Using antivirus software on every device you own made sense in the early days of personal computing, but modern smartphones are built to be more secure. Both Apple and Google include extensive protections that make phones much harder targets for traditional malware than older PCs were.

Today's biggest smartphone threat often isn't malware at all. It's phishing texts, fake websites and account takeover scams. That's why there are more effective ways to improve your security than buying antivirus software for your mobile device.

Your phone is already doing a lot of the work

Both iPhones and Android devices are designed to keep apps separated from one another. An app can usually access only the information and features you've specifically allowed it to use. If a malicious app does slip through, it's generally much harder for it to poke around the rest of your device than it would have been on an older computer.

Apple takes an especially restrictive approach. Apps must come through the App Store (though they're expanding that in certain regions) where they go through a review process before they're published. Apple also tightly controls what apps can do once they're installed. For some people, the stance may feel too controlling, but from a security standpoint, the approach has its advantages.

That same approach also limits what antivirus apps can do on iPhones. Unlike antivirus software on a Windows PC, mobile security apps generally can't scan the operating system itself because Apple restricts that level of access. There isn't much point in running an antivirus program that can't even scan your device.

Android gives its users more freedom, which comes with a little more risk. It's possible to install apps from outside the Google Play Store, which is known as sideloading. That's also where many Android malware infections begin. But Android includes several built-in safeguards including Google Play Protect, app permission controls and regular security updates that patch newly discovered vulnerabilities.

As an aside, Google Play Store periodically hides apps that no longer meet current security standards, which adds yet another layer of protection.

None of this means phones are impossible to compromise. Security researchers discover new flaws all the time, and bad actors are constantly looking for ways to exploit them. But compared with the computers many of us used a decade or so ago, today's smartphones are much tougher targets. Instead, many cybercriminals focus their efforts elsewhere.

Your accounts are a bigger target than your phone

Being tricked into giving away access to an account is arguably a bigger cybersecurity risk than getting malware on your phone. Phishing texts, fake package delivery notices, scam calls and fraudulent login pages have become some of the most common ways criminals target smartphone users.

The formula is usually simple. A message creates a sense of urgency and asks you to click a link, sign in to an account or verify a payment. The website often looks legitimate enough that many people don't realize anything is wrong until their credentials have already been stolen.

This type of attack is known as social engineering and has become increasingly common because it's usually easier than finding a technical vulnerability. Modern smartphones have strong built-in security protections, but those protections generally can't stop someone from voluntarily entering a password into a fake website.

That's why many security experts advocate for phishing awareness, strong passwords and two-factor authentication as they do for protection against malware. For the general population, protecting their accounts is more important than worrying about whether their phone has a virus.

Here's what I recommend instead of getting an antivirus for your phone

If you're looking for the biggest security payoff, skip the hunt for the perfect antivirus app and focus on the things that actually prevent most compromises.

• Keep your phones and apps updated
• Download apps only from the App Store or Google Play
• Review app permissions and disable access you don't need (most apps don't need your location data, for example)
• Use strong, unique passwords for important accounts
• Store passwords in a password manager (Bitwarden won CNET's best overall password manager. I also recommend 1Password)
• Enable two-factor authentication (preferably not by text) or passkeys when available
• Be cautious with unexpected texts, links and attachments

None of these steps are particularly exciting, but they're the measures that consistently make the biggest difference.

When a mobile security app actually makes sense

Most people can stop reading here and go about their day. If you keep your phone updated, download apps from official stores and exercise a little caution online, you're probably in good shape.

However, there are exceptions. If you're the type who regularly sideloads Android apps, downloads files from unfamiliar websites or likes experimenting with software that didn't come through Google Play, a mobile security app may provide some additional peace of mind.

The more you wander outside the guardrails built into modern smartphones, the more useful extra security tools become.