Most businesses secure their laptops properly and then hand everyone a phone with none of the same attention.
That phone holds company email, probably has a banking app on it, and very likely sits on the same Microsoft 365 account as everything else. If somebody uses their own phone for work, which most people do, then it is part of your setup whether you manage it or not.
Here is how phones actually get compromised.
1. Text messages
Smishing is phishing by text, and it works better than email because a text feels more personal and there is no sender address to inspect. A delivery that needs rescheduling, a bank asking you to confirm a payment, HMRC offering a refund.
The tell is almost always urgency plus a link. Banks and couriers do not need you to act in the next ten minutes.
2. Apps that are not what they claim
Fake apps copy the name, icon and screenshots of something popular, then harvest whatever you type into them. They appear in the official stores too, not just dubious corners of the internet.
Before installing, check the developer name rather than the app name, look at the review count rather than the score, and be suspicious of a brand new app claiming thousands of downloads.
3. Permissions nobody reads
A torch app does not need your contacts. A game does not need your microphone. Permissions are where a legitimate looking app turns into a problem.
Both Android and iOS let you review what each app can reach. It is worth ten minutes once a year, and you will almost certainly turn something off.
4. Public wifi
Open wifi in a hotel, an airport or a coffee shop can be watched by anyone else on it, and a network named after the venue is trivially easy for someone to fake.
Most things are encrypted these days, so this is less dangerous than it used to be. It is still not where you want to log into your bank. If staff work from cafes regularly, that is an argument for using mobile data or a proper VPN.
5. Public USB charging
A charging point in an airport or a train can be wired to do more than charge. It is rare, but the fix is easy: carry a plug and use a socket, or use a cable that only carries power.
6. Nobody installing updates
This is the dull one, and it is the one that matters most. Phone updates are mostly security fixes for holes that are already public knowledge. A phone two versions behind is a phone with known, documented ways in.
Turn on automatic updates. Then check occasionally that they are actually happening, because they often quietly stop.
The short list
If you do nothing else:
- Automatic updates on, for the operating system and for apps
- A proper passcode, not a four digit PIN and not a pattern
- Find My Phone or Find My Device switched on, so a lost phone can be wiped remotely
- Multi-factor on your email, so a stolen phone does not become a stolen account
- Apps only from the official stores, and uninstall anything you have stopped using
The bit most businesses miss
If staff use their own phones for work, a compromised phone is not just their problem. It has your email on it, and possibly your files.
That does not mean banning personal phones. It means being clear about what is expected, and being able to remove company data from a device without wiping somebody’s family photos. Microsoft 365 can do exactly that, and it is usually already included in the licence you are paying for.
Worth a conversation if staff phones are currently outside your setup entirely. It is part of managed IT support and of staff training, or just give us a call.
