Lost phone playbook for engineers: first hour checklist

If an engineer loses a phone, lock or erase it remotely, then revoke the sessions, tokens and credentials it held, and tell your security contact. Speed matters more than certainty. Setting up remote lock and a backup sign-in method before the loss is what makes the hour short.

Do the setup now, not later

Google's help page for finding a lost Android device lists what must be configured before you need it. You need a signed in Google Account with location on, and Find Hub allowed to locate the device. For offline finding, you need to set a PIN, pattern or password and choose a network option other than Off. The device must not be hidden on Google Play. You also need 2-Step Verification on the account, because without it you cannot remotely lock or erase the device. Save backup codes or a security key, or you may need your carrier for a new SIM.

Apple offers a similar set of options through Find My, including marking a device as lost and erasing it. Read Apple's current guide for the exact steps, because they vary by iOS version.

The first hour

1. Locate and lock. Use the manufacturer's find service. Put the phone in a locked or lost state with a contact message.
2. Decide on erase. If you have any doubt the phone is safe, erase it. Data is recoverable from backups, and a stolen unlocked session is not.
3. Tell security. Give them the time you last had it, the accounts you use on it, and whether it had a screen lock.
4. Revoke sessions. Sign out all sessions for your source control, cloud, chat, email and package registry accounts from the account security pages.
5. Rotate tokens. Revoke personal access tokens and API keys that were stored on or created from the phone.
6. Remove the phone as an authenticator. Delete it from the list of MFA devices and passkeys on each account, then register the replacement.
7. Check recent activity. Look at sign-in logs and audit logs for the hour after the loss.

What was probably on the phone

Make the list before you need it.

• Authenticator app or passkeys.
• Chat apps with a long history and shared files.
• Email with password reset links.
• A browser with signed in sessions.
• Screenshots and notes that may contain a secret.
• Any app that holds a token for your security tools.

NIST SP 800-124 Rev. 2 frames mobile device security across the device lifecycle, from deployment to disposal. A lost phone is a forced disposal, and the guide's lifecycle view is a good check for what to remove.

Make the next one cheaper

• Do not store secrets in notes or screenshots. Use a password manager with a screen lock timeout.
• Keep at least two registered MFA methods on important accounts.
• Hide notification content on the lock screen.
• Keep a short list of accounts to revoke, shared with your team.
• Run a drill once a year. Time how long it takes to revoke the sessions of a test device.

For managers

Add a "lost device" step to your incident process. Track who reported a loss, how long until the phone was locked, and how long until sessions were revoked. Those two times tell you whether the playbook works. Our post on push approval fatigue covers why a lost phone with live approvals is a bigger risk than a lost laptop.

Quick check

Sources

• Google: Find, lock, or erase a lost Android device
• NIST SP 800-124 Rev. 2

Last reviewed: 19 October 2026.