Respond to a stolen phone or account takeover

First get to safety. Do not pursue the thief or go to a location shown by a tracking app. A stolen device may expose far more than its replacement cost.

Use a known clean device or trusted helper

1. Contact your emergency contact and report any physical threat to local police. Warn the few people who could receive convincing requests from your account.
2. Start official lost device controls promptly. For an iPhone, iCloud.com/find lets you mark it lost without a verification code from a trusted device; Find My must already have been enabled. Do not remove the stolen device from Find My or follow unsolicited “phone found” links. [S58]
3. Contact the mobile carrier to address SIM or account compromise. If you suddenly lose service, verify with the carrier through a separate route; a network outage and an account takeover can initially look similar.
4. Secure the accounts that recover other accounts, particularly email and cloud identity. Review active sessions, recovery methods, forwarding rules and newly connected apps.
5. Contact banks, exchanges and custodians using verified channels to suspend affected access or withdrawals where available. Revoke compromised API access and sessions with technical help if needed.

Apple and Android provide theft controls with different requirements and limitations. A remote command may depend on connectivity and prior setup. Do not assume a remote lock or erase succeeded merely because you submitted it. [S11] [S12]

Decide what the device could expose

Was it unlocked? Was the passcode observed? Did it contain authentication codes, saved passwords, wallet keys, reserve addresses, private conversations or cloud access? Could it reset your financial accounts? Use this to prioritize containment without delaying urgent action.

If a seed or private key may be exposed, changing an app password is not enough. Use the wallet incident process on the next page. If a business device is involved, notify the responsible security team and follow its response plan.

Preserve useful evidence

Keep the time, location, device identifiers where available, unexpected login notices, account changes and case numbers. Do not copy recovery secrets into the incident log. Coordinate device wiping with security and legal responders where evidence or legal process is involved; do not erase a device to obstruct an investigation.

Avoid the second loss: do not restore a wallet or enter recovery words on an unverified borrowed device. Independently check messages demanding device removal, screen sharing or payment for recovery through the original official route. Report threats to police and professional responders; do not go to a recovery meeting yourself. [S58]

Return to normal only after: recovery routes, sessions, devices and financial permissions have been checked. A working replacement SIM is not proof that every affected account is secure.