A stolen phone is one of those situations where the decisions you made before it happened determine almost everything. If you’ve set things up right, you can remotely wipe the device, protect your accounts, and file a police report with a serial number in hand. If you haven’t, you’re in a much worse position. Here’s what to do — and what to set up now while you still have time.
Immediately: remote lock and locate
The first priority is preventing access to whatever’s on the phone. On another device or computer:
iPhone: Go to icloud.com/find or use the Find My app on another Apple device. Select your iPhone from the list. Choose “Mark as Lost” — this locks the device with your passcode, displays a message with a contact number, and activates Lost Mode which tracks the phone’s location. If you’ve given up on recovering it, choose “Erase iPhone” to wipe it remotely.
Android: Go to android.com/find or google.com/android/find. Log in with the Google account associated with the phone. You’ll see options to play a sound (if it might be nearby), secure the device (locks with your PIN), or erase the device.
These only work if Find My / Find My Device was enabled and the phone was connected to a network. Enable them now before anything happens: on iPhone, Settings → [your name] → Find My → Find My iPhone → on. On Android, Settings → Security → Find My Device → on.
Change passwords on high-value accounts
A thief with a phone has access to any account where you were logged in and any account that sends SMS recovery codes to your number. Change passwords on your email, banking apps, and any financial services immediately. Sign out all sessions, not just reset the password — look for a “Sign out all devices” option in your account settings.
Your email is the highest priority — it’s used to reset passwords for everything else. If your email app was open and you weren’t using Face ID or fingerprint to access it, consider that your email may already be compromised. Change the password and check for forwarding rules and auto-replies that could have been set up.
Contact your carrier
Call your carrier immediately to report the phone stolen and suspend the service. This prevents someone from running up charges and — critically — prevents SIM swapping. A sophisticated thief who calls your carrier pretending to be you can transfer your number to a new SIM, which lets them receive your SMS authentication codes for account recovery.
Ask the carrier to put a port freeze or SIM lock on your account, which prevents number transfers even with your account information. Many carriers offer this as a free security feature that most people don’t know about.
File a police report
File a police report even if you don’t expect the phone to be recovered. You’ll need it for an insurance claim. You’ll also need your phone’s IMEI number — a unique identifier that carriers use to block stolen phones from being activated. You can find it in your account on the carrier’s website, in your phone’s original packaging, or in Settings → General → About (iPhone) or Settings → About phone (Android). Note it now and store it somewhere other than the phone itself.
Revoke access to apps that were logged in
If your phone had apps logged in that access sensitive data — banking apps, password managers, authenticator apps — revoke those sessions from the web interface of each service. For your password manager, emergency-change the master password from another device, which should invalidate the session on the stolen phone.
Check which apps were using Face ID or fingerprint unlock. Any app that used biometrics — not a PIN — could potentially be accessed by someone who manipulates your face or finger (unlikely but relevant if the theft was targeted). For high-value apps, revoke and re-authenticate from a new device.
What to set up now
Enable Find My / Find My Device. Use a strong passcode, not a four-digit PIN. Require the passcode immediately (not after 30 seconds or more). Enable remote wipe capability. Note your IMEI number somewhere accessible. Use Face ID or fingerprint for app access, not just device unlock. Store your carrier’s customer service number somewhere other than the phone — you’ll need to call them when you can’t access the phone.
The bottom line
The first ten minutes after a phone is stolen determine most of the damage. If Find My is on and you can remote-lock quickly, your data is probably safe. If your carrier account is secured against SIM swaps, your SMS 2FA codes are protected. Do the setup now so those options are available when you need them.