A phone may act as an access device when it is properly equipped. This is often done with software and remember an access device includes a “code” which is input into the software to provide access to an account, as an example.
Just as you warn consumers not to write their PIN on the card or to keep it with their card, banks should be advising consumers to use multifactor authentication and biometrics to protect their accounts. Many times I’ve heard the claim, “he wanted to make a call so I loaned him my phone and later I saw he transferred money…” and “I sold my old phone (or gaming system) but didn’t completely erase it and that must be how someone accessed my account.” Any bank not presenting these cautions to their customers is setting themselves up for future claims. The honest customers need these periodic reminders.