Mobile Device Security: How to Secure a Work Phone

In short: a work phone is secured with about ten simple settings drawn from CISA and FTC guidance: lock, updates, phishing-resistant sign-in, a carrier PIN, app hygiene, separation of work and personal data, and a lost-phone plan written in advance. The stakes are real: the FBI’s Internet Crime Complaint Center logged $3.05 billion in business email compromise losses in 2025, and phishing was again the most reported crime, with 191,561 complaints.

A phone now holds your email, the codes for two-factor sign-in, banking apps, customer files and often the CRM. Losing it, or letting it be compromised, opens all of those doors at once.

Why is a work phone such a target?

Because it is the key to your accounts. The FBI’s 2025 IC3 report, built on 1,008,597 complaints and $20.877 billion in reported losses, shows the chain clearly:

• Phishing and spoofing remain the most reported category, with 191,561 complaints. They are often the first step toward stealing an account.
• Business email compromise cost $3,046,598,558 across 24,768 complaints, up from 21,442 the year before. A hijacked mailbox is used to send a fake invoice or a “new bank details” message that looks entirely legitimate.
• SIM swapping, where a criminal convinces your carrier to move your number to their SIM card and then receives your text-message codes, produced 971 complaints and $17.4 million in losses.

A phone piles up the risks: it gets lost, it gets stolen, it receives booby-trapped texts, and it connects to unknown networks and chargers on the road.

Which settings should you change on day one?

This list combines the FTC’s consumer guidance with CISA’s Mobile Communications Best Practice Guidance, published in December 2024. CISA wrote it for “highly targeted” people such as senior officials, but says it applies to all audiences, and most of it costs nothing. Everything can be done in one sitting, phone in hand.

1. Passcode and auto-lock. The FTC recommends at least a six-digit passcode, plus fingerprint or face unlock if available. Never 000000 or 123456.
2. Automatic updates for the operating system and apps. CISA adds: check weekly that the device is current.
3. Backups of contacts, messages and files, to the cloud service your company provides.
4. Find my device turned on (Find My on iPhone, Find My Device on Android), so you can locate, lock or erase a lost phone.
5. A carrier account PIN. CISA recommends adding a PIN or passcode and MFA to your mobile carrier account, required for sensitive operations such as porting your number. It is the main defense against SIM swapping.
6. Phishing-resistant sign-in. CISA’s order of preference: FIDO security keys or passkeys first, then authenticator app codes, and move away from text-message codes, which are neither encrypted nor phishing-resistant.
7. A password manager for every account, with a long passphrase protecting the vault.
8. The IMEI number written down somewhere other than the phone: dial *#06# to display it. Your carrier can use it to block the handset if it is stolen.

Which apps and networks should you allow?

Apps. Install only from the official stores, delete what you do not use, and review permissions at install and after updates. CISA’s iPhone and Android checklists both say the same thing: revoke access to location, camera and microphone that an app does not need to work. On Android, CISA also asks you to confirm that Google Play Protect is on and to be careful with third-party app stores and sideloading.

Browsing. On Android, CISA recommends checking that Chrome’s “Always use secure connections” and Enhanced Safe Browsing are enabled.

Networks and hardware. CISA advises against personal VPN apps, which mostly shift your risk from your internet provider to a VPN company with uncertain practices; a VPN your company requires for its own systems is a different case. It also recommends prioritizing recent hardware from makers that commit to monthly security updates for at least five years, because software updates cannot add protections that old hardware does not support.

Highly exposed people. For owners, executives or anyone likely to be targeted, CISA recommends turning on Lockdown Mode on iPhone, which restricts some apps and features to shrink the attack surface.

How do you handle messages, texts and phishing?

• Use end-to-end encrypted messaging for sensitive conversations. CISA names Signal as an example, and recommends disabling iPhone’s “Send as Text Message” fallback so iMessage conversations do not silently drop to unencrypted SMS.
• Never click a link in a text about a package, a toll, a fine or a bank problem. Open the website or app yourself.
• Hang up and call back on the official number if a “representative” asks you for a code or an approval, even if the caller ID looks right.
• Do not store secrets in plain sight: no passwords in notes, no PINs in contacts.
• Verify payment changes by voice, using a number you already had, before you act on any email asking to change bank details.

The same caution applies to files opened on a phone: our guide to sending large files explains how to spot a fake sharing link. To cut down the spam reaching the device, a disposable email address or alias protects your main address when you sign up for things.

Company phone or personal phone: what can the employer do?

The simplest setup is still a company-owned phone used only for work. If you let employees use their own devices (bring your own device, or BYOD), the rules depend on how the phone is enrolled.

• With full device management, the company controls the whole device, including the ability to erase it entirely. That suits company-owned phones.
• With Apple’s User Enrollment, designed for personally owned devices, Apple says IT can manage only the organization’s accounts, settings and information, never the user’s personal account. Android offers a similar split through a separate work profile.

NIST’s guidance on enterprise mobile security (SP 800-124 Rev. 2, May 2023) covers both company-provided and personally owned devices. Whatever you choose, write it down: a short BYOD policy that says what the company can see, what it can erase, which security settings are mandatory and what happens when someone leaves. Employment law on device monitoring varies by state, so have the policy reviewed before you roll it out. If you have UK or EU staff, the UK GDPR or EU GDPR also requires that monitoring be proportionate.

Do you need mobile device management (MDM)?

Beyond a handful of phones, configuring settings one by one stops being realistic. A mobile device management tool lets you:

• enforce a passcode and encryption on every device;
• push and remove work apps;
• create a separate work space on personal devices;
• lock or wipe a lost device remotely.

Apple and Google both offer enrollment programs for businesses, and most business office suites include basic device management. For a very small team, well-documented manual settings are enough. Past that, the tool pays for itself in time saved and in how fast you can react when a phone goes missing.

Lost, stolen or hacked: which plan should you prepare?

Write this procedure before you need it, on one page, and give it to every user:

1. Locate, lock, then erase remotely if the phone is not found quickly.
2. Call the carrier to suspend the line and block the device using the IMEI.
3. Change passwords for email and every account open on the phone, and sign out all active sessions.
4. Warn key contacts if a compromise is possible, so they distrust unusual requests sent in your name (payments, bank detail changes).
5. Report it. File a police report for a theft, report fraud to the FBI at ic3.gov, and check whether customer personal data was exposed: every US state has a data breach notification law, and under the UK GDPR a reportable breach must be notified to the ICO within 72 hours.

Think about business data too: if the phone had access to your CRM, end that device’s session from the admin console. And if a company social media account was logged in on the device, secure it right away: our guide to contacting Facebook support lists the options when an account has been hacked.

Securing a work phone takes neither a budget nor special expertise. It takes doing the settings once, properly, and knowing what to do the day the device disappears.