You know that sinking feeling when you realize your phone is missing.
That happened to a friend of mine. For a deeper dive, see The Art of Invisibility. She panicked. Her life revolved around her phone. She posted pictures to Instagram, texted friends all day, and made videos for TikTok. More importantly, her phone stored personal photos she never intended to be public, and she used apps for her bank account, credit cards, utilities, and everything else. For more, see practical home computer security.
Worst of all, she got tired of entering a PIN and never set up biometrics. Her phone was wide open to anyone.
Someone drained her bank account and credit cards, dropped her personal photos on explicit websites, and deleted her social media accounts. Just like that, her life changed for the worse.
What She Did Wrong
They’re less inconvenient than having your bank account drained and your private photos posted online.Share on X
She didn’t practice basic phone and internet security. For more, see qr codes for authors 2025. She didn’t protect her phone with a PIN or biometrics. For more, see AI writing prompts that actually work (and why yours don’t). Her apps used simple passwords. She set her phone as the source for two-factor authentication when she used it at all. Every online account had easy-to-guess passwords. She didn’t back up her phone data or her social media accounts. The list goes on.
Why This Matters for Writers
Writers store more sensitive material on their phones than most people realize. Notes, outlines, drafts, client communications, interview recordings, manuscript files, contract details. For ghostwriters, the stakes are higher because you’re holding client information and unpublished work that isn’t yours to lose.
I spent over twenty years in IT operations, including managing security compliance for a major retailer. The security principles that protect corporate networks are the same ones that protect your phone. Most people don’t follow them because they seem inconvenient. They’re less inconvenient than having your bank account drained and your private photos posted online.
The Basics That Most People Skip
Lock your phone. Use a PIN, passcode, or biometric lock. Fingerprint and facial recognition take less than a second. There is no excuse for leaving your phone unlocked. This is the single easiest security measure that prevents the most damage.
Use strong, unique passwords for every app. Every app on your phone that stores data or connects to an account needs its own password. Not your dog’s name. Not your birthday. Not the same password you use for everything else. Use a password vault like Sticky Password or 1Password to manage them. You remember one master password and the vault handles the rest.
Turn on two-factor authentication everywhere. Platforms like Gmail, Facebook, WordPress, and most banking apps offer two-factor authentication. It means that even if someone cracks your password, they still need a second verification to get in. Use an authenticator app rather than SMS for the second factor – SMS can be intercepted through SIM swapping.
Update everything. Operating system updates and app updates include security patches for newly discovered vulnerabilities. Delaying updates because they’re annoying is like leaving your front door unlocked because locking it takes two seconds. Update your phone. Update your apps. Do it when prompted.
Back up your data. Use cloud services like Google Drive, Dropbox, or iCloud for regular backups. If your phone is lost, stolen, or destroyed, your drafts, manuscripts, notes, and client files should exist somewhere other than on that device. Backup is not optional for anyone who stores work on their phone.
The Threats Most Writers Don’t Think About
Phishing. Emails and texts that look legitimate but are designed to steal your credentials. They’ll pose as your bank, your email provider, or a client. The message creates urgency – “your account has been compromised, click here immediately.” Don’t click. Go directly to the website or app instead. If the alert is real, you’ll see it there.
Public Wi-Fi. Coffee shop Wi-Fi, hotel Wi-Fi, airport Wi-Fi – all of it is insecure. Anyone on the same network can potentially intercept your data. If you work in public spaces, use a VPN. It encrypts your connection so that even on an open network, your data stays private.
Juice jacking. Public USB charging stations at airports and hotels can be used to inject malware or steal data from your phone. The charging cable is also a data cable. Use your own charger plugged into a wall outlet, or carry a portable power bank. For more on scams, passwords, and staying safe online, hear Richard on Aging Info Radio. If you must use a public USB port, a USB data blocker prevents data transfer while allowing the charge.
Bluetooth. Turn it off when you’re not using it. Bluetooth connections can be exploited to access your phone without your knowledge. If you’re not actively connected to headphones or a speaker, there’s no reason to leave it on.
Phone Security Checklist
Print this out or screenshot it. Go through it today and fix anything that isn’t done.
Set your phone to unlock with a PIN, passcode, or biometrics. Lock your screen when not in use. Keep your operating system and all apps updated. Install security updates immediately. Back up your data to cloud storage or external devices. Enable Find My Phone or the equivalent so you can locate or remotely wipe a lost device. Download apps only from official app stores. Don’t fall for phishing attempts in texts or emails. Log out of banking and payment sites after use. Don’t leave your phone unattended in public. Install a call screening app like Robokiller to reduce spam calls. Don’t charge your phone using public USB ports. Enable two-factor authentication on every account that supports it. Turn off Bluetooth when not in use. Don’t jailbreak or root your device. Use a VPN on public Wi-Fi. Use a password vault like Sticky Password or 1Password for all your credentials.
For Ghostwriters Specifically
Ghostwriters carry client information that goes beyond their own work. Interview recordings, manuscript drafts, emails with confidential details, non-disclosure agreements – all of it lives on your phone or is accessible through it. A security breach doesn’t just affect you. It affects your client, your professional reputation, and potentially your legal liability.
Treat client data with the same seriousness a lawyer treats privileged communications. Encrypt sensitive files. Use secure messaging for confidential discussions. And make sure your phone security is tight enough that if your device disappears, you can wipe it remotely before anyone gets through your lock screen.
The Guides That Get Your Book Written, Published, and Sold
Four short, practical guides on writing, publishing, and selling your book, plus the occasional note when there's something worth your time. No fluff, no daily inbox clutter. Drop your email and they're yours.
We use MailerLite to manage our list and send these emails. Your address is used only to send you what you signed up for. We will not sell it, share it, or use it for anything else, and you can unsubscribe anytime.
Frequently Asked Questions
Cybersecurity Ghostwriting
I spent 33 years in enterprise security before writing about it. If your security expertise belongs in a book, I ghostwrite it with the field time to get it right. Explore Cybersecurity Ghostwriting.
Hi Richard,
Do you have any thought on the use of Authentication apps in place of 2FA?
I tend to prefer authentication apps. I don’t like depending on a phone. Auth apps can be installed in multiple places and can be backed up so it’s not such a disaster when a phone is lost.
Interesting, and very helpful. I’m a writer but I prefer the computer over my phone for storing information. But I can see how the phone would be vulnerable to attack.
Such important reminders, Richard! Especially these days!
Thanks for the tips!