Mobile Malware Is Rising Fast. Is Your Phone as Secure as Your Computer?
It is 9:15am and you are checking a client email on your phone before walking into a meeting. You tap a link, it looks fine, and you move on. What you probably did not consider is whether that phone - the same device you use for two-factor authentication, email, calendar, and file access - has any real security protection on it at all.
Mobile malware attacks surged by 500% in early 2022, according to cybersecurity researchers. That is not a rounding error. It reflects a real shift in how cybercriminals operate. More than 60% of digital fraud now happens through mobile devices. Yet most businesses that would never dream of leaving a work laptop unprotected have done almost nothing to secure the phones their staff use every day.
The problem is a mismatch between how powerful phones have become and how seriously people treat them. A modern smartphone has access to your email, your practice management system, your client files, and your banking. It can approve logins to almost every system you use. If it is compromised, the damage is not limited to the phone. It can be a direct path into everything else. Under the NZ Privacy Act 2020, a breach that originates from an unsecured mobile device is still a breach - and still needs to be reported to the Office of the Privacy Commissioner if it involves client information.
Getting mobile security right does not require a complicated overhaul. The basics matter most. Every phone used for work should have a reputable mobile security app installed - not a free one downloaded on a whim, but something properly vetted. Apps should only ever be downloaded from trusted stores like the Apple App Store or Google Play, and the operating system should be kept updated automatically so vulnerabilities are patched as they arise. Old apps that nobody uses anymore should be removed. Abandoned apps that have not been updated in over a year are a known entry point for attackers, because security flaws in them are never fixed.
Email and text messages deserve the same scepticism on a phone as they do on a desktop. Smishing - phishing via text message - is now more common than phone spam calls. These messages often carry malicious links that look entirely plausible. A fake courier notification, a supposed bank alert, a message that almost makes sense but not quite. If something looks off, do not tap the link. Open it on a computer where you can check where it actually goes before clicking. And when staff are connecting to public Wi-Fi - at a cafe between client visits, or at an airport - a VPN (a tool that encrypts your connection) adds a meaningful layer of protection. Staff who understand how to spot these threats before they cause harm are far less likely to fall for them.
The cleanest way to handle this across a business is to bring mobile devices into whatever managed IT support arrangement already covers your computers and systems. That way updates, security apps, and access controls are managed consistently, not left to individual staff to sort out in their own time. For practices handling sensitive client data, having that consistency is not just convenient - it is necessary. You can read more about the broader approach to keeping client data safe on our cybersecurity page.
If you are not sure where your business currently stands on mobile security, ITstuffed offers a 15-minute IT Fit Check at itstuffed.co.nz/booking - a quick conversation to identify what is exposed and what can be done about it.