Work phone safety: 7 habits every staff member should have

Amaka leaves her phone on a bus seat. It has her work email, the shop’s chat group and a banking app. She does not tell anyone for two days because she hopes someone will hand it in.

Meanwhile, anyone who finds it and gets past a weak lock can read her messages and use her codes.

A phone is a small computer that goes everywhere. These habits take a few minutes to set up, and they stay set up.

What are the seven habits?

1. Use a screen lock. A 6-digit PIN, a fingerprint or a face unlock. Not 1234.
2. Lock it fast. Set auto-lock to 30 seconds or less.
3. Install updates. Turn on automatic updates. CISA’s guide to updating your software says the same.
4. Check app permissions. Does that torch app need your contacts and microphone? If not, switch it off.
5. Keep work and personal apart. Work email in the work app. Personal chats in your own accounts.
6. Treat chat groups with care. Know who is in them. Never post passwords or customer details.
7. Report fast. A lost phone, a strange message, a prompt you did not start. Tell IT early.

CISA also has a short page on privacy and mobile device apps. The UK’s NCSC has a longer device security guide your IT team may find useful.

What is the 10-second check?

Do this once a month. Pick the first Monday if that helps you remember.

What about app permissions?

Apps ask for things. Camera, microphone, contacts, location, photos. Some need them. Many do not.

A simple rule: if you cannot say why an app needs it, say no. You can change it later. On most phones, go to Settings, then Privacy or Apps, and look at each permission one by one.

Install apps only from your phone’s official store. If a link in a text or chat tells you to “install this to see the document,” do not. Our guide to smishing and QR code scams shows how those links look.

How do you keep work and personal apart?

You do not need two phones. You need two habits.

• Use your work email in the work mail app, not your personal Gmail or Yahoo.
• Do not forward work files to your own accounts “just to read at home.”
• If your office gives you a work profile or app, use it.
• Ask before you put a work account on a new phone. IT may want to set it up right.

What about WhatsApp work groups?

In Nigeria, WhatsApp is how many teams run the day. That is fine. A few rules make it safer:

• Admins check the member list every month. Remove people who left.
• Never post a password, a BVN, a card number or a customer’s ID.
• A message that says “send money now” or “this is the boss on a new number” gets a call-back first. Our post on WhatsApp scams at work in Nigeria has more.

In the United States, texting groups and apps like Slack or Teams do the same job. The same rules apply. Check who is in the group before you post anything private.

What if you lose your phone or think someone has it?

Do not wait and hope. Do these in order.

1. Tell IT or your manager now. Say what is on the phone: work email, chat, any banking app.
2. Lock or wipe it. Use Find My (iPhone) or Find My Device (Android), or ask IT to do it.
3. Change your passwords. Start with work email, then your bank and personal email.
4. Call your phone company. Ask them to block the SIM, so no one can use your number to get codes.
5. Tell your bank if the phone had a banking app. They can add extra checks.
6. Report a theft to the police if your office or insurer asks for it.

If the phone was lost and then you saw a prompt you did not start, read the sign-in prompt you did not ask for. If the phone was used to click a bad link, see what to do after clicking a phishing link.

Keep reading

Your phone also meets hotels and airports, so read public Wi-Fi safety for staff. Phones are one of many places a shared password can live, so see why to stop sharing work logins. For front-desk teams there is guest Wi-Fi and what to do at reception. Also see our security awareness checklist for small business.

Try it safely

Habits stick when you practice them. Our free phishing test sends safe, made-up phishing emails to your team and shows who clicked and what to fix. You can also see how phishing simulation training works.

For managers and owners: staff can only follow these habits if the office has a clear phone rule. AkolagTech wrote a plain guide on how to secure work phones in a small business.