Applying for a business loan on your phone, safely

Most online business loan journeys now happen on a phone. The enquiry, the ID selfie, the bank connection and often the e-signing all work beautifully on a small screen. That convenience is real. So are the risks if the phone is out of date, unlocked or full of old statements. Ten minutes of preparation makes your phone a safe place to borrow from.

What should you do before you start?

Check	Why it matters	How
Update software	Updates fix security holes	Settings, then software update; update apps too
Lock the phone	A lost unlocked phone is an open filing cabinet	Strong passcode plus face or fingerprint unlock
Two-factor authentication	Stops someone using a stolen password	Turn it on for email, banking, Xero or MYOB, and myIR
Check your email security	Email is the key to resetting everything else	Unique password, two-factor, check forwarding rules
Free up storage	Uploads fail on full phones	Clear old downloads and duplicates

These match the first things the National Cyber Security Centre’s Own Your Online service recommends for businesses: install updates, use two-factor authentication, secure your devices.

Which network should you use?

For anything sensitive — banking, open banking approvals, document uploads, e-signing — use mobile data or a trusted network such as your home or office Wi-Fi. Open public Wi-Fi in cafés, airports and hotels is convenient but not the place to handle statements and ID. If you are on the road, a few minutes on mobile data is the safer choice.

How do you make sure you are on the real site?

• Type the address or use a saved bookmark rather than tapping links in texts and emails.
• Check the domain letter by letter, especially on a small screen where long addresses are cut off. Tap the address bar to see it in full.
• Look for https and a padlock — necessary, but not sufficient; scam sites can have them too.
• Install apps only from official stores, and check the developer name.

Our online loan scams page shows the common tricks used to get people onto fake sites.

Ready to start? Our enquiry works on any phone and never asks for passwords.

How do you handle documents on a phone?

Phones make it easy to download statements from your banking app or myIR and upload them to a portal. They also make it easy to leave those files lying around.

1. Download only what is needed for the request.
2. Upload through the secure portal only. See uploading documents securely.
3. Check what synced. Photos and downloads may copy automatically to cloud storage. Make sure that account is protected with two-factor authentication.
4. Tidy up afterwards. Delete downloaded statements and ID photos from the phone once uploaded, unless you keep them in a secure business records folder.
5. Do not screenshot sensitive screens unless you need to, and delete them after.

What about the ID selfie and e-signing steps?

Both work well on phones. For the ID check, find good light and a plain background. For e-signing, read the documents on a bigger screen first if you can, then sign on the phone if that is convenient. Zoomed-out phone reading makes it easy to miss key clauses.

What if your phone is lost or stolen mid-application?

1. Use your phone provider’s or manufacturer’s tools to lock or erase it remotely.
2. Change passwords for email, banking and accounting from another device.
3. Tell your bank and your loan specialist.
4. Watch your accounts for unusual activity.

Worked example (illustrative): a Napier mechanic does his loan enquiry, ID check and bank connection on his phone between jobs. Before starting, he installs a pending update and turns on two-factor authentication for his Gmail, which handles his business email. When a fake “verify your loan” text arrives two days later, he recognises it — the real messages came from his specialist’s saved number — and deletes it.

Does a phone make you a bigger target?

Not inherently. Modern phones are well protected when kept updated and locked. The bigger risk is the convenience of tapping links in messages. Slow down at every link, and verify anything unexpected through a number you already have.

Should a staff member apply on the business’s behalf?

Office managers and bookkeepers often do the legwork, and that is fine for gathering documents. But some steps must be done by the people themselves: each director’s ID check, each guarantor’s signature and any open banking approval in an account they control. Sharing your phone or passcode with a colleague so they can “just do the selfie bit” defeats the purpose of identity checks and can stall an application. Agree in advance who uploads what, keep logins personal, and make sure everyone involved knows the only genuine contact is the specialist’s saved number. If a staff member leaves, remove their access to business email and accounting software the same day.

Which apps are worth having ready?

Before you begin, make sure the phone already has the apps you will need, downloaded from the official store and signed in: your bank’s app (for statements and open banking approvals), your accounting app if you use one, an authenticator app for two-factor codes, and a PDF viewer. Having them ready avoids the temptation to install something in a hurry from a link in a message.

Start on your phone, in about a minute

The enquiry is built for small screens. It does not involve a credit check, your details stay with one team instead of being handed to a line of lenders, and a real specialist reads it and calls. Fill it in carefully — accurate amount, purpose and property — and the rest of the process will run smoothly from the same device. See if you qualify.