Let me start with a detail from Microsoft's Q1 2026 email threat report that I have not been able to stop thinking about.
Microsoft analyzed roughly 8.3 billion email-based phishing threats in the first quarter of 2026. The fastest-growing tactic by the end of that quarter was QR code phishing, which jumped from 7.6 million attacks in January to 18.7 million in March, a 146% increase in three months. That is interesting on its own. But here is the line that matters for this post. Microsoft describes the goal of the tactic as redirecting "victims to phishing sites on unmanaged mobile devices."
Read that again. The attack is not just trying to trick a person. It is trying to move that person off the company laptop, which has security software on it, and onto the phone in their pocket, which almost certainly does not.
That is not an accident. That is target selection. And it tells you something uncomfortable about where your actual security perimeter is.
What "endpoint" means, and why your phone count is wrong
In security, an endpoint is any device that connects to your systems and data. Laptops, desktops, tablets, phones, servers. If it can open your email or reach your files, it is an endpoint.
A managed endpoint is one where the business can enforce rules: require encryption, require a screen lock, push updates, and remove company data remotely. An unmanaged endpoint is one where you have no enforcement at all. You are trusting the person holding it and nothing else.
Now do a quick inventory in your head. Count your company laptops. Most small business owners can do this accurately, because they bought them and there is a receipt somewhere.
Now count the personal phones that can open company email. If your team checks Outlook or Gmail on their own phones, and almost everyone does, then every one of those phones is an endpoint holding your business data. Nobody bought them, nobody configured them, and they are not on any list. They are, functionally, company computers that follow none of your company rules.
Here is the part most articles skip: the phone is often the better target, not the leftover one.
Why attackers prefer the phone
The 2026 Verizon Data Breach Investigations Report, which analyzed more than 22,000 confirmed breaches, found that mobile social engineering success is up 40%. The human element showed up in 62% of breaches, slightly up from 60% the year before. People fall for things on phones more than they fall for the same things on a desktop.
There are boring, mechanical reasons for this, and they are worth understanding because they are the reasons you can actually design around.
A phone screen truncates the sender address. On a laptop you see billing@micros0ft-invoices.com and something in your gut goes "hm." On a phone you see "Billing" and a logo. The URL bar in mobile Safari or Chrome hides most of the address as soon as you scroll. Hovering over a link to preview where it goes, which is the single most useful anti-phishing habit ever invented, does not exist on a touchscreen. You either tap it or you do not.
Add context. Phones get checked in line at the pharmacy, one-handed, half-distracted, between other things. That is not the mental state in which people scrutinize a sender domain.
And the QR code trick I opened with exploits all of this deliberately. A QR code is an image. Text-scanning email filters read text, so a malicious URL hidden inside an image-based QR code sails past defenses that would have caught the same link typed out. Then the scan happens on a phone, outside your network, outside your filtering, on a device you do not manage. Microsoft also reported CAPTCHA-gated phishing more than doubling (+125%) in March to 11.9 million attacks, which is the same idea: put a step in front of the payload that automated scanners cannot follow but a human happily clicks through.
The attacker is not beating your security software. They are routing around it.
What is actually sitting on that phone
Let me be real with you about the blast radius, because "they read email on their phone" undersells it considerably.
When someone signs into company email on a personal device, that device typically ends up holding:
Cached mail and attachments. Not a live window into the server. An actual local copy of months of correspondence, contracts, invoices, and whatever your team emails around.
A session token. This is the important one, and most people have never heard of it. When you log in, the service hands your device a session token, which is a long string that says "this device already authenticated, let it back in without asking." It is a hotel key card. It exists so you do not retype your password forty times a day. It also means that someone with access to an unlocked phone does not need the password *or* the multi-factor code. The door is already open.
Multi-factor codes. If your team uses SMS text messages for two-factor authentication, the second factor arrives on the same device that holds the first factor. That is not two factors. That is one factor and a formality.
Photos of documents. Someone photographs a signed form, a check, a driver's license for an onboarding packet. That image goes into the personal camera roll and syncs to a personal cloud account you have never heard of.
Saved passwords. In the phone's browser, in a personal password manager, in a note.
Now consider the ordinary, non-dramatic events that expose all of it. Not a targeted attack. Just: the phone is left in a rideshare. The phone is sold or traded in. The employee quits on bad terms and the data simply leaves with them, because there was never a mechanism to take it back. SecurityWeek notes that while millions of phones and laptops go missing every year, only a small fraction are ever classified and reported as data breaches, largely because nobody can prove what was on them. That gap is not comforting. It means these losses mostly go uncounted, not that they are harmless.
One more, newer wrinkle. The Verizon report found employee use of unapproved "shadow AI" tools tripled to 45%, with a matching spike in data leakage. Pasting a client contract into a random AI chatbot app is a data disclosure, and it is far more likely to happen on a personal phone than on a locked-down work machine.
The fix that small businesses keep missing
Here is where most advice goes wrong. The standard recommendation is MDM, or Mobile Device Management, which is software that enrolls a device and gives the business control over it. Full MDM on a personal phone means the company can, in principle, see the device, wipe the whole thing, and enforce settings on the owner's private property.
Employees hate this, and honestly, they are right to. "Install this so I can remotely erase your personal phone, including your kid's birthday photos" is a genuinely bad deal for someone using their own hardware for your convenience.
So the conversation stalls, nothing gets implemented, and everyone goes back to unmanaged.
The thing to know is that there is a middle option, and it is the correct answer for most small businesses: MAM, or Mobile Application Management, sometimes called app protection policies. Instead of managing the phone, you manage the company data *inside specific apps*.
Practically, that means the work account inside Outlook gets its own rules. Require a PIN or biometric to open the work profile. Encrypt the company data inside the app. Block copy-and-paste from the work app into personal apps. Block saving work attachments to the personal camera roll or personal cloud. And critically, allow a selective wipe, which removes only the company container and leaves everything personal untouched.
Both major platforms include this. Microsoft 365 Business Premium includes Intune app protection policies, and Google Workspace has comparable app management in its admin console. If you are already paying for one of these suites, and you probably are, this capability is very likely sitting unused in your subscription right now. It is a configuration task, not a purchase.
This is also the version employees will actually accept, because the honest pitch is true: the company protects company data, and does not touch your photos.
Your action plan
1. Inventory what "access" means. For each person, write down which company systems they can reach from a personal device. Email, file storage, the CRM, the accounting system. You cannot protect a list you have not written.
2. Turn on app protection policies before anything else. Require a PIN or biometric on the work app, encrypt the work container, block data transfer to personal apps, and enable selective wipe. This is the highest-value hour you will spend.
3. Get off SMS two-factor. Move to an authenticator app or, better, passkeys, which replace passwords with a cryptographic key stored on the device and unlocked by fingerprint or face. A passkey cannot be phished by a fake login page, because there is no code for a human to type into the wrong site. CISA's guidance on routinely exploited weak controls puts multi-factor at the top of the list for a reason.
4. Set an OS version floor. Decide the minimum iOS and Android version allowed to connect, and enforce it. "Update your phone" is a request. A conditional access rule is a policy.
5. Require a screen lock and device encryption. Modern phones encrypt by default *when a passcode is set*, and do not when it is not. The passcode is the encryption. A phone with no lock screen is a filing cabinet with the drawer open.
6. Write an offboarding checklist and actually use it. Revoke sessions, not just passwords. Changing a password does not necessarily kill an existing session token, so use the "sign out everywhere" or "revoke sessions" function in your admin console. Then run the selective wipe.
7. Train specifically on QR codes and mobile links. Tell your team the actual rule: do not scan a QR code that arrived in an email, and never log in from a link you did not initiate. If a message says your mailbox is full or a document is waiting, open the app directly instead of tapping through.
8. Use the free authoritative checklists. CISA publishes a Mobile Device Cybersecurity Checklist for Organizations that maps cleanly onto small business decisions, along with a broader set of small and medium business resources. For the deeper version, NIST's SP 800-124 Revision 2 is the reference document on managing mobile device security, including specific BYOD recommendations. These are free, and they are more rigorous than anything a vendor will hand you.
If steps 2, 3, and 6 are all you ever do, you have closed most of the gap. This is the unglamorous core of small business cybersecurity: not exotic tooling, just refusing to leave the easy doors open.
The takeaway
The phones your team already owns are the least protected computers touching your business, and attackers have noticed, which is why the fastest-growing phishing tactic of early 2026 is built specifically to land on them. You do not need to take over anyone's personal device to fix this. You need to manage the company data living inside it, which is a setting you are probably already paying for and have not switched on yet.
