Digital Banking
Security Published 16 January 2025 5 min read

Lost phone: what to do with your banking apps in the first 30 minutes

If your phone is gone — stolen or just left on a train — you have about half an hour before the finder can do real damage. Here is the ordered response.

A missing phone is scary mostly because of what it unlocks: email, SMS 2FA, banking apps, mobile wallet, work accounts. Done right, the first 30 minutes contain the loss. Done sloppily, a casual thief escalates to account takeover before you have made your coffee.

Minute 1-5: suspend the SIM

Call your mobile carrier (not from the lost phone, obviously). Suspend the line — this stops SMS 2FA interception and blocks any voice-based verification. Most carriers can do this in under 2 minutes with your account PIN.

Minute 5-10: remote lock the phone

Apple: iCloud.com > Find My > mark as lost. Enables a passcode (if not set) and shows a message on the lock screen. Android: Google Find My Device > secure device. Both options lock the device without wiping it — wipe is reserved for later if recovery looks hopeless.

Minute 10-15: change key passwords

From another device, change your main email password first (because it is the recovery destination for everything else). Then main banking password. Then password manager master passphrase (if you use one). Then any work-identity passwords.

Minute 15-20: freeze cards

In each banking app (now on a backup device or desktop web): freeze all cards. Virtual cards are especially important if someone has got into the mobile wallet and started attempting Apple Pay / Google Pay transactions.

Minute 20-30: audit active sessions

In email, banking, and major accounts (Google, Microsoft, Apple), check "active sessions" or "logged-in devices" and sign out anything you do not recognise. Enable login notifications where available.

Hour 1 onward

File a police report if stolen (needed for insurance). Contact your mobile insurance. Order a replacement phone and SIM. Only after everything above should you consider remote-wipe — once you wipe, you lose any residual tracking signal from the device.

The best preparation is boring

Always-on screen lock, biometric unlock on banking apps, 2FA on email and bank, Find My / Find My Device enabled, carrier account PIN set, home paper backup of the password manager master passphrase. If these are in place, the lost phone is an inconvenience, not a crisis.