A phone can look personal while carrying a surprising amount of business information: email, customer messages, photographs of documents and files downloaded for a meeting.
If it goes missing or an unsafe app gets access, the problem may be bigger than replacing the handset. Work can stop, and information may be exposed.
Last week’s brief covered protecting your online accounts. This week, focus on the phone itself. These five checks are a practical starting point.
1. Lock the screen and the SIM
Use a strong screen-lock PIN or password. Avoid birthdays, repeated digits and anything easy to guess. Fingerprint or face recognition can make unlocking convenient, but the fallback PIN still matters.
Set the screen to lock automatically after a short period and lock it yourself before putting the phone down. Check what notifications reveal while it is locked: a message preview may display customer details or a sign-in code.
Treat the unlock code like a key. Keep it private and be aware of people watching you enter it.
We strongly recommend enabling a SIM PIN as well as a screen lock. If an unprotected physical SIM is removed and put into another phone, someone may be able to use your number, receive SMS one-time passwords (OTPs) and read contacts saved on that SIM. Access to verification codes can also help them take over services such as WhatsApp, depending on the account’s other protections.
A SIM PIN locks the SIM after a restart or when it is moved to another phone, helping prevent use without that PIN. Ask IT or your mobile network to help enable it and change the default PIN. Keep the PIN and the network’s recovery code (PUK) somewhere secure, away from the phone. Do not guess either code: repeated incorrect attempts can block the SIM.
Enable WhatsApp’s own two-step verification as well. It is separate from the SIM PIN and adds protection against someone registering your number on another device.
2. Keep the phone and its apps supported
Install security updates for both the phone’s software and its apps. Enable automatic updates where appropriate, and check occasionally that they have actually installed.
An older phone may still make calls perfectly while no longer receiving security fixes. As Security Brief #005 explained, still working does not mean secure. Check the manufacturer’s support information for your exact model. If support has ended, discuss a replacement plan before continuing to use it for sensitive work.
For a phone managed by your employer, follow the update process agreed with IT.
3. Be selective about apps and permissions
Install apps through the phone’s official store or your employer’s approved route. Avoid installation links sent unexpectedly by message, even if they claim you need a delivery, banking or security update.
An official store reduces some risks; it does not make every app trustworthy. Check the publisher and whether the app really needs access to your contacts, microphone, camera or location.
Remove apps you no longer use. Ask IT before removing a work-management app or changing a work profile.
4. Check what you could recover
Do not assume everything on the phone is backed up. Check when the last backup completed and what it includes. Some apps need their own backup or transfer process.
Save work documents in the business’s approved storage, rather than leaving the only copy in a download folder or photo gallery. Avoid copying customer information into a personal backup account without permission.
A useful question is: could you retrieve an important work document from another authorised device today? Ask IT to help check this without deleting anything.
5. Prepare for a missing phone
Getting back into your accounts was covered last week. This check is about the phone itself and the information on it.
Check the phone’s built-in lost-device settings while you still have it. Know how to reach the official service from another device, and keep your IT support and mobile network contact details somewhere other than the phone.
Remote locking or erasing depends on the device, its settings and connectivity. It is useful protection, but not a guarantee that information can always be removed immediately.
If the phone goes missing
Report it to your IT provider promptly if it contains work information. Use the official lost-device service to mark it as lost or request a lock, and contact your mobile network to suspend the SIM or service.
Tell IT if the phone was unlocked or someone may know its PIN. They can assess work access and the appropriate response. Discuss remote erasure with them: it can permanently remove data and may affect tracking. After a phone goes missing, criminals sometimes send messages claiming it has been found and asking you to sign in or remove it from your account. Treat these as scams and contact IT instead.
A note for owners and managers
Agree which personal phones may access work information, the minimum security settings and who handles a loss. Explain any management controls and their privacy implications to staff before using them.
Not sure how your team’s phones access business information? Primeworks can review this as part of your Microsoft 365 setup. Existing Primeworks customers can email support@primeworks.co.za. If you are not yet a customer, request a security review.