Dtyjlui

My stock Android 9.0 gives me the option of showing some short text message on the lock screen. I want to add my email address here, so people know how to contact me if they find my phone.

Are there any downsides to this? The address is linked to the Google account that's used on this phone.

I know there are other options for getting my phone back, like find my phone, but I want a method that allows the finder to find me instead of the other way around.

Your email address is generally public knowledge, so disclosing it is often not a big security risk.

But it gets complicated when it's your phone. Because your email address is often used as your username to log into services, and you (should) use your phone as a second factor when logging in, tying those two pieces of data might have unintended consequences. Yes, you (should have already) encrypt your phone and you (should) have a strong password to log into your phone, but there are risks depending on how you implemented everything.

The better option to do what you want is to display a secondary address that you do not use as a username anywhere. This is easy to do and to simply forward all emails from there to your primary address.

If the goal is to allow a sincere finder to contact you but prevent leaking any information:

1. Lock the phone properly (strong password, fingerprint etc.)


2. Encrypt the contents.


3. Hide details for notification from the lock screen.


4. If possible, prevent answering to any phone calls without authentication. That's probably the hardest step to achieve, and anyone who calls you may accidentally reveal your identity, not to mention if a phone call is chosen for a 2FA method.


5. Use a secondary email address that could not be linked to you.

As in Schroeder's excellent answer, the email address is not the most crucial information a phone could leak. The #5 is only truly useful if you have achieved everything in #1-4, as any of #1-4 can make it trivial to find the information hidden in #5.

There is a better solution.. Display instead the phone number of the person you want contacted in case of emergency, labeling it clearly 'ICE' (which means 'in case of emergency' to all emergency workers). Then if you get in an accident and are unconscious your person will be contacted a lot faster. And as a side effect if you lose your phone a friend will get quickly notified too

I would consider that the main risk of placing the email address there is that in case it is lost, it would be a phishing target for unlocking the device.

This is quite common with Apple devices: iPhone is lost/stolen, and thus the owner locks access to the phone, so it's no longer possible to use this device (unless accessing the Apple account of the owner). However, the message shown for those that find it often includes the email address associated to the account. Thus, what attackers do (actually there are people selling this 'service') is to send a phishing email there claiming to come from Apple and stating that the iPhone has been found, that actually leads to a phishing page from which the credentials of such accounts are harvested for freeing the device.

I find that the same approach would equally work with an Android phone. If the email address shown is the Google account linked to the device (as it'd be usual to be), phishing the account credentials would allow unlocking the device.

Using a secondary email address exclusively for that (which should then receive 0 mails, and you may not even look at until you lose your phone), and not linked to the phone, should help.† Although you should be very wary that anything received there should be presumed to be a phishing attempt (note that any notification regarding the lost phone would not be sent there, only a human that had read the message would direct phone-related mails there!).

† Of course, store the name and password for that email safely, as well as of the primary account where the device backups everything.

Including your email there is a pretty risky move. Imagine you lose the phone and a bad guy finds it:

• he sees the email and goes to example.com and tries to log in


• since he doesn't know the password, he chooses to recover the account by sending a token to your (now his) phone


• the text notification on the phone displays the token since it isn't very long (and you have it configured to show that preview)


• now he can change the password of example.com and that account is gone

He can repeat that for other services and cause a lot of damage, so don't include your email. Look at the other answers that provide good advice (in this answer I just wanted to point out how easily things could go wrong).