Stolen or Lost Phone: What to Do in the First Hour

A stolen phone is no longer just a lost handset: it holds the codes, apps and saved passwords that open your email, bank and social accounts, and a thief may try to use them before you react. The first hour matters most. Lock the phone remotely, protect your mobile number, tell your bank and secure your main email before anyone can reset passwords through it. This guide gives a step-by-step sequence for iPhone and Android, explains when to erase and when not to, and covers the settings that make the next theft much less damaging. It is written in plain language for anyone who owns a smartphone, and for the IT and help desk staff who support them. For setting up a phone securely in the first place, see the Securing Your Smartphone Guide.

Key takeaways

Lock first, erase later. Mark the phone as lost straight away; erasing cannot be undone and, on Android, means you can no longer locate it.
Protect your number. Ask your mobile operator to block the SIM quickly so codes sent by text cannot be received on the stolen phone or a new SIM.
Bank and email come next. Call your bank from another phone, then change your main email password and sign out other devices, because every other reset arrives there.
Do not trust "we found your phone" messages. Apple says it will never contact you to say your device has been found; these are phishing attempts to get your passcode or account password.
Prepare now. Find My or Find Hub, Stolen Device Protection on iPhone and theft protection on Android only help if they are on before the phone is taken.

The first hour, step by step

Work through these in order from another device: a family member's phone, a laptop or a friend's computer. Write down what you did and when; the police, your bank and your insurer may ask.

Lock the phone remotely (minutes 0 to 5). iPhone: use Find My on another Apple device or icloud.com/find and choose Mark As Lost. Android: go to android.com/lock and enter your phone number for Remote Lock, or sign in to Find Hub and choose Mark as lost. Add a contact number and short message for the lock screen if you think it may simply be lost.
Call your mobile operator (minutes 5 to 15). Report the phone stolen and ask them to block the SIM or eSIM and, where they offer it, the handset. Ask for a replacement SIM or eSIM so you get your number back on a phone you control. Ask whether they can add a PIN or password to your account to stop anyone moving your number. See the SIM Swap Fraud Guide.
Call your bank (minutes 10 to 20). Use the number on your card or the bank's website, not one from a message. Ask them to watch for or freeze card and online banking activity and to block mobile banking on the stolen device. On iPhone, Lost Mode suspends Apple Pay cards, but your banking app and any saved card details still need attention.
Secure your main email (minutes 15 to 30). Change the password, sign out of other sessions, and check for forwarding rules and filters you did not create, as the NCSC advises after any suspected compromise. If the email account uses the stolen phone for two-step verification, use a backup code or another factor.
Secure Apple or Google (minutes 20 to 35). Check account sign-in and security settings for changes you did not make. If you see any, change your Apple Account or Google Account password. Check trusted phone numbers, recovery email and recovery contacts.
Report to the police (within the day). Apple notes the police may ask for the serial number. In the UK, use the non-emergency 101 number or the online reporting route for your force; in an emergency, or if you were threatened, call 999 or 911. Keep the crime reference number for your insurer and operator.
Decide about erasing (when you are ready). See the next section.
Tell people who may be targeted (within the day). Thieves sometimes message contacts from a stolen phone asking for money. Let close family know.

Lock, locate or erase: what each does

Action	iPhone (Find My)	Android (Find Hub and theft protection)	When to use
Locate and play sound	Shows location if the phone is on and connected	Shows location from GPS, Wi-Fi and cell towers; sound plays at full volume for 5 minutes even on silent	Only if you think it is lost nearby; never try to recover a stolen phone yourself
Mark as lost or lock	Mark As Lost locks with your passcode, suspends Apple Pay cards and shows your message	Mark as lost locks the screen and disables notifications; Remote Lock at android.com/lock works with just your phone number	Immediately, in every case
Erase	Cannot be undone; runs when the phone next connects; keep the device in Find My afterwards so Activation Lock stays on	Factory reset deletes all data (perhaps not the SD card); the phone then no longer appears in Find Hub; reuse needs your Google password	When you are sure it will not come back, or it holds sensitive data and you have a backup
Remove from account	Apple advises not removing it from Find My or your Apple Account, especially while an insurance claim is open	Remove only once you have erased and no longer need to track it	Rarely; leaving it linked keeps the thief locked out

Why not erase straight away? Apple calls remote erase a last resort because it cannot be undone. On Android, an erased phone disappears from Find Hub. Locking already protects the data on a phone with a strong passcode; erasing mainly matters when you will not get it back. If you have AppleCare+ with Theft and Loss, Apple says to keep the device in Find My and your Apple Account until the claim is approved.

If the phone turns up again

If you get the phone back, sign in and check it before trusting it. On iPhone, entering your passcode on the device turns off Lost Mode; on Android, unlock it with your screen lock. Review the Apple or Google account device list, check for apps, profiles or faces and fingerprints you did not add, and change any passwords you had not already changed. If someone else had it unlocked for any length of time, or you see anything unexpected, back up your photos and erase it before setting it up again.

Accounts to secure, in priority order

Priority	Account	What to do	Why
1	Mobile number	Block SIM or eSIM, get a replacement, add an account PIN	Text codes and calls for many services go to this number
2	Banking and payment apps	Call the bank, freeze cards if needed, sign out mobile banking	Direct route to money
3	Main email	New password, sign out all sessions, check forwarding and filters	Password resets for almost everything arrive here
4	Apple Account or Google Account	Check security settings and trusted devices; change password if anything changed	Controls Find My or Find Hub, backups, saved passwords and passkeys
5	Password manager	Sign out the stolen device, change the main password if the phone was unlocked when taken	Holds every other password
6	Messaging and social accounts	Sign out other sessions, warn contacts	Used to ask your contacts for money
7	Work accounts	Tell your IT team the same day	Work email, MFA apps and company data may be on the phone

If you used an authenticator app only on the stolen phone, use backup codes, a security key or another device to sign in, then move two-step verification to the new phone. Planning these routes in advance is covered in the Account Recovery Planning Guide.

Was the phone unlocked when it was taken?

A phone snatched while unlocked, or after the thief watched you type your passcode, is much more dangerous than one taken locked. The thief may try to change your Apple or Google password, turn off Find My, add their own face, or open banking apps. Treat it as urgent.

iPhone with Stolen Device Protection: away from familiar places such as home and work, Apple requires Face ID or Touch ID, with no passcode fallback, to use saved passwords and passkeys, use saved payment methods in Safari, turn off Lost Mode, erase the phone or set up an eSIM. Changing the Apple Account password, signing out, changing the passcode or turning off Stolen Device Protection also needs a one-hour security delay and a second biometric check. That hour is your window: use it.
Android theft protection: Theft Detection Lock uses motion sensors to lock the screen if someone grabs the phone and runs, rides or drives away; Offline Device Lock locks the screen if the phone is used offline for a while; Identity Check requires fingerprint or face for sensitive actions outside trusted places. Remote Lock at android.com/lock can be used twice in 24 hours.
Without these features: assume the thief can reach anything on the phone. Change the passwords of your main email, Apple or Google account, bank and password manager from another device straight away, before you do anything else on the list.

Scams that follow a theft

"Your phone has been found": texts or emails, sometimes looking like Apple or Google, with a link to a fake sign-in page. Apple says it will never contact you to tell you your device has been found, and to never share your passcode, password or verification codes.
Calls asking you to remove the phone from your account: the thief wants Activation Lock or Find Hub off so they can resell it. Do not do it.
Bank "fraud team" calls: if a caller asks for a code or tells you to move money, hang up and call your bank on its published number. See the Impersonation Scams Guide.
Messages to your contacts: "new number, lost my phone, can you send money?" Warn family that you will never ask for money that way.

Set up now so the next theft is a nuisance, not a disaster

Setting	iPhone	Android
Find your phone	Find My on (Settings, your name, Find My)	Find Hub on and signed in
Theft protection	Stolen Device Protection (Settings, Face ID and Passcode); consider Require Security Delay: Always	Settings, Google, All services, Theft protection: Theft Detection Lock, Offline Device Lock, Remote Lock, Identity Check where supported
Strong passcode	At least six digits, as the FTC advises; longer or alphanumeric is better	Same
Backups	iCloud Backup or a computer	Google backup or a computer
Recovery without the phone	Recovery contact and a second trusted number	Printed backup codes, recovery email
Know your details	Note the serial number and IMEI somewhere other than the phone	Same

Other habits help: shield your passcode in public, keep the phone out of reach when using it at the roadside, and set a SIM PIN so a removed SIM cannot be used in another phone without it. Passkeys stored in iCloud Keychain or Google Password Manager survive the loss of a phone because they sync to your other devices. See the Passkeys for Everyone Guide.

For employers and IT teams

A stolen phone is often also a work device or holds work accounts. Staff should know to report it the same day, and the help desk should have a short runbook.

Revoke, not just wipe: sign the device out of the identity provider, revoke refresh tokens and app sessions, and remove it as an MFA method; a remote wipe through device management alone does not end sessions already issued. See the Account Takeover Response Playbook.
Verify before re-enrolling MFA: a caller saying "I lost my phone, please reset my MFA" is the classic help desk social engineering pretext. Use a strong identity check. See the Account Recovery and Help Desk Security Guide.
Selective wipe for personal phones: use app protection or work profiles so company data can be removed without erasing personal data.

Control area	NIST CSF 2.0	NIST SP 800-53 Rev 5
Lost authenticators and MFA re-enrolment	PR.AA-01	IA-5 Authenticator Management
Remote lock and wipe of mobile devices	PR.PS-01	AC-19 Access Control for Mobile Devices
Staff awareness of the reporting route	PR.AT-01	AT-2 Literacy Training and Awareness
Handling the incident	RS.MA	IR-4 Incident Handling

Metrics: time from loss to report; time from report to session revocation; share of devices enrolled in device management with remote lock; share of staff with a second MFA method; and help desk MFA resets completed with a verified identity check.

Common failure patterns

Erasing in panic: wiping before locking, then losing the ability to track the phone, and sometimes removing it from the account so the thief can reuse it.
Forgetting the SIM: locking the phone but leaving the number active, so text codes still arrive on the stolen SIM.
Email last: securing apps one by one while the thief resets them through your email.
Phone as the only way in: passkeys, authenticator and recovery number all on one handset, with no backup codes or second device.
Falling for the "found it" message: entering an Apple Account password on a fake page days after the theft.
Features never switched on: Find My, Find Hub, Stolen Device Protection and theft protection cannot be enabled after the phone is gone.

Practitioner checklist

Mark the phone as lost or use Remote Lock straight away from another device.
Call your mobile operator to block the SIM and get a replacement.
Call your bank on its published number and freeze cards if needed.
Change your main email password, sign out other sessions and check forwarding rules.
Check Apple or Google account security settings and change the password if anything changed.
Report to the police and keep the reference for your operator and insurer.
Erase only when you are sure the phone will not come back, and keep it linked to your account afterwards.
Ignore any "we found your phone" message, and warn your contacts.
On your next phone, turn on Find My or Find Hub, theft protection, backups and recovery options on day one.