Lost or Stolen Phone: The First Hour
Your phone is your second factor, your password manager, your email, your bank and your wallet. When it goes missing, the first hour isn't about the phone. It's about everything the phone can open.
Most people who lose a phone spend the first hour retracing their steps. That's the wrong hour to spend that way. A locked, tracked phone can wait under a restaurant table for a day. An open email account can't wait fifteen minutes.
The Short Version
From another device: mark it lost and lock it. Then protect the accounts on it, email first, and remove the phone as a trusted device. Then call the carrier and suspend the line. Then decide whether to erase it. Do those four things before you go looking for it.
The First Hour, In Order
Lock and locate it from another device
iPhone: icloud.com/find, or the Find My app on any family member's iPhone. Android: google.com/android/find. Mark it Lost (Apple) or Secure Device (Google). That locks the screen, shows a message and a callback number, switches off tap-to-pay, and keeps tracking it.
Don't go and get it
If the map shows an address that isn't yours, that's a police matter, not a doorstep visit. Give them the location and the phone's IMEI number.
Protect your email account
From a computer: change the password, then open the account's devices page and remove the phone. That signs it out. Google: myaccount.google.com/devices. Apple: account.apple.com. Microsoft: account.microsoft.com/devices.
Move your second factor
If the phone was your authenticator, switch to your backup: the recovery codes, a second device, or the authenticator app's cloud backup. Then remove the phone as a trusted device on the bank, Microsoft 365 and Google accounts. A synced passkey survives this; a text-message code does not.
Call the carrier and suspend the line
The SIM, or the eSIM, receives your text codes and can be used to take over accounts. Suspend rather than cancel, order a replacement, and while you're on the call, set an account PIN so nobody can move the number to another phone.
Banks and wallets
Lost Mode already disables the tap-to-pay cards. If you couldn't lock the phone, call the bank for any card whose app was on it, and check the recent transactions either way.
Password manager
If the phone could be unlocked (a weak passcode, no biometrics), change the master password from a computer and sign out all other sessions.
Erase it
Once you've decided it isn't coming back, erase it remotely. Recent iPhones stay locked to your Apple account even after an erase, and Android does the same with your Google account, so the phone is worthless to whoever has it. Many models still report their location afterward.
Paper trail
File a police report with the IMEI; the carrier and your insurance will both ask for it. Find the IMEI today, on the phone you still have, by dialing *#06#, and write it somewhere that isn't the phone.
Work phone: tell IT the same hour
If the phone carried company email, whoever manages it can wipe the work data remotely in seconds. Sooner is better, and it's a ticket, not a favor.
Before It Happens: Ten Minutes Today
- A real passcode, six digits at minimum, with Face ID or a fingerprint on top. Auto-lock at thirty seconds or one minute.
- Find My or Find My Device turned on, with “send last location” enabled.
- Automatic cloud backup on, so an erase costs you nothing.
- Notification previews hidden on the lock screen. A thief can read a sign-in code off a locked phone otherwise.
- Stolen Device Protection on an iPhone (iOS 17.3 and later): password changes need Face ID, not the passcode, and wait an hour when you're away from familiar places. Theft Detection Lock on Android (Android 15 and later): the phone locks itself when it senses a snatch. Both on.
- A SIM PIN, so the SIM can't be moved to another phone and used for your text codes.
- The IMEI written down.
Work Phones and Mobile Device Management
MDM is the business version of all of the above, done in advance. It enforces the passcode and encryption, keeps work email and files in a separate container, and lets IT wipe the work data, and only the work data, from a lost phone without needing the employee's Apple or Google password. It's included for one phone or tablet on our Premium plans, business and residential, with additional devices at $12/mo each.
| Situation | Do this |
|---|---|
| Left it in a restaurant | Lost Mode with a message and a callback number. Wait. Don't erase yet. |
| Pickpocketed or snatched | Lost Mode, suspend the SIM, protect email and move the second factor, police report, then erase. |
| Map shows a stranger's house | Police, not you. |
| Found it after locking | Unlock it normally; Lost Mode clears. Review the account device lists anyway. |
| Work phone | All of the above, plus IT for the MDM wipe. |
Quick Self-Check
| Question | If “no” or “not sure”... |
|---|---|
| Could you find your phone right now from another device? | Turn on Find My tonight |
| Is the IMEI written down somewhere off the phone? | Dial *#06# now |
| If the phone vanished, could you still get into your email? | Set up a second-factor backup |
| Business: could you wipe a lost work phone in five minutes? | Worth a call |
Set the Phones Up Properly
Passcodes, Find My, backups and the theft protections turned on the right way, for the whole household or the whole office, plus Mobile Device Management on Premium.
Frequently Asked Questions
Will erasing the phone stop me from tracking it?
On recent iPhones and Android phones, no. Activation Lock and Factory Reset Protection keep the phone tied to your account after an erase, and most current models keep reporting location. Erase once you've decided it isn't coming back.
Can a thief get past my passcode?
Not by guessing on a modern phone. The real risk is that they watched you type it before taking the phone, which is exactly the case Stolen Device Protection and Theft Detection Lock were built for. Turn them on today.
I got a text saying my lost iPhone has been found. Is it real?
No. Apple doesn't text you, and Find My is the only place a real location shows up. Those texts lead to a fake Apple sign-in page built to steal the account so the thief can unlock the phone.
My authenticator app was on the phone. Am I locked out?
Use the recovery codes you saved, your second device, or the app's cloud backup. Microsoft Authenticator and Google Authenticator both back up to the cloud when you let them. If none of that exists, the provider's account recovery works but takes days, which is why the backup gets set up first.
Does Mobile Device Management let my employer read my personal texts?
No. A work profile keeps the work side and the personal side separate; IT sees, manages and wipes the work side only. On a company-owned phone the whole device is managed, and a good policy says so up front.
More Guides
The sign-in method a fake login page can't steal, and how to set one up.
The first hour after a breach notice: what to change, in what order, and what to check.
The five tells, the scams hitting Tampa Bay right now, and what to do if you already clicked.
The three layers of cyber threats, and which one is actually your problem.
DNS filtering, per-device controls, and what each one misses.
California's DROP tool plus the DIY opt-out list for every other state.
📞 727-579-4335 · ✉️ support@baygeeks.com · Privacy Policy · Terms of Service