Your office manager gets a text that looks like it came from the bank: a payment is on hold, tap here to confirm. On a laptop, the odd web address might stand out. On a phone, between meetings, with a small screen and no way to hover over the link, it gets tapped. That is how most mobile device attacks begin.
Phones now hold the same email, files, banking apps and MFA prompts as a work computer, and they rarely get the same protection.
Five mobile device attacks at a glance
| Attack | What it looks like | First defense |
|---|---|---|
| Text and voice phishing | A text or call from the “bank”, a delivery company or your CEO | Open the app or call a number you already have |
| Malicious and risky apps | A copycat app, or a real one asking for far too much access | Official app stores only, and a permissions check |
| Out-of-date phones | A phone past its last security update | Automatic updates, and replacement when updates stop |
| Lost and stolen phones | A phone left in a restaurant or taken from a car | Six-digit passcode, Find My and remote wipe |
| Risky Wi-Fi, fake sites and chargers | A lookalike site, an open network or a public USB port | Cellular data for sensitive work, and your own charger |
1. Text message and voice phishing
Smishing (text phishing) and vishing (voice phishing) are everyday tools now. The messages pose as banks, delivery companies, toll agencies, Microsoft or your own CEO, and they push you to act fast. Links are hard to inspect on a phone, sender names are easy to fake, and people answer between other tasks.
40%
higher median click rate in phishing simulations using mobile channels like text and voice, compared with email (Verizon 2026 DBIR)
Don’t tap links in unexpected texts. Open the app or type the address yourself, confirm any request about money or logins through a number you already have, and never read an MFA code or password to someone who calls, even if they say they are from IT. QR codes are a close cousin of this attack, and our post on QR code phishing covers them.
2. Malicious and risky apps
Fake apps copy the look, name and even the reviews of real ones. Some work exactly as advertised while collecting data in the background. Others are legitimate apps with far more access than they need.
- Download only from the Apple App Store or Google Play, never from a link in a text or website.
- Check the developer name, the number of downloads and recent reviews, beyond the star rating.
- A flashlight or PDF app has no reason to read your contacts, messages or location.
- Delete apps you don’t use, and revisit permissions in Settings every few months.
3. Phones that stopped getting updates
Every phone has an end date for security updates, and after that, newly found flaws stay open for good. Google commits to seven years of updates for Pixel 8 and later, counted from when the model first went on sale. Many other Android phones get much less, and support varies by manufacturer and carrier. Turn on automatic updates, restart phones regularly so updates install, and replace any phone used for work email or MFA once updates stop. Microsoft Intune can also block company apps on phones running an operating system older than a minimum you set.
4. Lost and stolen phones
A phone left behind can expose email, files and every account that sends codes to it. The FTC recommends at least a six-digit passcode and auto-lock. Turn on Find My on iPhone, or Google’s find-and-erase feature on Android, so the phone can be located, locked or erased. On iPhone with iOS 17.3 or later, Stolen Device Protection requires Face ID or Touch ID with no passcode fallback for things like saved passwords, and adds a one-hour delay before key security settings can be changed away from familiar places. Back the phone up, and have a rule that staff report a missing work device right away, day or night. Our post on what to do when a mobile device goes missing walks through the response.
5. Risky Wi-Fi, fake websites and public chargers
Public Wi-Fi is less dangerous than it used to be. The FTC notes that most websites now encrypt traffic, so public Wi-Fi is usually safe for ordinary browsing. The bigger risk is the site itself, since scammers put the padlock icon on fake sites too. Use your cellular connection or hotspot for banking and sensitive work, turn off auto-join for open networks with generic names, and use the company’s secure remote access instead of a free VPN app. Charge from a wall outlet with your own adapter, because a USB port can carry data as well as power.
Protecting company data on personal phones
Most offices have staff reading email and Teams on personal phones. The right setup varies by organization. Among our clients, some use app protection on personal phones, some require full enrollment, and some don’t allow personal phones for work at all.
- Microsoft Intune app protection works on personal phones that aren’t enrolled. It can require a PIN to open Outlook or Teams, block copy and paste from work apps into personal ones, stop saves to personal cloud storage, and wipe only company data when someone leaves.
- Company-owned phones should be fully enrolled, so you can enforce passcodes, updates and encryption and wipe them if lost.
- Move staff off text-message codes. For our clients, admins use passkeys or security keys and everyone else approves sign-ins in an app with number matching. Our post on push bombing explains why number matching matters.
- Write it down: which apps can reach company data, what happens when a device is lost, and what IT can and can’t see. Our guide to smooth BYOD programs covers getting staff on board.
For healthcare practices and financial firms, patient and client data on phones falls under the same HIPAA and FTC Safeguards Rule requirements as data on a laptop, including access controls and encryption. Microsoft 365 Business Premium includes Intune Plan 1, so many organizations already own these tools. Our cybersecurity services cover phones the same way they cover laptops, and our compliance team can document mobile controls for your next risk assessment.
Nearly everyone on your staff carries work in their pocket. Book an intro call and we will help you decide how much of it to manage: app protection, full enrollment or company phones only.
FAQ
Frequently asked questions
What is mobile security?
Mobile security is protecting phones and tablets, and the email, files, banking apps and MFA prompts on them, from phishing, malicious apps, theft and unpatched flaws. For a business, it also covers company data on personal phones, which app protection can control without managing the whole device.
How do you secure mobile devices?
Turn on automatic updates and replace phones once updates stop, use at least a six-digit passcode with auto-lock, and turn on Find My or Google’s find-and-erase feature. Install apps only from the official stores. For work data on personal phones, Intune app protection can require a PIN for Outlook and Teams and wipe only company data; company-owned phones should be fully enrolled.
What is a common mobile device security threat?
Text and voice phishing is the most common starting point. In Verizon’s 2026 report, phishing simulations sent by text and voice had a 40% higher median click rate than email. Malicious apps, phones past their last security update, lost or stolen phones and fake sites round out the list.
Sources: Verizon: 2026 Data Breach Investigations Report; Google: Pixel update support schedule; FTC: How to protect your phone from hackers; Apple: About Stolen Device Protection for iPhone; FTC: Are public Wi-Fi networks safe?; Microsoft Learn: Intune app protection policies overview; Microsoft Learn: Microsoft 365 for business security best practices; CISA: Implementing phishing-resistant MFA (fact sheet).
