Before and after phone theft: a practical response plan

Start with a small recovery worksheet: your Apple or Google account identifier, carrier contact route, bank contact route, device model, serial number and IMEI. Store it somewhere accessible independently, such as a protected home record. Do not put passwords and recovery codes together on a card inside the phone case.

Google supports backup codes for two-step verification. Treat each code as a secret, keep it outside the missing device and follow the provider's instructions when using or replacing it. Review the equivalent recovery options for your other important services rather than assuming every account works like Google.

Run a simple rehearsal on a trusted computer: locate the official device-finding service, confirm which account owns the handset and check that you can reach your backup. Stop before issuing a lock or erase command. Record anything that still requires approval from the phone; that dependency needs a separate recovery route.

Decide what you would need on the first evening without a handset: a contact number, transport information, access to accommodation or essential documents. Our suggested worksheet should contain references to these resources, not a complete unprotected copy of your digital life.

NIST treats physical possession of a lost or stolen device as a security threat. Its countermeasures include attending to the device and using appropriate remote protection. Translate that into a repeatable habit: put the phone away after checking it, rather than leaving it visible while eating, paying or sorting luggage.

Police advice highlights snatching near roads and distraction while walking. If you need directions, stop in a suitable place away from the roadside, look around and put the handset away before moving. Avoid making an expensive device the centre of your attention in a crowded transition area.

CERT Polska recommends regular system and application updates. Check whether your phone still receives updates and review its available protection settings using the manufacturer's current guidance. A feature name in an article is not proof that the feature exists or is enabled on your particular model.

An anti-theft backpack is an optional organisational aid, not the core of this plan. If considering one, examine pocket placement, closure access and whether you can reach the phone without exposing other belongings. This article has not tested the listed product and makes no claim that it prevents theft.

Use Apple's Find My service at https://www.icloud.com/find or Google's Find Hub at https://www.google.com/android/find. Type the address yourself or follow the official support documentation. Avoid links delivered by an unexpected message claiming that the phone has been found.

Apple says Find My must have been enabled before theft to mark the device as lost or erase it remotely. Google lists prerequisites for remote securing and erasure, including power, connectivity and an enabled Find Hub service. If a command cannot execute, continue protecting accounts rather than repeatedly refreshing the map.

Write down when you noticed the loss, where you last used the handset and whether it was unlocked or its passcode might have been observed. Save screenshots with their displayed times. Separate what you witnessed from what you infer; this makes a later report easier to understand.

Our practical division of work is simple: if a trusted person is helping, one person can record the incident while you handle account access. Do not disclose account secrets merely to speed things up. On a borrowed device, finish by signing out of your own accounts.

Tell the carrier that the device was stolen and ask what it can suspend, what it needs to issue a replacement SIM or eSIM, and whether IMEI blocking is available. Record the reference number. Service suspension is a different action from remotely locking the handset or changing an account password.

Contact your bank through an independently verified channel. Explain whether the thief may have had an unlocked device, banking access or payment credentials, and identify any transactions you do not recognise. Ask the bank which mobile access, cards or payment services need restriction; do not assume one action covers everything.

For account recovery, begin with email and the main platform account because they are important recovery channels. Google's compromised-account guidance includes checking security events, devices and recovery information. For Gmail, also inspect unfamiliar forwarding rules or filters. Continue with other accounts according to the information and access they expose.

Keep a short action log with the service, time, action requested and confirmation received. Our suggested log helps distinguish a request from a completed restriction. If work information was accessible, notify your organisation promptly and follow its response process rather than improvising changes to managed services.

There is no universal waiting period that fits every theft. Our decision criteria are the sensitivity of local information, the likely access available to the thief, the status of your backup and the realistic recovery situation. Missing photographs matter, but they should be weighed alongside exposed work records or identity documents.

Google warns that remote factory reset permanently deletes device data, may not delete SD cards and makes the device unavailable in Find Hub. Apple states that devices running iOS 15 or later can still be located after erasure; an offline erase begins when the device next comes online.

On an Apple device, do not remove the stolen handset from Find My, including after erasing it: that removes Activation Lock. Distinguish this from reviewing account sessions or devices. Follow Apple's exact instructions instead of treating every button labelled 'remove' as equivalent.

Prepare the model, colour, serial number or IMEI, approximate time and place, and any relevant transaction references. Keep the police report reference for follow-up and any insurance enquiry. Check your own policy for evidence requirements and deadlines; this article does not promise coverage or reimbursement.

CERT Polska accepts incident reports through https://incydent.cert.pl and suspicious SMS messages containing malicious links forwarded to 8080. These channels address cyber incidents and phishing; they do not replace reporting the physical theft to police. Elsewhere, use the appropriate local reporting service.

On a replacement handset, update the system, restore the backup you have checked and re-establish financial and authentication access through each provider. Review which recovery methods still depend on the missing device. Revisit the incident log until outstanding requests have an outcome, then improve the preparation worksheet using what actually caused difficulty.