Do You Need Antivirus on Your Phone? Our Take on Poland's Digital Affairs Minister's Advice

Krzysztof Gawkowski, Poland's Deputy Prime Minister and Minister of Digital Affairs, recently posted on X: "I recommend installing an antivirus program on your phone – it's basic protection in the digital world." The short post spread quickly and set off plenty of debate. Some people agreed, and some in the cybersecurity industry smiled indulgently. So what does this look like from a technical point of view? Do we really need extra software on our smartphones, or is the idea left over from the early Windows XP days?

Architecture: A Sandbox, Not a Free-for-All

How does a traditional antivirus work on a PC? With the knowledge and consent of an informed user, it raises its privileges to system level (root, SYSTEM) or installs its own drivers deep in the operating system kernel. This lets it do two things. First, it scans the computer's entire RAM for anomalies. Second, it checks nearly every file on the disk against known signatures.

An app installed on a phone, whether Android or iOS, can't do either of those things. Modern mobile operating systems rely heavily on sandboxing. Each app runs in its own isolated "sandbox" and can't freely see outside it. It can use only the memory assigned to it. It can read its own files and a small set of "shared" resources, such as photos, and only if the user explicitly grants permission. The operating system treats an antivirus app exactly like a calculator, a notepad or a mobile game. It starts with no special privileges that would let it scan other processes running in the background.

Tightening the Screws: How Android Took Away Freedoms

Early versions of Android gave users and developers a great deal of freedom, to the point of being dangerous. Since then, nearly every new release has taken some of those permissions away.

Apps that ran silently in the background were the first to go. They were the main cause of battery drain, so Google sharply restricted them. Next came tighter and tighter limits on free access to files on the memory card, which also lowers the risk of mobile ransomware stealing data in bulk. Soon apps won't even be able to freely check what else the user has installed on the device. The list of installed apps is an excellent source of data for ad profiling.

The Illusion of Scanning: What Comes in the "Antivirus" Bundle?

If a real system scan isn't possible by design, what do all those apps with a reassuring shield icon actually do? Most "antivirus" programs in the app stores offer a collection of side tools. These typically include backup services, simple VPNs, anti-theft features for locating a stolen device, password locks for specific apps (app lockers) and bulk deletion of temporary files (cache cleaning).

Some of this may be useful, but it has little to do with detecting viruses. Paid bundles also often include features of very doubtful value. Examples include "magic" battery-life extension, which usually just kills important background processes, "Wi-Fi scanning in public buildings" (whatever that means in practice) and "identifying apps that scam you out of money."

The Real Threats Lie Elsewhere

Today's attacks on smartphones rarely involve silently installing sophisticated malware that breaks through operating system security. Social engineering dominates instead. Common examples are phishing, malware sent through links, smishing (SMS scams such as fake parcel delivery surcharges or electricity bills) and criminals pretending to be employees of a particular bank. If you believe that a bank's security hotline is calling you, and you willingly hand over a BLIK code or approve a transfer, no antivirus on your phone will save your money, however expensive it is. The main problem is the human factor.

Who Actually Benefits from an Antivirus Scanner on Their Phone?

Modules that act as APK file scanners seem useful mainly for advanced users who regularly download apps from untrusted third-party websites. This practice, called sideloading, bypasses the official app store. It is increasingly the only situation in which a mobile security app from any vendor can actually scan malicious executable code in an installation file before it is installed. Network traffic filtering modules (Web Protection) can also help. They try to block known phishing domains and sites with a malicious reputation at the DNS or browser level, although browsers have had this feature built in for a long time.

Native Protection: Google Play Protect Is All You Need

We recommend that all other everyday smartphone users rely on the security features already built into most systems. Google Play Protect is a strong example of a mechanism deeply integrated with the Play Store and partly with Google's operating system itself. Google also has real privileges to inspect individual processes, something third-party antivirus vendors can only dream of. The service proactively scans millions of apps published in the cloud. It can also actively remove apps from an unsuspecting user's device once Google has identified them as a security threat to Android.

Bottom Line

The Minister of Digital Affairs probably made his recommendation in good faith, as part of an effort to fight disinformation and the growing number of malicious programs. Measured against expert cybersecurity analysis, however, it falls short. Don't buy an extra all-in-one security suite on impulse. It uses your phone's memory and has very little real power over software running in the background. A better investment costs nothing and works reliably: educate yourself and the people close to you, and use common sense and stay alert as you deal with the many traps in today's digital life.