biometric unlock (fingerprint or face) where your device supports it — it is both more convenient and harder to shoulder-surf than a PIN.
  • Avoid rooted or jailbroken devices. Device integrity attestation will fail on tampered devices, and Trusted-level verification will be unavailable.
  • Review which apps have accessibility or screen-reading permissions — malicious apps abuse these to watch other apps.
  • Keep a record of your recovery information somewhere safe and offline, in case your device is lost.

Things the wallet does for you

The wallet encrypts identity material on-device before anything is transmitted, uses your phone's hardware-backed keystore where available, and proves its own integrity to the network through Play Integrity (Android) or App Attest (iOS). A stolen phone with a locked screen exposes encrypted data only.

No one legitimate will ever ask you to read out codes from your wallet, approve a request you did not initiate, or install a remote-access app. If that happens, stop and read the scams article.