Phone Lost or Stolen? How to Lock Down Your Identity

Your phone is gone. Maybe you left it in a cab, maybe someone lifted it out of your hand at a crosswalk. Either way, the first thing most people worry about is the wrong thing. You’re thinking about the cost of the device. I want you thinking about the SIM card and the apps you left signed in.

Here’s the reality after twenty years watching identity fraud from the inside. A modern phone isn’t a phone anymore. It’s the master key to your whole digital life. Your email lives on it, already logged in. Your authenticator app lives on it. The text-message codes that banks and everyone else send to confirm it’s really you land on the SIM inside it. Whoever ends up holding your phone doesn’t need to crack a single password to do damage. They need your phone to do most of the work for them.

So a lost or stolen phone is an account-takeover event, not just a hardware loss. Account takeover just means someone getting into accounts that are yours by using access you already set up. The good news is that if you move in the right order in the first hour, you can shut the door before anyone gets through it. Let me walk you through that order, and why it matters.

First, Understand What You Actually Lost

Before the steps, a quick picture of the exposure. This is what makes the sequence make sense.

Two things on your phone are worth more to a criminal than the phone itself. The first is the SIM, the small chip (or these days, the built-in eSIM) that ties your phone number to the network. As long as that SIM is active and in their hands, any security code texted to your number goes to them, not you. The second is every app you left signed in. Email, banking, your password manager, social accounts. If the screen is unlocked, those are just sitting there open.

That’s why the resale value of the device is a footnote. The exposure is the SIM and the unlocked apps.

Now, there are really two situations you could be in, and they carry very different risk.

They have your phone, but not your passcode. This is the more common and more recoverable case. A modern iPhone or Android with a decent passcode and biometrics is genuinely hard to break into. The thief mostly has a locked brick they’ll try to wipe and resell. Your job is to lock it down and cut off the SIM before they get lucky.

They have your phone and your passcode. This is the one that keeps me up. It happens more than people think, usually because someone watched you type your code in a bar or on the subway, then took the phone a few minutes later. Once someone has your passcode, they can get into the apps, and on older setups they could even change the password on your Apple or Google account from the device itself. If this is you, you need to move faster and go straight to changing your account passwords from another device. More on defending against this below.

Figure out which situation you’re in. Then start.

The First Hour, in the Order That Matters

1. Lock and locate the device from somewhere else

Get to another device fast. A laptop, a tablet, a family member’s phone. Sign in to Find My iPhone (iCloud.com/find) or Android’s Find My Device (android.com/find) and put the phone in lost mode. That locks the screen, shows a message with a callback number, and keeps location tracking on.

Lock first, don’t erase yet. A locked phone can still be located, and lost mode preserves your ability to track it and prove where it went. Erasing is the last resort, for when you’ve given up on recovery or you know sensitive data is exposed. On both platforms, erasing remotely does not remove the account lock that stops the thief from reusing the device, so you lose nothing security-wise by trying to locate it first.

One caveat. If someone has your passcode, remote lock buys you less, because they may be able to undo it from the phone. In that case, do this step, then move immediately to step 3.

2. Suspend the line to kill the SIM

Call your carrier and tell them your phone was lost or stolen. Ask them to suspend the line. This is the step most guides bury, and it’s the one that cuts off the text-message codes flowing to the thief. The moment the SIM is dead, so is their ability to intercept your SMS verification.

While you’re on the phone, ask them to block the device by its IMEI, the unique serial number for the hardware. Blocking the IMEI keeps the phone from being reactivated on the network, even with a new SIM. If you have an eSIM, the built-in kind with no physical chip, the carrier can still suspend and re-provision it to your replacement phone. You don’t have to physically recover anything.

Get a reference number for the call and, if you can, written confirmation. You may need it later.

A quick note on why speed matters here. Suspending the line is not the same as a SIM swap, and I’ll come back to that. Right now you’re closing the window where the codes go to them.

3. Change passwords on the accounts the phone could unlock

From that same other device, start resetting passwords. Order matters here too.

Start with the master account, meaning your Apple Account (formerly Apple ID) or your Google Account. That account can control the phone, your backups, and often the recovery path for everything else. Change it, and choose the option to sign out of all devices. Signing out is the part people skip, and it’s the part that actually revokes the access tokens sitting on the stolen phone. A password change alone doesn’t always kick an already-logged-in app off the device. Signing everything out does.

Then move to email, since email is the recovery route for nearly every other account you own. Then your bank and any payment apps. Then the social accounts. If you find signs someone already got into your inbox, our guide on recovering a hacked email account covers the cleanup.

If your phone was your only two-factor authentication device, meaning the only place your login codes or authenticator app lived, don’t panic. This is exactly what backup codes are for. Most services let you set them up in advance and use them to get back in when your usual device is gone. If you never saved backup codes, each service has an account-recovery path. It’s slower and more of a hassle, which is the best argument I know for setting up backup codes before you ever need them.

4. Watch for the follow-on

You’ve contained the immediate damage. Now stay alert for two things that tend to come next.

The first is a phishing attempt dressed up as help. Phishing just means a fake message built to trick you into handing over a password or a code. Within a day or two of a phone theft, a lot of people get a text or email claiming to be from Apple or Google saying their lost phone has been found, click here to see the location. It’s fake. It’s the thief trying to get the account password so they can unlock the device you locked. Real lost-device notifications show up inside your account, not as a random link in a text. Don’t click it. If you already tapped something like this, here’s what to do after clicking a phishing link.

The second is a SIM-swap attempt, which I’ll cover in its own section, because it’s the move a determined attacker makes after the easy path closes.

If It’s an iPhone

Apple’s tools are built around your Apple Account, so protecting that account is the whole game.

Find My iPhone is what you used in step 1 to lock and locate. When you mark the phone as lost, Activation Lock kicks in automatically. Activation Lock ties the device to your account so it can’t be erased and set up by someone else without your credentials. It’s the reason a stolen iPhone is mostly worth parts, and it’s why the thief may try to phish your password out of you.

There’s one more feature worth knowing about, and it’s the best defense against the passcode problem. It’s called Stolen Device Protection, introduced in iOS 17.3. When it’s on and you’re somewhere unfamiliar, meaning not your home or work, changing sensitive settings requires Face ID or Touch ID with no passcode fallback. And the most sensitive actions, like changing your Apple Account password or turning the feature off, require your biometrics, then a one-hour wait, then your biometrics again. That security delay is designed to give you time to mark the phone lost before a thief who knows your passcode can lock you out of your own account. If you haven’t turned it on, do it on your next phone. Settings, Face ID and Passcode, Stolen Device Protection. It’s the single best switch Apple has added for this exact situation.

If It’s an Android

Google’s tools work the same way in spirit, tied to your Google Account.

Find My Device (android.com/find) is your lock-and-locate tool. If the phone is offline or powered off, newer Android phones can still be found through Google’s network of nearby devices, similar to Apple’s approach.

Google also added a remote lock you can trigger from any browser at android.com/lock using just your phone number and a quick security check. It’s faster to reach than the full Find My Device flow when you’re panicking, so it’s worth remembering. Factory Reset Protection does for Android what Activation Lock does for iPhone. It stops someone from wiping the phone and setting it up as their own without your Google credentials.

Recent Android versions have layered on more automatic theft defenses: Theft Detection Lock, which uses the phone’s sensors to lock the screen if it detects the motion of a snatch-and-run, and Identity Check, which requires your biometrics for sensitive account changes when you’re away from trusted locations. Same idea as Apple’s Stolen Device Protection. If you’re on Android 15 or later, turn Identity Check on. Settings, Google, then look under theft and device protection.

The Passcode Problem, and How to Stay Ahead of It

I keep coming back to the passcode because it’s the real exposure, and almost no carrier or manufacturer help page talks about it honestly.

If a thief knows your passcode, biometrics and remote-lock features matter less, because the passcode is the master override for most of them. The defenses above (Stolen Device Protection on iPhone, Identity Check on Android) exist specifically to blunt this, by demanding your face or fingerprint for the actions that would let someone take over your account. Turn those on and they’re worth real money in a moment like this.

The behavioral fix is just as important and it’s free. Cover your screen when you type your passcode in public, the same way you’d cover a PIN pad at an ATM. Use a long alphanumeric passcode instead of a four-digit PIN, because a six-character mix of letters and numbers is far harder for someone to catch over your shoulder. Lean on Face ID or fingerprint for everyday unlocking so your passcode gets typed in public as rarely as possible. None of this helps you after the fact, but it’s the difference between the recoverable situation and the nightmare one next time.

The SIM-Swap Follow-On

Here’s the move a serious attacker makes once you’ve suspended your line. They call your carrier, impersonate you, and try to get your number transferred to a SIM they control. That’s a SIM swap, and its whole purpose is to get your text-message codes flowing to them again after you cut off the original SIM.

The good news is that this got harder in 2024. Federal rules that took effect in July of that year now require wireless carriers to use secure customer authentication before they’ll change your SIM or port your number to another company, and to notify you immediately whenever such a request is made. If you get one of those notifications and you didn’t make the request, call your carrier right away.

You can add your own lock too. Ask your carrier to put a number-transfer PIN or port-out PIN on your account, a separate code required before anyone can move your number. Most major carriers offer it, and it’s the best defense against a SIM swap. Set it up now, on the account for your replacement phone, so it’s already in place.

When a Lost Phone Becomes Identity Theft

Most of the time, if you move fast, a stolen phone stays a contained problem. But if the thief got into your accounts, or you’re not sure what they reached, treat it as the start of a possible identity-theft situation and take the standard protective steps.

Freeze your credit at all three bureaus. It’s free, it blocks anyone from opening new accounts in your name, and it’s the single most effective step you can take. Our credit freeze guide walks through the process at each bureau, and if you want a faster, lighter first move while you set the freeze up, our fraud alert guide covers that too. Watch your bank and card accounts closely for the next few weeks. And if you do find something opened in your name, our guide on what to do when someone opens a credit card in your name covers the recovery process step by step. The FTC’s IdentityTheft.gov will also build you a personalized recovery plan if it comes to that.

If you’re weighing whether ongoing monitoring is worth paying for after a scare like this, our piece on what identity protection services actually monitor and the one on whether identity protection is worth it both give you the honest version of that decision.

The Honest Bottom Line

The phone is replaceable. The accounts behind it are the asset, and they’re what a thief is really after. Lock the device, kill the SIM, change the passwords on the accounts it could unlock, and watch for the SIM-swap follow-on. Do those four things in that order and you close the door on almost everything a stolen phone can lead to.

The people who get hurt are usually the ones who spent the first hour trying to get the hardware back instead of protecting what was on it. Don’t chase the phone. Lock down your identity first. The phone can wait.

---

Tom Reardon spent over 20 years in product and operations at major identity protection providers. He writes at MyScamGuide.com to give consumers the honest picture the industry’s marketing never did.

---

Recommended resources:

• IdentityTheft.gov: the FTC’s official recovery resource and reporting tool
• Apple Stolen Device Protection: how to turn on the iPhone security delay
• Android Find My Device: locate, lock, or erase a lost Android phone
• FCC SIM-swap and port-out protections: your rights under the 2024 carrier rules