A stolen handset is replaceable hardware. The bank apps, email inbox and messaging accounts sitting behind its lock screen are not. That is why the first sixty minutes after a theft should follow a fixed sequence rather than panic: lock the device, cut the SIM, secure the money and the accounts, and only then file a police report. Get the order wrong — or go chasing the phone yourself — and a bad afternoon becomes a drained account.
Platform owners are blunt about the temptation to play detective. Apple’s own guidance states that if the device appears in a location you do not recognise, you should not go looking for it; you call the police instead.
- Lock before you locate: flagging the handset as lost remotely takes seconds and shuts the door on everything inside it.
- The SIM comes second: blocking the line stops calls and data abuse but can also kill location services, so it cannot be step one.
- Money before passwords: card liability shifts the moment you notify your bank.
- The IMEI is the paperwork: report plus device identifier lets the carrier blacklist the phone on every network.
Minutes 0–10: freeze the handset before searching for it
Every minute a stolen phone stays unlocked is a minute someone can browse your apps. On iPhone, sign in to iCloud.com/find from any browser, select the device and tap Mark as Lost. No verification code is needed at that stage, precisely because your trusted device is gone. Apple’s instructions then run against instinct: do not publish your number or a contact message on the lock screen if the phone was taken, since a thief can use it to manipulate you; do not remove the iPhone from Find My, even after erasing it, because that strips the activation lock and makes it resellable; and mark it as lost even if Stolen Device Protection was enabled, because those extra safeguards only hold for a limited period.
Android users have two routes. The fastest is android.com/lock, where a phone number plus a reCAPTCHA lock the screen without asking for the Google password — provided Remote Lock was configured beforehand and the handset still has an active SIM. The alternative is Google’s Find My Device app or website, which plots the phone on a map and can mark it lost or wipe it. Erasing should wait, though: Apple asks users to exhaust the other options first because a wipe is irreversible, and Google warns that once a device is reset to factory settings it stops appearing in the locator.
Minutes 10–20: cut the line
Next, ask the carrier to block the SIM so nobody can slot it into another handset to make calls or burn data. Both Spain’s national cybersecurity institute, INCIBE, and the Policía Nacional recommend it.
Ask your operator to block the SIM card.
There is a side effect worth planning around: with the SIM blocked, location services may stop working, which is exactly why this step follows the remote lock. On Android, Remote Lock depends on an active SIM, so trigger it before placing that call.
Minutes 20–40: protect the money, then the accounts
Call the bank, or use its app from another device, and block your cards. Speed pays. According to the Banco de España‘s banking customer portal, once a theft is reported the bank assumes responsibility for later transactions you did not authorise, while for earlier ones you answer for up to 50 euros unless you were negligent in safeguarding the card or its security elements. Failing to notify promptly is itself treated as negligence. That guidance covers physical cards rather than cards stored on a stolen phone, so ask your bank how it applies.
Then the accounts, starting with the one that unlocks the rest — the Apple or Google account tied to the handset. From another trusted device, review the device list and remove the stolen phone, taking care on iPhone to keep it inside Find My. Check the recovery addresses and numbers attached to the account, and change the password if anything looks unfamiliar; Apple adds that if Find My was never switched on, the password should be changed immediately. Email follows, as the master key to almost everything, then banking, social media and messaging, where you should terminate open sessions and rotate passwords if the phone was unlocked or stored credentials without protection.
For the following days, treat unexpected calls and texts as hostile. Apple stresses that it will never contact a user to say an iPhone has been found; messages claiming a device has been located are a classic technique for harvesting the code that disables the lock.
Minutes 40–60: file the report with the IMEI ready
Report the theft to the Policía Nacional or the Guardia Civil with the handset’s IMEI, the unique identifier INCIBE says you will be asked for. If the phone is gone, the number can still be recovered from the box, the label on the device or your carrier’s customer area; Android users can read it in Google’s locator at android.com/find alongside the device settings, and Apple notes the serial number is obtainable without the device in hand.
Armed with the report, ask the carrier to blacklist the handset by IMEI so it will not work with any other SIM. Keep the receipt: INCIBE notes it may be needed for an insurance claim and, on iPhone, for an AppleCare+ with Theft and Loss claim where that cover was bought — it is not offered in every country. Anyone still unsure can call INCIBE’s free cybersecurity helpline on 017, open daily from 8:00 to 23:00.
What the first hour cannot fix
Almost every step above depends on decisions taken before the theft: Find My or the Android locator switched on, Remote Lock configured, the IMEI written down somewhere other than the phone, and a recent backup. Without Find My, Apple is categorical — the iPhone will not appear, and it cannot be marked as lost or erased remotely. Anyone reading this in advance should spend ten minutes today noting the IMEI and running a backup.
For those already robbed, the consolation is structural. An hour executed in this order leaves the thief holding a locked slab of glass that no buyer wants, while the data, the money and the identity behind it stay where they belong.