It was on the table and then it was not, and the man who had been standing near the table is now a figure moving quickly toward the escalator. Everyone’s first instinct is to find the phone — open a laptop, pull up the map, watch the dot move across the city. That instinct is backwards. The handset is worth two hundred dollars on a street corner. The banking app, the email that can reset every password you own, and the text messages that receive your verification codes are worth considerably more, and they are all still logged in.
Minute 1 to 5: lock it from somewhere else
Borrow any device with a browser. This works from a stranger’s phone.
iPhone: go to icloud.com/find, sign in, select the phone, choose Mark As Lost. This locks the screen with a passcode, disables Apple Pay immediately, and shows a message with a number to call. Do not choose Erase yet — an erased phone stops reporting its location, and you may still want it.
Android: go to android.com/find, sign in, choose Secure device. Same effect: locks it, signs out of the Google account for payments, lets you display a message.
On both, this works even if the phone is offline — the command queues and executes the moment it touches a network.
Minute 5 to 15: the SIM, and why it is urgent
This is the step people leave for the next day, and it is the one that does the damage.
Whoever has your phone can pull the SIM and put it in another handset. That SIM receives your text messages. Your text messages are where your bank sends the code that approves a transfer and where most services send a password reset. The screen lock does not protect the SIM — it is a separate chip.
Call your carrier and ask them to suspend the line. Not cancel — suspend. The number stays yours and stops working in any device.
- Verizon: 1-800-922-0204
- AT&T: 1-800-331-0500
- T-Mobile: 1-800-937-8997
If the phone used an eSIM there is no physical chip to steal, which is a real advantage, but suspend the line anyway.
Minute 15 to 30: the email account, first
Change the password on the email address that every other account uses for recovery. Not the bank first. Email first.
The reason is mechanical: whoever controls your email can reset the password on everything else, including the bank. It is the master key, and people guard the vault while leaving the key on the table.
While you are in there, open the security settings and look for a list of devices or active sessions. Sign out of everything. On Google that is myaccount.google.com/device-activity; on Apple it is in Settings on any other signed-in device, or on iCloud.com under your name.
Then, in this order: banking, payment apps, and anything that stores a card.
Minute 30 to 60: report it properly
- File a police report. Most carriers and all insurers require the report number. Many departments let you file online for a theft with no injury.
- Give the carrier the IMEI. This is the serial number of the handset and it lets them blacklist it across US networks, which makes it close to worthless to resell. Find it on the box, on the original receipt, or in your Google or Apple account under device details. If you have none of those, the carrier has it on file.
- Tell your bank the phone was stolen, even if nothing has happened yet. Ask them to flag the account for attempted SIM-swap fraud. That changes how they treat a call from “you” tomorrow.
After the first hour
- Two-factor apps. If you used Google Authenticator or similar, those codes lived on the phone. Open each account on a new device and re-enrol. This is the part that is genuinely tedious and genuinely necessary.
- Check your recovery phone numbers. A thief who got in may have added their own number as a backup, which keeps them inside even after you change the password.
- Erase it, once you have accepted it is gone. From the same Find pages. Remote erase leaves the activation lock in place on an iPhone — it cannot be set up by anyone else, which is why stolen iPhones are usually parted out rather than resold.
- Do not respond to the text. A message arrives a day or two later claiming to be Apple or Google, saying your device has been located, with a link to sign in. It is a phishing page, and signing in there is what finally removes the activation lock for them. Apple and Google do not text you a link like that.
The ten minutes that makes all of this easier, today
- Turn on Find My iPhone or Find My Device and confirm it is actually on, not just installed.
- Write down your IMEI somewhere that is not the phone. Dial
*#06#to display it. - Set a SIM PIN. This is the step nobody does and it defeats the SIM theft entirely — the chip asks for a PIN when it is moved to another device. iPhone: Settings → Cellular → SIM PIN. Android: Settings → Security → SIM card lock.
- Move your two-factor codes to an app that syncs, or print the backup codes and put them in a drawer.
- Know your carrier’s number without needing the phone to look it up.
Point three is the single highest-value item on the list, takes ninety seconds, and almost nobody has it switched on.
