Here's how Android's new Secure Lock feature will help secure your sensitive data

Most people have a lot of sensitive personal data on their smartphones, making their devices prime targets for theft. If a thief steals your smartphone while it’s unlocked, you can remotely lock it to prevent access to your apps. However, if a thief has shoulder-surfed your lock screen credentials before stealing your phone, remotely locking it won’t prevent them from unlocking it again. Google has been working on features to address this issue, and in this year’s Android 16 update, the company may introduce a new Secure Lock feature that makes it even harder for thieves to access your sensitive data.

If a thief sees you entering your phone’s lock screen PIN, pattern, or password before stealing it, you can’t prevent them from unlocking your phone, even with biometric authentication enabled. Android doesn’t primarily rely on biometrics for unlocking because they’re considered less secure than knowledge-factor-based screen lock methods like PINs, patterns, or passwords. While the risk is small, biometrics can be spoofed, which is why they serve as secondary authentication methods. However, as discussed, this security model fails if someone obtains your primary lock screen credential.

Google partially addressed this issue with a new feature called Identity Check, introduced in the first Android 15 quarterly update. With Identity Check enabled, Android requires biometric authentication before allowing changes to certain sensitive settings when the device is outside a trusted location. This prevents thieves who know your lock screen PIN, pattern, or password from making critical account changes or accessing saved passwords. While this significantly improves protection against online account compromises, it doesn’t fully prevent access to sensitive data on your phone. Sensitive information may still be revealed through app notifications, widgets, or the digital assistant, all of which are accessible to someone who knows your primary lock screen credential.

This is where Android’s upcoming Secure Lock feature comes in. This new feature, currently under development by Google, enables an enhanced security mode that can be activated remotely. In this mode, unlocking the device requires both your primary lock screen credential and your biometrics. Additionally, features such as app notifications, widgets, Quick Settings, and the digital assistant are restricted to prevent sensitive data leaks.

Because Google hasn’t officially shared details about Secure Lock, I investigated its functionality. During this process, I discovered a new permission in Android 16 related to Secure Lock called MANAGE_SECURE_LOCK_DEVICE. This system permission is likely going to be granted to the Google Play Services app, which contains Google’s Find My Device service. I believe that you’ll be able to remotely enable Secure Lock through the Find My Device website. While I haven’t confirmed this yet, it’s a plausible scenario that I’ll continue to look for evidence of.