In 2025, Brazil recorded 830,890 phones taken in robberies and thefts, according to the 2026 National Public Security Yearbook, published by the Brazilian Forum on Public Security — an average of nearly 95 devices every hour, every day of the year. The survey counts 308,723 robberies, down 18.6% from 2024, and 483,561 thefts, roughly unchanged.
The phone that disappears isn't just a handset. It's the company email synced to it, the finance team's chat group, the price sheet saved for quick reference mid-visit, and the system app already logged in, no password needed. All of that travels together, because someone put it there, one day, so the sales rep could move faster.
The detail that changes everything: it's his phone. It's his SIM card. The company never had ownership of either — it only put data inside. And that's exactly why, when the device disappears, most companies discover they have nothing ready to do about it.
The problem in detail
Anyone working out in the field — a sales rep, a technician, a delivery driver — carries their personal phone as a work tool all day. It's where the chat app used with clients lives, where email arrives first, and where the system password got saved so it wouldn't need typing again at every stop.
The Yearbook also shows where this risk concentrates: the city of São Paulo alone accounts for 20% of all phone robberies and thefts in the country, despite holding 5.6% of the national population. For anyone selling or serving clients in the field in any large urban center, this isn't a distant risk — it's routine.
Recovering the device is rare. The Yearbook itself describes a resale chain that crosses borders, with phones stolen in Brazil ending up in electronics markets abroad. In practice, a company should treat every lost personal phone as gone for good — not as something that might come back.
The loss isn't just the device. It's the client who gets a strange message from the number they trust, still thinking they're talking to the same sales rep. It's the price sheet that starts circulating outside the company. It's system access, still active, with no one sure for how long.
And there's a second door that opens the same way, though it's talked about less: someone who left the company still has the company email synced on their own phone, and no one removed it. That's not the focus here, but it's the same problem from another angle — company data sitting inside a device the company doesn't control.
Why the usual approach doesn't work
The usual approach is trusting that "everyone looks after their own phone" and going no further. It works until a client calls sounding suspicious, or the sales rep reports, days later, that the phone was lost over the weekend.
Another version of the same approach is verbal guidance — "don't save your password," "don't keep the price sheet on your phone" — with no mechanism behind it. Guidance without a control depends on everyone remembering it on a busy ordinary day, which is exactly when it fails.
It's also common to treat "IT security" as a computer-only topic — antivirus on the machine, backup on the server — leaving the personal phone completely out, even though, for many companies, it's the device that touches clients and systems the most during the day.
And when someone leaves the company, it's common to remember disabling the office computer's email and forget that the same email is still synced on that person's personal phone — which keeps receiving everything, even after they've stopped working there.
What has to be in place
Identify corporate access. Record which company accounts, apps and information are on the phone. The company needs to know what to block and who can authorize that action.
Protection that fits the device and its use. Work profiles and app protection can separate corporate and personal data where the chosen tools support that capability. Check platform, app, licence and configuration; do not assume every file saved on a phone can be wiped selectively.
Review authentication and sessions. Multi-factor authentication helps protect new sign-ins, but is not a guarantee when a device is already unlocked and signed in. The plan should also cover account blocking and session revocation in the relevant systems.
Rules understood by the device user. Agree beforehand what will be managed, which actions can follow a loss and how the employee reports it. Configuration must respect authorization and the separation of personal and corporate use.
Decide who needs a company device. A corporate phone may make sense for some roles. Consider the data accessed, necessary protection and cost; hardware purchases and licences are defined in the proposal.
Skills IT assesses corporate access on mobile devices and recommends controls compatible with the environment. Protection and selective wipe configuration depend on supported apps, devices, licences, authorization and contracted services. After an authorized loss or departure notice, we act on covered access according to agreed priority and coverage.
The gain for the company
With an access map and named owners, the team has a reference for acting after a device is lost. The outcome depends on the systems, available access and notification of the incident.
There's also a gain that only shows up when it's missing: the deadline. Per ANPD guidance, losing a device with personal data belonging to a client or employee can require the company to report the incident within three business days, when that unprotected data could pose a real risk to those affected. Finding this out in the middle of a crisis costs far more than having already separated company data beforehand.
The aim is to reduce misuse of accounts and information after a loss. Alongside the technical actions available, the company decides who needs notification and follows outstanding actions; these measures cannot guarantee that every scam will be prevented.
Questions to bring to your next meeting
- Does anyone know, today, what each team member's personal phone can access from the company? If the answer is "sort of," there's no map to revoke anything when a device is lost.
- Is there anything in writing agreed with whoever uses their own phone for work? Without it, no one knows what the company can or can't erase when the device disappears.
- Who receives a loss report and what must they do? Agree on the channel, authorization, covered systems and how blocking is confirmed.
- Is there a second confirmation step beyond the password on every access from a personal phone? Without it, the password saved on the lost device is enough to get in.
- Does whoever handles pricing and clients all day have a company phone, or their own? The answer decides whether this is worth treating as an investment, instead of waiting for the loss to happen.
