Phone Stolen? What to Do in the First Hour

1. First five minutes: Locate and remotely lock it

Open the device maker’s recovery service yourself rather than following a message or search advertisement. For an iPhone, use Find My on another Apple device or type icloud.com/find into a browser. Apple’s Find Devices sign-in path can let you proceed without the verification code sent to your missing phone; look for that option if prompted. For Android, use Google’s Find Hub app or google.com/android/find.

Select the missing device and activate Apple’s Lost Mode or the available Android lost-device or lock option. These generally lock the screen and can display a contact message. Availability depends on prior setup, the device and its connection. An offline phone may show its last location, while a lock command waits for connectivity. Seeing a map pin does not prove the lock succeeded.

If you cannot immediately access your account, check whether a previously enabled remote-lock feature offers another route. Some Android devices support Remote Lock through android.com/lock, subject to eligibility and setup requirements. Do not spend the whole hour troubleshooting one sign-in screen while your phone number and email remain exposed.

• Use a safe alternate callback number in the lock-screen message, not your home address.
• Save screenshots of the location, device details and command status for your records.
• Never confront a suspected thief; give useful location information to police instead.

2. Next: Protect your phone number with the carrier

After submitting the lock request, contact your wireless carrier through its official website, app, store or a number on your bill. Report the theft and ask it to suspend service on the missing SIM or eSIM. Explain that you need to keep your number, not cancel the line. Losing that number could make account recovery much harder.

There is a trade-off: suspending cellular service may reduce the phone’s ability to receive remote commands or report its location, although Wi-Fi and supported finding networks may still help. That is why sending the lock request first usually makes sense. But if someone is already receiving your codes or using the line, prioritize stopping that access. Do not wait indefinitely for a lock confirmation.

Ask about transferring your number to a replacement SIM or eSIM you control, adding or changing the carrier account PIN, and enabling available number-transfer protections. A carrier suspension does not sign the phone out of apps or disconnect it from Wi-Fi. Ask about IMEI blocking as a separate measure; it is not a remote wipe, and its reach varies.

• Ask whether existing port-out or number-transfer requests are pending.
• Record the suspension time, case number and any replacement activation instructions.
• Confirm billing and device-payment obligations; suspension does not necessarily stop charges.

3. Secure email, then the accounts that control the phone

Your primary email is a high-priority target because it receives password resets for other services. From a trusted device, change its password to a unique one and inspect recent security activity. Explicitly revoke the stolen phone’s email sessions where the provider allows it. A password change alone does not reliably terminate every app session or previously authorized connection.

Check recovery phone numbers and addresses, forwarding rules, filters, delegated access and connected apps. An intruder could quietly forward mail or hide bank alerts rather than immediately lock you out. Remove changes you do not recognize. If your authentication app was on the phone, use an existing trusted device, security key or stored recovery code. Never send a recovery code to someone offering help.

Next, review your Apple Account or Google Account and your password manager. If the thief may know the device passcode, assume saved credentials and account settings could be at risk despite built-in theft protections. Change exposed credentials and use each service’s stolen-device security guidance. Distinguish revoking account sessions from removing the phone from its finding service; removing it there can have different consequences. If a work or school account was present, alert IT promptly so it can revoke access or manage the device.

4. Check cards, banking apps and payment services

Open financial accounts from a trusted device and look for unfamiliar purchases, transfers, new payees or changes to contact information. Check mobile wallets, banking apps, payment services and shopping accounts with saved cards. Start with accounts that were open on the phone or could be accessed using its passcode, email or text messages. An empty transaction list is reassuring, but it is not proof that access is secure.

Apple’s Lost Mode suspends supported Apple Pay payment cards and passes on the device. Other wallet protections depend on the platform, device and payment type. Do not assume a screen lock or carrier suspension disables every payment route. Contact the issuer using its official app, website or the number on your physical card, and ask specifically about the stolen device’s wallet token as well as the underlying card.

Report unauthorized activity immediately and ask how to submit a formal dispute. Debit-card and electronic-transfer protections can depend on what happened and how quickly you report it; credit-card rules differ. A temporary card lock may not stop all recurring charges, previously authorized transactions or account transfers. Follow the institution’s fraud instructions rather than relying solely on a lock toggle.

5. Decide carefully about remote erasure and device removal

Remote erasure can protect information when recovery seems unlikely or exposure is severe. Consider it sooner if the thief knows your passcode, sensitive information is accessible, or your employer requires it. But first understand what the service says will happen. Erasure can permanently destroy local photos, messages and files that were never backed up. Checking an existing backup does not guarantee the missing phone’s newest data is included.

Erasure also affects finding features differently. Apple says supported iPhones running iOS 15 or later can still be located after erasure through Find My. Google says a device’s location will no longer be available in Find Hub after erasure. Capabilities and command timing depend on the device and connection, so read the confirmation screen. A queued erase is not proof that data has been deleted.

Do not confuse erasing with removing the device from your account. On an iPhone, removing it from Find My removes Activation Lock, making resale or reuse easier for whoever has it. Keep it linked even after erasure, and follow any theft-claim requirements before changing its status. Android reset protection has different rules and should not be assumed equivalent. Avoid ownership-removal actions you do not understand, especially at a stranger’s request.

6. Before the hour ends: Document the theft and notify others

Once immediate access is contained, make a short incident record: when and where the phone disappeared, whether it was unlocked, whether anyone knew the passcode, and what you have already done. Save security alerts and suspicious transaction details. Find the serial number and IMEI in the original packaging, receipt, carrier records or device account if available. Keep those identifiers private rather than posting them with a public appeal.

Report the theft to local police through the appropriate nonemergency channel unless there is an emergency. Ask for the report number. Location data may help an investigation, but an apartment-building pin or last-seen address does not identify a thief. Do not visit it yourself. If you have device insurance or purchase protection, check reporting deadlines, deductibles and documentation requirements without assuming theft is covered.

Notify your employer if work information was accessible. Warn close contacts if someone could impersonate you through messages or social accounts, particularly to request money. Use another trusted channel and keep the warning factual. If you discover broader identity misuse, use IdentityTheft.gov for a recovery plan; a stolen handset alone does not automatically mean you need every identity-theft remedy.

7. Expect convincing messages saying the phone was found

Recovery scams can arrive minutes, days or weeks later. A text or email may claim to be from Apple, Google, the carrier, police or someone who bought your phone. It may include a plausible model, location or screenshot, then ask you to sign in to see where the device is. Those details do not authenticate the sender. Open the official finding service independently instead.

Other messages demand that you erase the device or remove it from your account, sometimes with threats or promises of payment. Removing an iPhone from Find My can release Activation Lock; it is not a necessary favor for an innocent buyer. Preserve threatening messages, stop engaging and report credible threats to police. Do not surrender ownership protections because someone creates urgency.

• Never disclose your device passcode, account password, recovery key or verification codes.
• Do not scan a stranger’s recovery QR code or install remote-access software.
• Verify any claimed police contact through the agency’s independently published number.
• On borrowed equipment, sign out when finished and do not save passwords or mark it trusted.