Phone Stolen? What to Do in 2026: Step-by-Step Plan

In short: If your phone is lost or stolen, move fast and in order. 1) From any device, open icloud.com/find (iPhone) or android.com/find (Android), locate the phone on the map and turn on Lost Mode to lock the screen. 2) If it is unrecoverable and holds sensitive data, wipe it remotely. 3) Call your carrier and suspend the SIM. 4) Change the passwords of your key accounts (email, bank, messengers) and sign out all other sessions. 5) File a police report and note the IMEI. A strong passcode, backups and Find My enabled ahead of time turn a theft from a disaster into a nuisance.

The first minutes decide everything

A stolen smartphone is not just the loss of an expensive device. What most thieves are really after is what is inside: access to your email, banking apps, messengers and the SMS one-time codes that arrive on your number. While the phone is unlocked or protected by a weak PIN, an attacker has a window to sign into your accounts and move money. So the order is simple: rescue your data and access first, then worry about the hardware.

If the phone is gone, do not waste time chasing it yourself — it is dangerous and almost always pointless. Instead grab any device with internet: a second phone, a tablet, a work computer or a friend's laptop. Locking, locating and wiping can all be done remotely through a browser in a few minutes.

One caveat: if you sign into your Apple or Google account from someone else's computer or over an open cafe network, that session is exposed. Use a secure connection where you can — more on the role of a VPN below.

Step 1. Locate and lock the phone remotely

Both iPhone and Android have a built-in find feature that works even when the device is in someone else's hands, as long as it was enabled beforehand and the phone still has internet. Open it from any device and lock the screen first so the thief cannot use the handset.

For iPhone, go to icloud.com/find and sign in with your Apple ID. For Android, open android.com/find and sign into the same Google account linked to the phone. You will see the device on a map and get a set of actions: play a sound, lock, show a message on screen or erase the data. Here is what each platform offers and what it is called.

Note the last row: both Apple and Google tie the device to your account. Even after a full reset, a thief cannot activate the phone without your login and password — which is exactly why that link must be enabled and your account password must be strong.

Step 2. Turn on Lost Mode or wipe the data

Lost Mode is the middle ground. It locks the screen instantly, suspends payment services such as contactless pay, and lets you display a message asking for the phone back with a callback number. The device stays visible on the map, so the chance of recovery remains.

If you are sure the phone will not come back and it holds sensitive data — work documents, credentials, personal photos — use the remote wipe. Keep two things in mind. First, after a wipe you usually lose the ability to track the phone on the map. Second, the account link normally survives the reset, so the device is still useless to a stranger as a working phone. Wipe when recovery is already unlikely and the risk of a data leak outweighs the odds of finding the handset.

Step 3. Suspend the SIM and protect your money

Call your mobile carrier and ask them to suspend the SIM. This is critical: your number receives SMS one-time codes, and with it an attacker can confirm a bank login or reset your email password. You can restore the same number later for free with ID. A related threat is SIM swapping, where a fraudster reissues your number to themselves; suspending it closes that scenario too. Right after, call your bank or open online banking on a computer, temporarily freeze the cards tied to the phone and review recent transactions.

Step 4. Change passwords and end other sessions

Start with the most important account — your email. Your inbox is the key to every door: it is used to recover access to all other services. Change your email password, then your bank, and your messengers. In each service's security settings, find the active sessions or devices list and end every session except the current one — that kicks the thief out of apps that are already open.

Pay special attention to messengers: end extra sessions and check your cloud password. If you kept passwords in notes or in the browser, now is the time to move to a password manager and turn on two-factor authentication everywhere you can — ideally in an authenticator app rather than over SMS.

You will often change passwords and sign in wherever you happen to be — a cafe, a hotel or a borrowed laptop, that is, on an open Wi-Fi network. Traffic on such networks is easier to intercept; this is how a classic man-in-the-middle attack works. An encrypted VPN connection shields that session from others on the same network: even if an attacker is sitting nearby, they will not see your logins and codes. If you have a second phone or tablet, keep a LiMP VPN connection ready on it — cheap insurance for exactly these emergencies. When you reinstall a VPN afterwards, get it from an official source, as covered in how to download a VPN safely.

Step 5. File a police report and block by IMEI

File a police report: you will need a description of what happened and the IMEI — the unique 15-digit identifier of the handset. You can find it on the phone's box, on the receipt, and in your Apple or Google account under the device list. An official theft record helps with insurance and proves you are not responsible for anything done with the phone after it went missing.

With the IMEI, a carrier or law enforcement can in some cases add the device to a blacklist, making it harder to use on the network. Do not treat this as your main safeguard, but record the IMEI and hand it over.

How to prepare in advance so a theft is not a catastrophe

The gap between annoying and catastrophic is set by choices you make before the theft. A few minutes of preparation save hours of panic and protect your money.

• A strong lock code. A six-digit-or-longer numeric code or an alphanumeric password instead of a simple 1234. Modern iPhones and Androids encrypt storage when a lock is set, so without the code the data is unreadable.
• Biometrics plus auto-lock. Enable Face ID or a fingerprint and the shortest screen auto-lock so the device is not left open in someone else's hands.
• Find feature enabled ahead of time. Find My on iPhone and Find My Device on Android only work if you turned them on before the loss. Check today.
• Hide notification content. Turn off showing the text of SMS and messages on the lock screen so confirmation codes are not visible without unlocking.
• Backups. A regular backup to iCloud or Google means a remote wipe will not cost you your photos and contacts.
• Password manager and 2FA. Unique passwords and two-factor authentication in an authenticator app, not over SMS, make a hijacked number almost useless.

It also helps to know the warning signs in advance: sometimes a phone is not stolen physically but quietly infected. And if you post photos often, it is worth reducing your digital footprint so a single account never exposes your whole life.

Checklist: what to do if your phone is stolen

• Grab any device with internet and sign into icloud.com/find (iPhone) or android.com/find (Android).
• Turn on Lost Mode and lock the screen; display a message with a callback number.
• Call your carrier and suspend the SIM to take back control of SMS codes.
• Contact your bank: freeze the cards tied to the phone and review transactions.
• Change passwords — email first, then bank and messengers.
• End all other sessions in your accounts and enable two-factor authentication.
• If the phone is unrecoverable and holds sensitive data, run a remote wipe.
• File a police report, note the IMEI and keep a copy of the record.

Frequently asked questions

Can I find the phone if it is turned off or offline?

While the phone is offline, its current location is unavailable, but the system remembers the last point where it was connected. Newer iPhones can respond in the Find My network for a while even after being switched off. As soon as the device comes back online you get a notification, and any lock or wipe you set earlier is applied automatically.

Should I wipe the data right away?

Do not rush. Turn on Lost Mode first: it locks the phone and keeps it visible on the map. A full wipe is justified when the chance of getting the device back is low and it holds data whose leak is more dangerous than the loss of the hardware itself. After a wipe you usually can no longer track the phone.

Can a thief use the phone after a factory reset?

No, if the account link was enabled. Both Apple and Google block reactivation of the device without your login and password. So a stolen handset with protection on is nearly worthless for resale as a working phone.

Do I still need to change passwords if the phone had a PIN?

Yes, as a sensible precaution. A PIN makes access much harder, but the passwords for key services such as email and banking are worth changing anyway, along with ending active sessions on other devices. It takes a few minutes and closes even unlikely scenarios.

Will a VPN protect my phone from being stolen?

A VPN does not prevent a physical theft and does not locate the device — Find My and Find My Device do that. But when you urgently sign into your accounts from someone else's device or over open Wi-Fi to lock the phone, a VPN encrypts that connection and stops your logins and codes from being intercepted on the same network.

What comes first — suspending the SIM or changing passwords?

Suspend the SIM first: without it an attacker cannot receive SMS codes and therefore cannot confirm a login or a password reset. Immediately after that, change passwords, starting with your email as the recovery hub for everything else.