The lock screen's job is triage: show enough that you can decide whether to pick up the phone. The privacy problem is that "you" is not enforced. Anything rendered before authentication is rendered for every pair of eyes in range, on the train, in the meeting, at the bar, in the repair shop. Most of what leaks is mundane. Some of it is a medical appointment reminder, a bank balance alert, a message from a dating app, or a name your coworkers were not supposed to see. And one category, the login code, is an active credential sitting in plain view.
The 2FA code problem
Text-message login codes are the clearest case because they are designed to be short-lived proof of possession. A code readable on a locked screen collapses that proof: possession of the phone becomes possession of the code, no passcode needed. Someone who briefly holds your locked phone, a pickpocket, a "can I borrow your charger" acquaintance, a coworker at your desk, can trigger a password reset on an account that uses SMS recovery and read the confirmation code right off the notification banner.
SMS two-factor authentication assumes the code reaches only you. Lock screen previews break that assumption for anyone physically near your phone, before any of the network-level problems like SIM swapping even come up. An authenticator app moves the code behind the unlock; hiding previews moves every code behind it. Either step closes this particular hole.
The theft playbook that forced the fixes
For years the assumption was that a locked phone was a brick to a thief. Reporting by The Wall Street Journal in early 2023 documented the crews that broke that assumption without breaking any cryptography: watch a target type their passcode in a bar, then take the phone. With passcode in hand, the thief changed the victim's Apple ID password, disabled Find My, and used the still-logged-in mail and banking apps, with lock screen notifications helpfully surfacing every verification code the takeover generated. Victims were locked out of their own accounts while the accounts drained.
Both platforms shipped countermeasures with the same design idea: stop treating knowledge of the passcode as full ownership. Apple's Stolen Device Protection, released with iOS 17.3 in January 2024, requires Face ID or Touch ID, with no passcode fallback, for sensitive actions like reading stored passwords or changing the Apple ID password when the phone is away from familiar locations, and adds a one-hour delay before the most damaging changes take effect. Android 15 added Theft Detection Lock, which uses motion signatures of a snatch to lock the screen instantly, alongside remote and offline lock options. These features target the aftermath of theft; the lock screen settings below target the hours your phone spends unattended around people who will never steal it.
The other audience: apps that read notifications
Human shoulder-surfers are one audience. On Android, there is a second one: any app granted notification access receives a copy of every notification the system posts, message previews and login codes included. The permission exists for legitimate mirrors, a smartwatch companion, a car interface, but it is also a favorite of stalkerware and of the banking malware families that harvest codes at scale. Recent Android releases have started redacting one-time codes from notifications handed to untrusted apps, but the grant list itself deserves an audit: Settings, then Notifications, then the entry for app notification access. Every app on that list can read everything. If you did not knowingly put it there, remove it.
Smartwatches deserve a mention in the same breath, because a paired watch is a second lock screen you configured once and forgot. If wrist detection is off, a watch on a nightstand mirrors your messages and codes to whoever picks it up, with no unlock at all.
There is also a third audience further upstream: the push infrastructure itself, through which governments have requested notification records from Apple and Google. That is a different threat with different fixes, covered in our push notification surveillance post; everything below is about the people and apps within arm's reach of your phone.
Settings worth changing today
The defaults lean toward showing content. Both platforms let you keep the triage function, seeing that something arrived and from which app, while hiding the content until the phone authenticates you.
- iOS: Settings > Notifications > Show Previews > When Unlocked. On Face ID iPhones this is the default behavior: previews stay hidden until the phone recognizes the owner looking at it, then expand. If you have ever set it to Always, this is the one to walk back. The same menu exists per-app, so you can hide previews for Messages and email while leaving news headlines visible.
- iOS, second layer: Settings > Face ID & Passcode, then review what is allowed "when locked": Control Center, Reply with Message, Wallet, USB accessories. Each toggle is a capability someone holding your locked phone has. Siri on the lock screen is worth disabling in the same list; it will otherwise announce contact details on request.
- Android: Settings > Notifications > Notifications on lock screen, and choose to hide silent notifications or hide content entirely; the "sensitive notification content" toggle controls whether previews appear when locked. Exact menu names vary by manufacturer, but every recent Android has this control. Work profile notifications carry a separate setting.
- Both platforms: shorten the auto-lock timeout. A phone that locks after 30 seconds leaks 30 seconds of arrivals; one set to five minutes is effectively unlocked for anyone nearby most of the time it sits on a table.
- Move your codes. An authenticator app keeps login codes behind the unlock and out of the notification stream entirely, and removes the SMS channel that account takeover playbooks lean on.
None of this costs real convenience. The notification still arrives, the screen still wakes, and you still know someone wants you; the content just waits for your face or your fingerprint. The phone already knows how to tell you apart from everyone else who might be holding it. These settings just tell it to bother.