What happens to your accounts when you lose your phone

What a finder can actually reach

Start with the good news. A phone with a PIN, pattern or fingerprint lock is very hard to get into. The storage is encrypted, and the lock screen is the door. A finder sees notifications, if you let them show on the lock screen, and not much else.

So the phone itself is rarely the problem. Two other things are.

• The SIM card. It is not protected by your screen lock. Put it in another phone, and that phone receives your calls and texts, including every sign-in code sent by SMS.
• Accounts that are still signed in. If the phone is unlocked when it is lost, or the lock is weak, every signed-in app is open: email, chat, shopping, sometimes banking.

Everything you do in the first hour is about those two.

The first hour, in order

I would do it in this order, from another device.

1. Locate, then lock or erase. Use Find Hub (formerly Find My Device) for Android or Find My for iPhone. Try to locate the phone first. If it is gone for good, erase it; erasing usually stops you tracking it afterwards.
2. Block the SIM. Call your mobile carrier and ask them to block the card. This stops text-message codes going to whoever has it.
3. Sign the phone out of your main account. In your Google Account, Security, Your devices, choose the phone and sign it out. On Apple, remove it from the device list in your Apple Account.
4. Change the passwords that matter. Email first, because email resets everything else. Then banking.

The two-factor trap

This is the part that catches careful people. You turned on two-factor authentication, which is right. The codes live in an authenticator app on the phone. The phone is gone.

Whether you can still sign in depends on choices made months ago:

Your setup	After losing the phone
Codes by text message	Fine once you get a new SIM with your number
Authenticator with backup or sync	Fine, restore it on the new phone
Authenticator, no backup	Locked out unless you have backup codes
Backup codes saved somewhere safe	Fine, use one per account
A second device or security key	Fine, sign in with that

The row you do not want is the third one. Check now whether your authenticator app backs up or syncs its codes. Several popular ones can, but not always by default.

Backup codes: the boring fix

Most services that offer two-factor authentication also give you a set of one-time backup codes. Each works once, without the phone.

Print them, or write them down, and keep them at home with your passport. Not in a note on the phone you might lose. It takes ten minutes for your three most important accounts, and it turns a week of account recovery into a two-minute sign-in.

What to set up before it happens

Prevention is cheap. This is the setup I would want on any phone.

• A screen lock that is not 1234 or a simple pattern.
• Find Hub or Find My switched on and tested once.
• A SIM PIN, so a stolen SIM cannot be used in another phone without it.
• Photos and files backed up, so erasing the phone loses nothing.
• Backup codes for email, banking and anything work-related, on paper.

The short version

A lost phone is usually a hardware problem, not a security disaster, as long as it was locked and you act quickly on the SIM and your main account.

Lock or erase it, block the SIM, sign it out of your account, and change your email password. Then use the new phone to fix what you were missing: backups, backup codes, and a second way to sign in.