Phones, Tablets and Mobile Devices

Verizon's 2026 Data Breach Investigations Report page names mobile devices as a favored target, reports a 40% higher click rate, and says fake texts and scam calls are often more likely to succeed than phishing email. People trust a buzz in the pocket more than a message in a crowded inbox. That is one reason phones deserve their own lesson.

Company phones or personal phones?

Every small business ends up with a mix. The mistake is to leave it undecided. Pick a model on purpose.

The last row is where most small offices live. Do not stay there. The middle two are realistic for a business of 5 to 50 people.

A one-page phone policy

Put these items in writing and have each person who uses a phone for work sign it:

• Which phones may reach work email and files, and through which apps.
• A screen lock of at least a six-digit passcode, plus fingerprint or face if the owner likes. No swipe-only or four-digit codes on work phones.
• Automatic updates on, and the phone must be on a supported version of its operating system.
• No jailbroken or rooted phones.
• Install apps from the official store only.
• Report a lost or stolen phone the same day, to a named person, by calling.
• What the business can do: remove company data from the phone, and on a company-owned phone erase it. What the business cannot do: read personal texts or photos on a personal phone.
• What happens at the end of employment (below).
• A stipend, if you offer one, and what it covers.

That last bullet about what you cannot see matters. If staff fear their employer will look through their personal photos, they will not report a lost phone, or they will refuse to enroll. A policy that is honest about the limits gets better cooperation.

The basic settings

1. Screen lock. A six-digit or longer passcode, or an alphanumeric one, plus biometrics for convenience. Set the phone to lock itself after a short idle time, such as one or two minutes.
2. Updates. Turn on automatic operating system and app updates. When the maker stops sending updates for a model, replace it. An unsupported phone is like an unsupported router.
3. Encryption. Recent iPhones and Android phones encrypt their storage when a screen lock is set. Open the security settings and confirm it says so, because a phone with no lock may leave the data readable.
4. Find and erase. Turn on the built-in find-my-phone feature that came with the device, tied to an account the owner controls. Test that it can show the phone and send an erase command.
5. Sign-in. Use the business password manager (lesson 02) and an authenticator app, not texts, for two-step sign-in where possible.
6. Backups. Photos of work documents and notes can accumulate. Decide whether work data may be backed up to a personal cloud account. For managed apps, Microsoft's recommended app protection policy blocks backing up organization data to iTunes and iCloud.

App permissions

Apps ask for access to the camera, microphone, contacts, location and files. A flashlight app has no need of your contacts. Walk through the permission list once a quarter: remove apps nobody uses, and for the rest, answer "while using the app" instead of "always" for location. A short list of approved work apps beats a free-for-all. Install only from the official store. Installing apps from random links is called sideloading and it is a common way malware gets onto a phone.

Mobile device management in plain words

Mobile device management (MDM) is software that lets a business set rules on phones and tablets and send commands to them, such as "require a passcode," "block this app" and "erase this device." Mobile application management (MAM) is the lighter version: it protects the company data inside certain apps, for example by requiring a PIN to open Outlook, and lets the business remove just that data. Full MDM is for company-owned phones. MAM is a good fit for personal phones.

Big MDM products sound like enterprise tools. Yet two of the cheapest ways to get started may already be on your invoice. Check which email plan you have.

Plan names, features and prices change, so confirm with the vendor's current documentation and your own admin console before you rely on a feature. What you pay for the plan is yours to look up. The point is that basic phone controls are often included in what you buy, and nobody has switched them on.

Microsoft's own advice says it recommends MDM for company-owned devices and that MAM can protect company data on personal devices without managing the whole phone. In MAM, if a phone is lost, the company can remotely remove organization data from managed apps. That is the best fit for the BYOD row in the table above.

What small offices can do without a tool

If your plan has nothing, you can still set rules and check by hand. Each phone is looked at once a year: lock set, updates on, find-my-phone on, a work password manager installed, no stray work files. It is laborious past about ten phones. At that point a tool earns its place, and your outside IT provider can enroll devices for a monthly per-device charge. Ask them for a quote.

When a phone is lost

The first hour matters more than anything else. Write this up and tape it inside the office manager's drawer.

1. Call the person. Maybe it is in the truck. If it is not, move on in minutes, not days.
2. Use find-my-phone to see where it is. If it is at home or in the truck, you can stop there. If it is out of reach, lock it and show a contact number on the lock screen.
3. If the phone is company-owned and there is any doubt, erase it. If it is personal, remove company data from the managed apps.
4. Sign the person out of work accounts from another device. Change the passwords that were saved on the phone, starting with email, bank and payroll.
5. Call the carrier from another phone. Ask them to suspend the line or block the SIM, and put a note on the account.
6. Tell the owner or manager, and write down the time and what was on the phone.
7. If it was stolen, file a police report and keep the number. Your insurer or carrier may ask for it.
8. When a replacement arrives, sign back in and review the account security pages.

SIM swap and port-out fraud

A SIM swap happens when a criminal convinces your carrier to move your number onto a SIM card they hold. A port-out moves the number to a different carrier. After either one, calls and texts to your number go to the criminal. That includes the six-digit codes your bank and email send for two-step sign-in. Using a few facts about you, perhaps taken from a data breach or the company website, they pose as the owner on the phone or in a shop.

The FCC adopted rules on November 15, 2023 to protect cell phone customers from SIM swap and port-out fraud. It said carriers' secure authentication methods must work for the full range of customers, and set compliance for July 8, 2024, or later if Paperwork Reduction Act approval from the Office of Management and Budget was still pending. Rules do not remove the need for your own protection.

1. Call the carrier and ask for the strongest account protections they offer: an account PIN or passcode that is not a birthday, and a port-out or number lock. Names differ by carrier.
2. Put the business, not an individual, as the account holder, and list the people who may make changes. Remove former employees.
3. Keep the PIN in the business password manager, and know who can read it.
4. Where you can, move two-step codes away from text messages. Use an authenticator app, or better a passkey or hardware security key. CISA's fact sheet calls FIDO-based methods phishing resistant.
5. If your phone suddenly says "No Service" or "SOS only" and you did not do anything, call the carrier from another phone right away and check your email and bank for unexpected changes.

Text scams and fake boss messages

Smishing is phishing by text. The common ones: a delivery you did not order, a bank fraud alert with a link, a toll or parking fine, and the "boss" text: "Are you at your desk? I need a favor." It comes from a new number that uses the owner's name. Staff who answer get a request for gift cards, a payment or a code.

• Never reply to a text asking for money, codes or a favor from someone "new."
• Do not tap links in texts. Open the bank or carrier app or type the address yourself.
• Call the person on a number you already had.
• Report it. The FTC says to forward phishing texts to 7726 (SPAM) and to report at ReportFraud.ftc.gov.
• Delete the text after you have taken a screenshot for the file.

Lesson 08 covers boss, vendor and payroll scams in depth and gives a verification procedure that fits phones too.

Mobile payments and card readers

A card reader that connects to a phone or tablet is a convenient way to take payments at a job site or a market stand. Some points of care:

• Use the reader and app from your payment processor. Do not store card numbers in notes, photos, texts or a spreadsheet. Lesson 09 explains why.
• Give each person their own login to the payment app, and remove it the day they leave.
• Keep the app and the tablet updated. Use a screen lock on the tablet, and if it stays on the counter, set it to open one app only if the tablet supports that mode.
• Pair the reader's Bluetooth only with the intended device. Check the reader's body for signs of tampering.
• Keep payment tablets on the device network (lesson 06).
• Count readers and tablets at close and keep them locked at night.

Messaging apps and records

Staff will text customers and coworkers, and some will use consumer chat apps. This is convenient and also a records problem. A customer promise made in a personal text thread is invisible to the business, and it leaves with the phone when the person quits.

• Pick an approved place for business messages: the company phone's number, the business messaging tool, or the shared inbox.
• Do not send passwords, full card numbers, Social Security numbers or ID photos by text.
• Be careful with disappearing messages. Some businesses are required to keep certain records, and the right retention period depends on your industry. Module 73 covers that at /journal_tools/issues/73-smb-privacy-security-management/.
• Group chats keep members forever unless someone removes them. Remove people who change roles or leave.

Travel with devices

• Take the minimum: a phone and laptop with only the files needed. A cheap loaner laptop is an option for trips to places where theft is common.
• Bring your own charger and power bank rather than plugging into unknown public charging ports.
• Keep devices in your carry-on, not in checked luggage or an unattended car.
• Use the hotspot on your phone instead of unknown Wi-Fi for banking and the admin console.
• Screens attract onlookers. Use a privacy filter or keep sensitive work for the room.
• If a device goes missing, follow the lost-phone steps from wherever you are.
• Before you leave, tell your bank and your office who to call if you cannot be reached for a payment approval.

When an employee leaves

The phone is part of the offboarding checklist from lesson 02. Do these on the last day or sooner, depending on the situation:

1. Remove the person's work accounts and company data from the phone. On a personal phone, use app-level removal. On a company phone, collect it, back up what the business needs, then erase it.
2. Remove the person from group chats, shared mailboxes, the business messaging tool and the payment app.
3. Take them off the carrier account's authorized users list and change the account PIN if they knew it.
4. If the business phone number was theirs, keep it. Customers may still call it. Transfer the number into the company's name before they go, not after.
5. Remove the person's phone number and device from two-step sign-in on shared accounts, and change shared passwords they knew.
6. Get written confirmation that the person has deleted company files from any personal cloud account or phone backup.

Do this this week

Who does what

Questions and answers

Can I make employees install management software on their own phones?

You can require it as a condition of using a personal phone for work, but a lighter option is often better: app protection that only covers the work apps. Say clearly in the policy what the business can and cannot see, and give staff the choice of a company phone.

What does it cost to manage phones?

Basic controls come with some email plans, so the cost can be zero. Plans that add full management and security are priced per user per month by the vendor, and the price changes. Get a current quote from the vendor or your IT provider.

Should we pay a stipend or buy phones?

Do the arithmetic as in the Ridgeline example, with your own numbers. Company phones give more control. A stipend is cheaper but only works if you protect company data at the app level.

What if a worker refuses a passcode?

Then that worker does not get work email or files on that phone. A phone with no lock is open to anyone who finds it.

How do I know if my number has been swapped?

Sudden loss of service on your phone, plus alerts about sign-ins or password resets you did not request, are the signs. Call the carrier from another phone at once and secure your email first, because email is how criminals reset everything else.

Are tablets on the shop floor different from phones?

They need the same lock, updates and find-and-erase, plus a rule about who may use them and a place to lock them at night. If they run a point-of-sale app, give each person a separate login.

Can we use consumer messaging apps for business?

You can, but you should decide on purpose. Pick one place for business messages so that the business can find them, and keep sensitive items out of chat.

Is there a simple template for the phone policy?

Use the one-page list earlier in this lesson as your template and talk it through with your staff before anyone signs. Your outside IT provider can review the technical items. For records rules by industry, see module 73.

Hard questions

"My employees will never give up their personal phones for work controls."

They do not have to. The app-level option protects company data without taking over the phone. The alternative is a company phone, which many staff like because the business pays. Pushing everyone toward a bare BYOD arrangement with no controls is what fails.

"If we require two-step codes by app, half the office will lock themselves out."

Some will, once. Set up recovery methods before you roll it out, and keep a backup method for each person, such as printed recovery codes in the safe. A day of annoyance beats a bank account taken over by someone who read a text code.

"The carrier's PIN is a hassle. We have never had a SIM swap."

Most people who have been hit felt the same way a day earlier. The PIN takes ten minutes to set. Your bank, payroll and email may all let a text code reset a password. Set the PIN.

"Why not ban phones at work?"

The phone is often the second factor for the very accounts you want to protect. Banning phones does not remove them from the risk, it just removes your say over how they are used.

"We cannot afford a management tool."

Check your admin console first. The basic controls from Microsoft and Google are included in plans many offices already have. Use them, and write down the manual yearly check for everything else.