How to Secure a Lost or Compromised Work Phone

This guide walks you through the exact steps to take when a work phone is lost, stolen, or suspected of being compromised. You’ll learn how to remotely lock or wipe the device, revoke access to company accounts, and prevent data breaches—all in the order that matters most.

What You’ll Need

• Access to your company’s IT helpdesk or security team contact
• Your work email or another device with internet access
• Your phone number (for account verification)
• Any passwords or PINs you use for company accounts
• Your device’s IMEI number (optional, but helpful for carriers)

Step-by-Step

1. Report the loss or suspected compromise immediately. Contact your IT/security team as soon as you realize the phone is missing or acting oddly. Time is critical—the faster they know, the faster they can revoke access and limit damage. Provide your name, the phone’s make/model, and the last time you used it normally.
2. Change your passwords. Using another device, change the password for your work email, VPN, and any other company accounts you accessed on that phone. If you use a password manager, rotate the master password too. Do this before you attempt to locate the phone, because a thief might be watching your accounts.
3. Enable two-factor authentication (2FA) or reset it. If you don’t already use 2FA, turn it on for all work accounts. If you do, reset the 2FA method so the lost phone’s authenticator app or SMS codes no longer work. Your IT team can help with this if you’re locked out.
4. Use your device’s remote lock/wipe feature. If your company uses Mobile Device Management (MDM), go to the MDM portal (often via a web browser) and select your device. Choose “Lock” first to prevent access, then “Wipe” if you’re sure the data is at risk. If you have a personal phone with work apps, use the built-in “Find My” feature (Apple’s iCloud or Google’s Find My Device) to lock or erase it.
5. Revoke app-specific passwords and sessions. In your email or cloud account settings, revoke any active sessions on the lost device. Also remove any app-specific passwords you had set up for third-party tools. This cuts off access even if the phone is unlocked.
6. Contact your mobile carrier. Ask the carrier to suspend or block the SIM card and, if possible, the device itself (using the IMEI). This prevents calls, texts, and data usage. Keep the phone number active if you need it for 2FA on other accounts, but block data and calls.
7. Notify your manager and colleagues. Let your supervisor and key team members know the phone is compromised so they can watch for phishing emails or unusual messages that appear to come from you. This is especially important if the phone contained chat apps or email.
8. Monitor your accounts for unusual activity. For the next few weeks, check your sent email folder, cloud storage access logs, and any financial or HR portals for unauthorized actions. Report anything suspicious to IT immediately.
9. Get a replacement device and set it up securely. Once IT gives the go-ahead, set up the new phone with a strong PIN or biometric lock, enable full-disk encryption, and reinstall only necessary work apps. Do not restore from a backup of the compromised phone unless IT has verified it’s clean.

Common Mistakes

• Waiting to report: Hoping the phone turns up wastes precious time. Report immediately—you can always cancel the report if it’s found.
• Only changing your email password: Attackers often use the email to reset passwords for other services. Change all passwords, including VPN, CRM, and any financial tools.
• Forgetting about 2FA codes: If your 2FA codes are generated on the lost phone, an attacker can use them. Reset 2FA on every account.
• Not wiping the device: A remote lock is good, but a wipe is better if the phone contains sensitive data. If you’re unsure, wipe—you can always restore from backup.
• Ignoring the SIM: Even if the phone is locked, the SIM card can be removed and used in another device. Block the SIM with your carrier.
• Restoring from a compromised backup: If the phone was hacked, its backup might be infected too. Start fresh or use a backup from before the suspected compromise.

Tips

• Keep your IT team’s number saved somewhere else (like a printed card or a family member’s phone) so you can reach them even without your work phone.
• Use a dedicated work profile on your phone (e.g., Android Work Profile or iOS Managed Apple ID) so work data is separate and can be wiped remotely without erasing personal photos.
• Write down your IMEI number and keep it in a safe place. It helps carriers block the device permanently.
• Enable automatic cloud backups for your work documents so a wipe doesn’t mean lost data—but ensure the backups are encrypted and protected with separate credentials.
• Set a screen lock with a long PIN (6+ digits) rather than a pattern or fingerprint alone. It’s harder to guess or force.
• Turn on “Find My” or “Find My Device” on all your phones, even if they’re company-issued, so you can locate them before they’re gone.

Troubleshooting

• I can’t access the MDM portal because I need 2FA from the lost phone. Contact IT directly—they can bypass 2FA for the portal or use a backup code. Do not try to guess codes; you’ll lock yourself out.
• The remote wipe failed. This can happen if the phone is offline. Keep trying every few hours, and also change your passwords and revoke sessions—those work without the phone being online. If the phone is turned on later, the wipe command will execute.
• I don’t know if the phone was compromised or just lost. Treat it as compromised. The steps are the same, and it’s safer to overreact than underreact.
• My personal phone with work apps was lost, but it’s not enrolled in MDM. Use the consumer “Find My” feature to lock or erase it, then immediately change your work passwords. Your IT team can also revoke access to company data from their side.
• I’m locked out of my own work accounts because I changed passwords and lost my 2FA. Contact IT to verify your identity (they may ask security questions or call your manager) and get a temporary access code. Do not try to bypass security—that looks suspicious.
• The carrier won’t block the SIM without a police report. Ask your IT team for a company letter or file a police report if the phone was stolen. Some carriers require it for IMEI blocking.

Frequently Asked Questions

Can I locate my work phone if it’s turned off?

No, most tracking services require the phone to be on and connected to the internet. However, the last known location may be shown. If it’s off, focus on locking and wiping rather than locating.

Will wiping the phone delete my personal photos?

Yes, a full wipe erases everything on the device, including personal data. That’s why it’s best to keep work and personal data separate using a work profile. If you have personal data you need, you might be able to back it up before wiping, but only if the phone is still accessible and you’re sure it’s not compromised.

What if I don’t have IT support (small company)?

If there’s no IT team, you’ll need to follow the same steps yourself: change passwords, revoke sessions, use the device’s built-in remote lock/wipe, and contact your carrier to block the SIM. Also inform your manager so they can alert others.

How long does it take to secure a lost phone?

The initial steps (reporting, changing passwords, remote lock) can be done in 15-30 minutes. Full security, including monitoring and setting up a new device, may take a few days. The key is to act fast on the critical steps.

Is it safe to use the same phone again if it’s recovered?

Only if you’ve wiped it and restored from a backup that predates the loss. If the phone was compromised, the malware might survive a factory reset in rare cases. Have IT inspect it before reusing it.

What should I do if I see suspicious activity on my accounts after securing the phone?

Report it to IT immediately. They can audit the activity, revoke any remaining access, and help you recover any data that was stolen. Do not try to handle it alone, as it could involve multiple systems.

Related

• Project Zomboid Dedicated Server vs Rented Hosting
• Arc Raiders Shared Watch Event: Merits & All Rewards
• How Stellantis Makes Money Across Its Brands