Phone myths are hard to dispel because they often contain a grain of truth or date back to a time when they were actually true.
However, technology moves on quickly. The danger is that anyone who clings to outdated assumptions will make the wrong decisions – for example, when installing updates or choosing apps.
Here are five of the biggest myths and why they’re wrong.
Myth 1: All third-party app stores contain viruses
Android users usually download their apps from the Google Play Store. However, there are also good reasons to use alternative app stores: for example, because an app is no longer available on Google or is only available in a version that isn’t supported by your mobile device.
Sometimes, Android phone owners are blocked from accessing the Google Play Store for political reasons, making them heavily reliant on APK files from alternative sources. However, third-party stores are often assumed to be full of apps that contain malware.
Hannah Cowton-Barnes / Foundry
However, this is only partly true. Whilst there are undoubtedly dubious sources out there, there are also numerous alternative app stores that place great emphasis on security.
Probably the best-known alternative app store is F-Droid. It offers only free apps available under open-source licences, with installers generated directly from the F-Droid server. All apps are therefore signed by F-Droid, which is intended to guarantee their security.
Aptoide, on the other hand, also features applications that are not open-source, as well as paid apps. Aptoide describes itself as ‘community-oriented’: this means that any user can create and manage their own app store and upload their own apps to it. Aptoide acts as a package manager, which also scans all the apps on offer for viruses.
APK Pure and APKMirror are two great alternatives that we personally rely on at Tech Advisor when our regular benchmarking apps aren’t available, and we’ve never run into any security issues.
Each store has its own app, which you can download as an APK file via the store’s website. To install it, you must grant the app you’re using – i.e. your browser or file manager – the necessary permission to ‘Install unknown apps’ via its settings.
And this is precisely the reason behind the preconception that third-party app stores are riddled with viruses: granting permission to install unknown apps also provides hackers with a way in to your smartphone. You should therefore grant this permission very carefully and, if necessary, revoke it immediately after the desired installation.
Verena Ottmann
Incidentally, so-called ‘sideloading’ – that is, installing APK files outside the Play Store – will no longer be as straightforward in future. Google plans to introduce the ‘Advanced Flow’, a one-off security measure for apps from unverified developers. This requires users to first enable developer options, then confirm that they are not being coerced.
The mobile device then restarts, and the user must log in to prevent unauthorised remote access. After 24 hours, the download becomes possible following re-authentication. This authorisation can be set for seven days or indefinitely.
Myth 2: Wi-Fi and Bluetooth make it easy for hackers
We rarely give much thought to Wi-Fi and Bluetooth on our mobile phones in everyday life. Both functions are almost always enabled, whether at home or on the move. But can hackers actually gain access to your smartphone via Wi-Fi and Bluetooth, as is often claimed?
In principle, having Wi-Fi enabled carries several drawbacks or risks: the so-called MAC (Media Access Control) address, which uniquely identifies your smartphone, is continuously broadcast whilst searching for Wi-Fi networks, which does drain your battery more quickly.
It can also leave your device vulnerable if, for example, a hacker sets up a fake hotspot to which your mobile connects. In this case, it’s best to disable automatic connection in your Wi-Fi settings, and turn it off when you leave home.
Another potential risk is the list of saved Wi-Fi networks, which can reveal your location. Many Wi-Fi networks worldwide are recorded in so-called location databases. This data is used, amongst other things, to locate devices more quickly even without GPS.
Chris Martin / Foundry
If the name of a Wi-Fi network is unique or has been chosen individually, its approximate position can sometimes be geolocated. If attackers gain access to the list of saved Wi-Fi networks, they can cross-reference the names against such databases. If a network name contains clues such as an address, a surname or a town, it is possible to deduce your personal whereabouts (in extreme cases, even your home address). You should therefore regularly clear the list.
Hackers can also exploit an activated Bluetooth function on your smartphone, although they must be in proximity to do so: under ideal conditions, Bluetooth allows a maximum range of up to 240 metres, but in practice this is more like 50 metres. The connection is also usually protected by a PIN. To protect yourself against hackers, you should never accept connection requests from Bluetooth devices you do not recognise. You should also regularly delete old connections.
By the way: Be particularly careful when providing a Wi-Fi or Bluetooth hotspot (tethering). If possible, do not display the network name publicly, and do not forget to switch the hotspot off again when it is no longer needed.
However, if you take these necessary precautions, there’s no reason to be worried about hackers accessing your Wi-Fi and/or Bluetooth connections.
Myth 3: Public Wi-Fi hotspots should always be avoided
As already described in the previous section, a Wi-Fi function that is constantly switched on can provide an opportunity for hackers to attack. This naturally also applies to public Wi-Fi hotspots. Nevertheless, it is not advisable to generally advise against using a public Wi-Fi hotspot.
Sometimes it’s simply necessary to connect to the Wi-Fi on offer – usually free of charge – at a station, an airport, in a café or on a train.
Dominik Tomaszewski / Foundry
However, the key here is to always use a VPN. With a VPN connection, data traffic between your mobile device and the Wi-Fi hotspot is encrypted and routed via dedicated servers, protecting it from hackers.
Recommended VPN services include NordVPN, Surfshark, CyberGhost and ProtonVPN. You can activate your chosen service via the corresponding app or in the Android settings under ‘Network & Security > VPN’.
Myth 4: Older versions of Android are insecure
According to an estimate by Statcounter, in May 2026 just under 54 per cent of all Android mobile devices worldwide were still running Android 14 or an older version – meaning that more than half of all devices are using an operating system that is at least three years old. As a result, these smartphones do not receive important security updates and are vulnerable to cyber-attacks.
For example, Android 15 includes an anti-theft feature that automatically locks the device, as well as a ‘Private Space’ that runs apps and data separately from the rest of the system. Android 16 offers more flexible access rights to images and biometric identity verification, whilst Android 17, amongst other things, restricts apps’ access to contacts. It can therefore definitely be said that an outdated operating system poses a security risk.
Foundry
However, the security of your mobile device depends not only on the Android version, but also on security updates, which, amongst other things, patch security vulnerabilities. And these are not linked to the Android version, but depend on the smartphone manufacturer and the device itself. So make sure you have the latest version of the security updates installed.
You’ll find the menu option in Settings under ‘Privacy & Security > System and Updates > Security Update’ or similar. The entry shows you the date of the last update; tapping on it will install a new version, if available.
However, if no updates – whether Android or security updates – have been available for your mobile device for some time, you should consider buying a new device. Otherwise, you can only use the device securely if you cut off all internet and other connections.
Myth 5: The camera and microphone are spying on you
On every smartphone, the built-in microphone is switched on by default so that the virtual assistant can hear voice commands. Apps also often request access to the smartphone’s microphone or camera. However, both are components that hackers can use to gain access to sensitive information.
It’s only natural to suspect that your own smartphone is spying on you. But Google and other providers have strict privacy measures in place to ensure they’re only listening to the wake word.
If you’d like extra peace of mind, open Quick Settings and tap the pencil icon to open edit mode. In the ‘Privacy’ section, you’ll find the two tiles ‘Camera access’ and ‘Microphone access’, which you can add to Quick Settings by tapping the plus sign. To enable or disable access, tap the relevant tile.
Foundry
The third level of deactivation operates at the sensor level and therefore requires Developer Options to be enabled. If this menu is not yet enabled on your smartphone, go to ‘About phone’ or similar in the Settings and tap the ‘Build number’ entry several times until a message appears stating that you are now a developer. Under ‘System > Developer options > Quick Settings tiles for developers’. Enable the “Sensors off” option to make the corresponding tile available in Quick Settings. Add it as described above and enable it. If an app now attempts to use the camera or microphone, it will receive an error message and will usually close immediately.
If you don’t want to set your smartphone to such restrictive settings, but simply wish to keep an eye on access to the camera and microphone, you have two options: Since Android 12, a coloured LED in the status indicates when an app is accessing the camera, microphone and/or location.
Alternatively, you can go to ‘Privacy & Security > Privacy settings > Permission manager’ (or similar) in the settings to see which apps have access to the camera and microphone, and revoke permissions if necessary. In addition, the ‘Privacy Dashboard’ under ‘Privacy & Security’ shows which apps have accessed the camera and microphone in the last 24 hours.
