Lost or stolen smartphone: regaining control in the right order

Losing a smartphone is not simply losing a device. The phone receives login codes, opens the mailbox, holds the banking applications, confirms certain transactions with itsme, and sometimes serves as the key to work accounts.

You have to act fast, but in the right order. Blocking the SIM card immediately may be necessary. Yet if the device is merely mislaid, locating it or calling it may still bring it back. The situation, the screen lock and the risk of theft determine the priority.

First question: lost, or probably stolen?

Think back over the last few minutes. Could the device have been left on a train, in a restaurant or at an office? Could someone have watched you enter your code? Was your bag opened?

If the phone appears on a map in an unfamiliar place, do not travel there to confront anyone. Keep the location and pass it to the police.

If you believe the phone is nearby and properly locked, call it from another number. Then use the device's official location feature to make it ring or display a contact message.

Lock remotely before you erase

The official Apple and Google services allow a device to be located, locked or erased, provided they were switched on beforehand.

Start with lost mode or remote locking. That step protects access while leaving a chance of recovering the device. Erasing remotely becomes relevant when recovery looks unlikely or when the data present a significant risk.

After an erase, locating the device may become impossible, depending on the device and its configuration. So take the time to save the useful information before triggering that step.

Do not use a link received by SMS or email claiming to show the phone's position. Thieves sometimes send fake location messages in order to obtain the password to the Apple or Google account.

Secure the mailbox first

The mailbox is what allows many other accounts to be reset. From a device you trust:

• change the password if the phone could open the mailbox;
• revoke active sessions;
• check the recovery methods;
• review the forwarding rules;
• examine the sign-in alerts;
• switch on a second factor that does not depend solely on the lost phone.

If you use a password manager that was accessible on the phone, secure its main account and revoke the lost device.

Block itsme and the banking applications

itsme states that an account must be blocked immediately when the device is lost or stolen. The account can be reactivated later on a new phone.

Also contact your bank through its website or its official number. Card Stop recommends having payment applications blocked when a mobile device is lost or stolen. Monitor transactions and report any approval you do not recognise.

Do not give any code to someone who calls you after the loss. A fraudster may pose as the bank, itsme, Card Stop, the police or the mobile operator.

Hang up and call the institution back yourself, using a number obtained from its official website.

Contact the mobile operator

The operator can block the SIM card to prevent it being used. That step limits calls, text messages and certain resets that rely on the number.

Also ask what protections exist against a fraudulent SIM swap. When you receive a new card, check that the old one really has been deactivated.

Blocking the SIM does not necessarily lock the phone and does not erase its data. It complements the location and remote-locking measures.

Preparing the theft report

In the event of theft, report it to the police. Have ready:

• the make and model;
• the phone number;
• the SIM card number if you have it;
• the IMEI number;
• the place and approximate time;
• the location information you saved;
• a description of the device and its case.

The IMEI number is usually on the box, on the invoice, or in your operator's customer area. It is worth noting it down before any incident occurs.

Keep the report certificate. Your insurer or operator may ask for it.

Work accounts and employer data

Alert your employer quickly if the phone holds a work mailbox, a VPN, documents or an authentication application.

The organisation can then:

• revoke the device in its cloud services;
• remove the work profile remotely;
• change the secrets involved;
• review the sign-ins;
• assess whether personal data have been exposed.

Do not delay reporting out of fear of a sanction. A device reported within minutes is far simpler to deal with than an unknown sign-in discovered several days later.

After recovery

A phone that has been found should not be treated as safe without checks once it has left your control.

Check:

• the installed applications;
• the configuration profiles;
• the registered biometric methods;
• the accounts added;
• the forwarding settings;
• the security alerts;
• the transactions carried out while it was gone.

Update the system. If the device was unlocked or tampered with, ask for a reset and a controlled restore.

Prepare the five useful details today

Keep, away from the phone:

1. the Apple or Google account identifier;
2. the IMEI number;
3. the operator's number;
4. the bank's official number;
5. the recovery codes for your essential accounts.

Switch on a sufficiently long screen code, biometrics, location and backups. Above all, check that you know how to open the recovery tools from another device.

A protection you cannot use without the lost phone is not yet a complete protection.

Official sources

• Safeonweb - I have lost my smartphone or tablet
• itsme - Device lost or stolen
• Card Stop - Blocking a banking application
• Brussels-West Police - Loss or theft of a smartphone