Lost or Stolen iPhone: The First Ten Minutes

Published August 20, 2026 · Last reviewed September 2, 2026

Minute one to three: Mark As Lost

1. Open Find My on another Apple device you own, or sign in at iCloud.com from any browser on any computer.
2. Select the missing iPhone from the device list.
3. Choose Mark As Lost and follow the prompts.
4. Add a contact phone number and a short message — a genuine finder needs a way to reach you.
5. Turn on notify when found so you are alerted the moment it reconnects.

Mark As Lost locks the device with your passcode, disables Apple Pay and payment cards, displays your message on the lock screen, and queues all of this even if the phone is offline right now — it applies the instant the phone next connects to any network. That last property is why this step comes first: it costs 90 seconds and works regardless of the phone's current state.

Minute three to six: the carrier and your accounts

Action

Call your mobile carrier and ask them to suspend the SIM and any eSIM on the account.

Why it helps

It stops call and data charges, and more importantly stops your number being used to receive SMS verification codes for your other accounts.

Verification

The carrier confirms the line is suspended; the number stops receiving calls.

Action

Change your Apple Account password from another device.

Why it helps

It invalidates sessions and blocks an attacker from acting on the account even if they somehow reach it.

Verification

You are prompted to sign in again on your other Apple devices.

Action

Change the passwords for email and banking, especially if you used SMS for two-factor.

Why it helps

Email is the reset path for everything else, so it is the account an attacker goes for first.

Verification

You have signed in with the new passwords and reviewed recent activity.

Action

Report it to the police and record the serial number and IMEI.

Why it helps

Many insurers require a crime reference number, and the identifiers are needed for any claim or recovery.

Verification

You have a crime reference number and the identifiers written down somewhere other than the missing phone.

Find the IMEI and serial from another device: they appear in Settings › [your name] under the device list on any other Apple device, and on your Apple Account page on the web. If you still have the original box, they are printed on it.

When to erase, and why not sooner

Mark As Lost already prevents access to your data, because the phone is locked with your passcode and encrypted. Erasing is a separate, stronger step with a real cost: it wipes the device, and on current iOS an erased device does continue to appear in Find My with Activation Lock intact, but you lose the ability to display a contact message and to interact with it in the same way.

Erase when: you have accepted the phone is gone, an insurance claim requires it, or the device held something you cannot risk under any circumstances. Do not erase when: there is any realistic chance of recovery, or the phone is merely lost rather than stolen.

The scam that follows a theft

Within hours or days of marking a phone lost, many people receive a message or email claiming the device has been found and asking them to sign in to a page to see its location. It is phishing, aimed at the Apple Account password that would let a thief remove Activation Lock and make the stolen hardware sellable. Apple does not send location links by text. Check Find My directly instead, and never sign in from a link in a message.

Afterwards: the thing that decides how bad this was

Whether losing a phone is an inconvenience or a catastrophe is decided before it happens, by whether a recent backup exists and whether Stolen Device Protection was on. Both are ten-minute jobs you can only do while you still have the phone.

How it works

Find My works even when the phone is offline, which is the part most people do not realise. Apple devices broadcast a rotating, encrypted Bluetooth identifier that any nearby Apple device can detect and relay — anonymously, and without the relaying device or Apple learning the location. That is why a stolen phone in a pocket, with cellular data off, can still report a position through a stranger's iPhone walking past.

Mark As Lost is a queued command rather than a live action. Marking a device that is currently offline stores the instruction, which executes the instant the device reaches any network. This is exactly why it belongs first in the sequence: it takes ninety seconds and its effectiveness does not depend on the phone's current state, whereas every minute spent deliberating is a minute the command is not yet queued.

Activation Lock is what makes the hardware worth much less to a thief. The device's Find My status is tied to your Apple Account on Apple's servers, so even a fully erased iPhone demands the original account credentials before it can be set up again. Nothing done to the device itself removes that link — which is precisely why the follow-up attack is always a phishing attempt for the account password rather than a technical attack on the phone. The lock holds unless you hand over the key.

Worked example

A phone is taken from a bag on a train at 18:20. The owner notices at 18:34 and borrows a friend's phone.

18:35 — signs in at iCloud.com in the browser, opens Find My. The phone shows as offline, last seen at 18:22 near the station. Mark As Lost is applied with the friend's number as the contact, plus notify-when-found. The command queues.

18:39 — calls the carrier and suspends the SIM and eSIM. 18:44 — changes the Apple Account password from the friend's phone, which signs the stolen device out of active sessions. 18:52 — changes the email password, because SMS two-factor on that account is no longer trustworthy.

At 21:10 the notify-when-found alert fires: the phone briefly connected and reported a location three miles away. The owner does not go there; they give the location to the police with the crime reference number obtained that evening.

Two days later a text arrives saying the iPhone has been located, with a link to sign in. It is phishing, and it is ignored. The phone is never recovered, but the outcome is bounded: the insurance claim proceeds on the crime reference, a replacement is restored from the previous night's iCloud backup, and no account was compromised. The whole difference was made in the first fifteen minutes and by a backup taken before any of it happened.