Half of mobile phones sold in the UK at risk of security issues

Additionally, 53% of devices sold at Carphone Warehouse, 50% at Mobiles.co.uk, 50% at Vodafone, 40% at Three, 38% at Mobile Phones Direct and 33% at EE were at risk.

Popular handsets due to run out of support in the next 12 months include the Motorola G8 Power, available through Mobiles.co.uk and Vodafone; the Oppo Find X2 Lite, available through Mobile Phones Direct, Mobiles.co.uk, EE, O2 and Vodafone; and the Samsung Galaxy S9, available through Vodafone. Note the Galaxy S9 recently lost its Which? Best Buy badge because it is nearing the end of support.

Crucially, said Which?, all the above listed devices were still available, with no indication to buyers that they will soon be at risk. The organisation said a lack of transparency around security patches was a big part of the problem. It also found that 40% of smartphone owners thought that if they bought a phone on contract it would continue to receive updates for the lifetime of the contract, which is not necessarily the case, and 69% said they would be worried if their device did not receive updates, so there is clearly support for change.

Which? said it was unacceptable that some mobile brands were only providing two years of security support, and is now calling for a legally mandated five-year support period. It added that increasing support would not only protect consumers from cyber attacks, but would also have a positive environmental impact, with fewer devices being discarded earlier than they need to be.

Going forward, it will now remove its Best Buy recommendations from all devices with less than a year of support remaining, and is urging manufacturers, retailers and networks to be more upfront about their support policies. In the meantime, consumers can use Which?’s free support calculator to find out whether or not their devices are still being supported or not.

A spokesperson for O2, which fared worst in the rankings, said: “Manufacturers set the security patch lifespan of their devices, covering around three to four years for newer models. O2 customers can choose tariffs up to three years in length with our O2 Refresh plans, customisable between three and 36 months.

“We are proud to have led the industry here, as by splitting airtime and device costs customers have true flexibility over how they pay for their mobile phone. However, customer security is an absolute priority, so should manufacturers advise that one-off security updates are required outside of their set lifespan, we would work closely with them to ensure customers receive the updates needed.”

A Three spokesperson said: “Software updates are managed by device manufacturers and Three customers are provided with the updates for as long as the manufacturers release them.”

A Vodafone spokesperson added: “Vodafone works closely with its suppliers to ensure that the devices it provides to customers are supported with OS [operating system] and security updates. Though there may be some variance to the lifecycle support duration depending on the device and its manufacturer, in practice this support generally extends beyond the timeframe you reference. In general, the length of support has become longer over the years.”

EE, although it engaged with Which? on its findings, declined to take advantage of a right to reply. Note that EE, Three and Vodafone all disputed elements of Which?’s analysis, specifically the inclusion of some of the device models examined. However, Which? maintains that these devices could be out of support before the end of currently available contracts.

Retailer Dixons Carphone – which owns both Carphone Warehouse and Mobiles.co.uk, said it would continue to sell devices further along the product lifecycle to keep options affordable, but that it would welcome the provision of clearer communications around security update policies to keep customers informed.

Mobile Phones Direct said it would continue to work closely with manufacturers to keep consumers informed of the need to adopt software patches throughout the product’s life.

Of the device manufacturers examined, Motorola said that while devices could clearly not be upgraded infinitely, it provides security updates in line with industry standards and is working with Google to keep expanding the number of features that are updatable via the Play Store, meaning that some essential features can be patched and upgraded more easily and for longer.

Samsung directed users to its security update information website, and Oppo declined to engage.