Act in the first hour
A missing work phone is a security incident as well as an equipment problem. It may hold email, client files, Teams chats and the authenticator app staff use to sign in. Work through these steps quickly, in this order.
1. Lock the device and try to locate it
If the phone is enrolled in mobile device management, such as Microsoft Intune, lock it remotely and check its last reported location. If it is not managed, the user can lock it through Apple's Find My or Google's Find My Device. Do not try to recover a phone from someone yourself; leave that to the police.
2. Wipe it if it will not be recovered
If the phone is clearly lost or stolen, wipe it. On company-owned devices a full remote wipe removes everything. On personal phones used for work, mobile device management can remove only the work apps and data, leaving personal content untouched.
3. Secure the user's accounts
- Sign the user out of all Microsoft 365 sessions and revoke tokens for the lost device.
- Reset their password if there is any chance the device was unlocked.
- Remove the lost phone as a multi-factor authentication method, and register a new one on the replacement.
- Check for unusual sign-ins or new mailbox forwarding rules over the following days.
4. Bar the SIM and block the handset
Contact your mobile provider to bar the SIM, which stops calls and data being charged to your account. Ask them to block the handset's IMEI as well, so it cannot be used on UK networks. Your provider can then issue a replacement SIM on the same number. Keep an asset list with each device's IMEI so this step is quick.
5. Report it
Report a theft to the police on 101 or through your local force's online reporting service, and keep the crime reference number for insurance claims. Tell your insurer if the device is covered.
6. Decide whether it is a data breach
If the phone held personal data and was not adequately protected, for example with no PIN or encryption, losing it may be a personal data breach under UK GDPR. If the breach is likely to put people's rights and freedoms at risk, it must be reported to the ICO within 72 hours of you becoming aware of it. A device that was encrypted, PIN-protected and remotely wiped is far less likely to be reportable, but record your assessment either way.
Prepare before it happens
- Enrol every company phone in device management so it can be locked and wiped. See our Intune guide.
- Require a PIN or biometrics, and confirm devices are encrypted, which modern phones do by default once a passcode is set.
- Keep an asset register with users, models, IMEIs and phone numbers.
- Apply bars on premium-rate numbers and set spend alerts on your mobile account.
- Write a short procedure so staff know who to call, and make sure they report losses straight away.
Get help from Omega IT
Our mobile device management service sets up Intune so lost devices can be locked and wiped remotely, and we supply business mobile contracts across UK networks.