Your phone has been stolen. Do this, in this order.

If this has just happened, start at step one and work down. Read the rest later.

Right now, in order

1. Lock the phone remotely. From any browser or a friend's phone:

• iPhone: icloud.com/find — put it in Lost Mode.
• Android: google.com/android/find — Secure Device.

This locks the screen, shows a message, and on an iPhone stops the SIM being reused. Do this before anything else, because it is the one thing that gets harder the longer you wait.

2. Ring your bank. Not your banking app on another device — ring them. Banking apps on an unlocked phone are the actual target, and most theft to order is about the bank, not the handset.

3. Ring your mobile provider and block the SIM. A stolen SIM receives your verification codes, which is how a locked phone still becomes a lost bank account.

4. Change your email password, from a different device. Your email is the reset route into everything else.

5. Report it to the police and get a crime reference. You need it for insurance, and stolen handsets do get recovered.

6. Sign out of your accounts remotely. Google, Apple, WhatsApp, banking. Each has a "devices" or "active sessions" screen.

Only once all of that is done: erase the device remotely if you are confident it is gone. Erasing first can stop you tracking it, which is why it comes last.

Why the SIM matters so much

A locked phone is a brick. A stolen SIM in a different phone still receives your calls and texts, including the six-digit codes that protect your accounts. Blocking the SIM is a separate action from locking the phone, and it is the step people skip.

This is also the argument for an authenticator app over SMS codes. There is more in two-factor authentication, ranked.

The message that comes next

Days or weeks later: a text or email that appears to be from Apple or Google, saying your lost phone has been located, with a link to sign in.

It is a scam, every time, and it is aimed precisely at someone anxiously hoping for that message. Signing in there hands over the account that is currently the only thing protecting the device. Check the address yourself at icloud.com or google.com, never through the link.

Five minutes now, so it is less bad later

• A six-digit PIN, not four, and Face ID or a fingerprint.
• Hide notification content on the lock screen, so a bank code cannot be read from a table.
• Turn on Find My / Find My Device and check it actually works once.
• Enable Stolen Device Protection on an iPhone. It adds a delay and a biometric check before

security settings can be changed away from home, which defeats the shoulder-surfed passcode.

• Know your email password without the phone. People discover they cannot get in precisely when

they need to most.