Yes — phishing simulations can run on staff personal phones, because a simulated phish is just an email or an SMS: it lands in whatever inbox the person actually reads, whether the device is corporate or their own. What changes on a personal device is not the campaign mechanics but the rules around it — written consent to be tested, tight limits on what gets collected, and coaching that never punishes a private phone. Cyber Aware delivers email and SMS simulations to any device that receives them and never harvests credentials at any step, which is what makes personal-phone campaigns safe to run.
TL;DR
- Simulations travel by email and SMS, so they reach personal phones the same way real attacks do.
- BYOD testing is legitimate in 2026 when consent is written into the enrolment policy.
- Collect clicks and reports only — never credentials, never device inventory.
- 46% of compromised systems holding corporate logins were non-managed devices (Verizon 2025 DBIR).
- A click on a personal phone triggers the same private, same-day coaching as a click on a work laptop.
Why this matters
The attack already targets personal phones. The modern compromise does not wait for the corporate laptop: scammers text, off-hours email arrives on the personal device, and staff read both. Verizon's 2025 Data Breach Investigations Report analysed 22,052 security incidents and 12,195 confirmed data breaches, and found that of compromised systems holding corporate logins, 46% were non-managed devices carrying both personal and business credentials (full report PDF). The human element stayed involved in roughly 60% of breaches. In Australia, the Australian Signals Directorate received more than 84,700 cybercrime reports in FY2024-25 — one every six minutes — with small businesses averaging $56,600 per self-reported loss (ASD Annual Cyber Threat Report 2024-25).
A training programme that only tests corporate inboxes is testing the wrong device half the time. BYOD testing in 2026 is not a niche request — it is the version of the programme that matches where staff actually read messages.
Can phishing simulations be run on staff personal phones?
Yes, on four conditions. The simulation is delivered as ordinary email or ordinary SMS, so no agent, enrolment profile or mobile device management is needed to reach a personal phone. Consent to be tested on any device is written into the enrolment policy. The campaign measures clicks and reports only. And coaching is private and same-day, because a fail on a personal device feels more personal than a fail on a work laptop.
| Aspect | What works on personal phones | What to avoid |
|---|---|---|
| Consent | Written BYOD testing consent at enrolment | Testing a device the staff member never agreed to have tested |
| Delivery | Email and SMS simulations, identical to real attacks | Any approach that needs an app install or MDM profile |
| Data collected | Click and report events only | Credential harvesting, device inventory, location data |
| Coaching | Branded explainer plus auto-enrolment in a short lesson | Public leaderboards naming individuals |
How the simulation actually reaches the phone
An email simulation arrives in the mail app exactly like any other message — there is nothing for the phone to detect or block, which is the point. A click opens a branded explainer page showing the email the person received and the red flags inside it, and the learner is auto-enrolled into a short failed-phishing course the same day. Anyone who does not click gets a congrats email showing the simulation they beat.
The mechanics are identical on a corporate laptop and a personal phone because phishing simulations are message-based by design. Cyber Aware keeps 100+ templates from invoice fraud to spear-phishing, refreshed against current threats, and runs no credential harvesting at any step — reporting shows who clicked and who reported, and nothing else.
What changes when the device is personal
- Consent is the gate. The enrolment policy states that simulations may be delivered to any device, work or personal. Staff see that sentence before the first campaign.
- Privacy is the constraint. Reporting stays at click-and-report level. Nothing instruments the phone itself — no app, no profile, no reading of contacts or messages.
- Tone matters more. A fail on a private phone feels like a personal failure. Same-day short lessons and private reporting keep the moment constructive.
- SMS is where phones differ most. Texts live on personal phones far more than on desk-bound laptops, so the smishing variant of the programme is mostly a personal-device programme by default.
The SMS variant: smishing on personal phones
If the phishing programme tests email, the phone programme tests SMS. A smishing simulation sends a realistic text — a courier delivery fee, a payment-card lock, a bank security alert — and measures who taps the link. The reflex being trained is the same one email simulations train: pause, check the sender, report instead of tap.
The 2026 case for smishing is arithmetic. ASD logged one cybercrime report every six minutes in FY2024-25, and text-based scam volume keeps climbing with it. A programme that never tests the phone leaves the fastest-growing channel untrained.
Why BYOD simulation practice varies
- Whether the BYOD policy covers testing at all. Some policies govern device security only; if testing is not named, add it before the first personal-device campaign.
- Privacy obligations. Australian organisations handling personal information under the Privacy Act need the collection to be minimal and disclosed — click events on a simulation are about as minimal as testing data gets.
- SMS sender registration and carrier filtering. Registered sender IDs and correct opt-out wording keep simulations deliverable and compliant with carrier rules.
- Whether the platform harvests credentials. A credential-harvesting simulation on a personal phone is both a trust failure and a data-minimisation problem. Pick a platform that does not do it.
- Reporting granularity. Per-learner trends for the security owner, never named public results — the difference between coaching and humiliation.
How to run a personal-phone simulation in 2026
- Put the consent in writing at enrolment. One sentence in the enrolment policy: simulations may arrive on any device, work or personal.
- Choose lures that mirror real traffic. Invoice fraud, payment-card alerts, unusual sign-in notices, tax-refund texts — the templates staff already see on their phones.
- Send like an attacker. Mid-morning, mid-week, from a display name that matches a real colleague or a real service.
- Measure clicks and reports, nothing else. No credential capture, no device telemetry.
- Auto-enrol clickers into a short same-day lesson. The moment a fail becomes a lesson, the personal phone stops feeling like a trap.
- Report the trend, not the name. Per-learner movement belongs in human risk reporting visible to the security owner — never on a wall.
Run the email and SMS variants on the same monthly cadence, and the personal-phone programme costs nothing extra to operate.
Related questions admins ask
Is it legal to send a phishing simulation to an employee's personal phone?
In Australia, yes, when consent is written, the collection is minimal and the purpose is disclosed. The risks come from harvesting credentials or instrumenting the device, not from sending a message.
What happens if someone clicks on their personal phone?
The same thing that happens on a work device: a branded explainer, auto-enrolment into a short failed-phishing course, and a private log entry. Nothing is installed and no credential form appears.
Do we need mobile device management to run simulations on BYOD?
No. Delivery is ordinary email and SMS. If a vendor needs an app or profile to reach the phone, it is collecting more than a simulation needs.
FAQ
Can phishing simulations be run on staff personal phones? Yes. A simulation is an email or SMS like any other, so it reaches personal phones without any agent or enrolment profile — provided consent is written, collection stays at click-and-report level and coaching stays private.
Is BYOD phishing testing allowed in 2026? Yes, when the enrolment policy names it, the data collected is minimal and staff are told what happens on a click before the first campaign.
Do phishing simulations capture passwords? No, on a properly built platform. Reporting shows who clicked and who reported — which is everything a training programme needs without collecting anyone's credentials.
What is a smishing simulation? A phishing simulation delivered by SMS. It tests the tap-versus-report reflex on the channel that mostly lives on personal phones.
How often should simulations run? Monthly. A once-a-year test teaches nothing about the reflexes a real attack needs, and a monthly cadence keeps both email and SMS variants maintained.
Can staff see their own simulation results? Yes — each learner sees their own history and score on their dashboard, while org-wide results stay with administrators.
One last thing
The biggest BYOD risk is not the phone — it is the dashboard. The moment a learner believes their personal device is being instrumented, the programme loses the trust it runs on. Measure behaviour, not devices, and say so in the policy.