Introduction: what you're really losing
A phone costs a few hundred euros. Nobody wakes up thinking its loss amounts to a major security incident: you think about the replacement, the insurance, the contract. That's a failure of scale.
What the device holds isn't data — it's keys. Your number, now a universal identifier, is what resets half of your accounts. Your open sessions (messaging, banking, social media, photo cloud) ask for no password: they're already authenticated. Your two-factor authentication app generates the codes that protect everything else. Your location history says where you sleep. Your notifications display, right on the lock screen, snippets of conversations and sometimes verification codes.
A reader of this site has usually invested time in their digital hygiene: encrypted messaging, compartmentalised identities, the use of masked-sender messages for sensitive exchanges. That whole edifice rests on a 180-gram object that can slip out of a pocket on a tram. This guide is about precisely that moment: the 48 hours following the disappearance, and the preparation that makes them bearable.
Hour 0 to 1: the order of operations
In a panic, the temptation is to do everything at once. Yet there is a logical order, from the most irreversible to the least urgent.
1. Locate before you block
First of all, use the location feature from another device: Find My on Apple, Find My Device on Google, or the manufacturer's equivalent on Samsung or Xiaomi. Once the SIM card is blocked, location via the mobile network goes dark; only Wi-Fi or Bluetooth will remain. So take thirty seconds to check whether the device is simply still at the office.
If the displayed position is plausible and nearby, activate "lost mode": it locks the screen, hides notifications and displays a contact message. If the position is inconsistent or unknown, treat the device as compromised and move on to the next step.
2. Suspend the line with your carrier
The number is the most dangerous way in. As long as the SIM is active in someone else's device, it receives verification codes by SMS from your banks, government services and platforms. Call your carrier (Orange, SFR, Bouygues, Free and the virtual operators all have an emergency number reachable from another line) and ask for the line to be suspended, not merely for outgoing calls to be blocked.
Specify that you want to keep your number and obtain a replacement SIM. In most cases a card is shipped within 24 to 72 hours, or available in-store with proof of identity.
3. Have the IMEI blocked
The IMEI is the device's unique serial number, independent of the SIM card. Blocking it, at your carrier's request, adds the phone to a blacklist that renders it unusable on French networks, whatever SIM is inserted. It's a deterrent against resale.
But you still need to know that IMEI. It appears on the original box, on the purchase invoice, in your Apple or Google account, and can be displayed by dialling *#06# on the device's keypad. Write it down today, somewhere that doesn't depend on the phone.
4. Revoke active sessions
From a computer, open the security settings of your main accounts and sign out all devices. Most services offer a "sign out of all sessions" option: Google account, Apple account, WhatsApp, Signal, Telegram, email services, social networks, online banking.
This step is often neglected because it's tedious. Yet it's the most effective one: it turns an unlocked device into a mere paperweight.
Hour 1 to 24: containing the damage
Filing a report, and what it's actually for
In France, theft is reported at a police station or gendarmerie; an online pre-complaint is possible for thefts with no identified perpetrator via the Interior Ministry's official online pre-complaint service, to be finalised in person afterwards. A simple loss, on the other hand, is declared at the town hall or prefecture.
The receipt has almost no chance of getting your device back. It serves three concrete purposes:
- providing proof to your insurer or carrier;
- releasing you from liability in the event of fraudulent use of the line;
- constituting dated evidence should your identity later be misused.
Changing passwords in the right order
Don't start with social media. Start with your main email address, because it can reset everything else. Then the password manager. Then financial accounts. Then messaging services. Then, and only then, entertainment.
Do it from a trusted computer, not from a borrowed device. If you absolutely must use someone else's machine, a private browsing session and an explicit sign-out at the end reduce — without eliminating — the risk.
The blind spot: SMS-based two-factor authentication
If your second factor relies on SMS, losing the line locks you out of your own accounts at the worst possible moment. That's why ANSSI and the CNIL have for several years recommended favouring authenticator apps or hardware keys over SMS, which is vulnerable to SIM swapping as well as to device loss.
A FIDO2 security key kept in a drawer, at a relative's home or in a safe is the best safety net: it lets you regain control of an account even without a phone or an active line. Two copies are better than one — the failure of a single key is the scenario everyone forgets.
Staying reachable without stripping yourself bare
During these 48 hours, a very concrete problem arises: you need to warn people, confirm appointments, answer an employer, reassure family — with no number and often no address book.
This is when the most serious privacy mistakes get made. You borrow a colleague's phone and create a session on it that will stay open. You give your work number to a customer service line that will archive it forever. You install an unknown app on a family tablet.
A few principles limit the damage:
| Need | Risky reflex | Sober alternative |
|---|---|---|
| Warn a loved one | Create a session on a borrowed phone | Web gateway for sending SMS, no app to install |
| Confirm an appointment | Give out a replacement personal number | Masked-sender message with instructions to reply by email |
| Receive a code | Have the code resent to a third party's line | Wait for the new SIM or use a printed backup code |
| Access your contacts | Sign in to the cloud from a public terminal | Consult the offline copy prepared in advance |
Sending an SMS from a web interface, without exposing a new personal number, is particularly well suited to this interlude: the message goes out, the recipient is informed, and you haven't scattered an extra identifier through the address books of three strangers. Discretion here isn't a pose, it's damage limitation.
Cold preparation: ten minutes that change everything
Everything above is infinitely simpler if you've laid the groundwork. Here's what deserves to be done on a rainy Sunday, once and for all.
An offline "incident" folder
Gather together, on paper or in an encrypted file stored somewhere other than the phone:
- the device's IMEI and serial number;
- your carrier's emergency number and your customer account credentials;
- the single-use backup codes for your critical accounts;
- a list of ten essential numbers, memorised or copied out;
- your insurance and warranty references.
A hardcover notebook kept at home, out of reach of an opportunistic burglary, remains surprisingly effective: it can't be hacked, it doesn't run out of battery and it depends on no online service. For more sensitive data, a hardware-encrypted USB stick kept at a relative's home saves you from having to trust a cloud.
Really locking the screen
The four-digit code is a relic. Move up to six digits at minimum, or an alphanumeric passphrase. Above all, configure:
- hiding notification contents on the lock screen (a verification code visible without unlocking cancels out everything else);
- fast locking, ten to thirty seconds of inactivity;
- blocking the control centre and the voice assistant from the lock screen;
- automatic wiping after a set number of failed attempts, if you have a reliable backup.
The SIM card PIN
Many users disable it to save three seconds at startup. It's a bad bargain: without a PIN, the SIM pulled from your device works immediately in another phone, and receives your verification texts. Turn it back on and change the carrier's default value.
Back up so you can wipe
Remote wiping is only a comfortable option if your data exists elsewhere. An encrypted, automatic and regular backup is the precondition for a fast decision. Many people hesitate for days before wiping, for fear of losing photos — and in the meantime the device remains exploitable.
An encrypted external hard drive for local backups, complemented by an end-to-end encrypted cloud service, covers both scenarios: hardware failure and device loss.
Reduce what's exposed
The best protection is still not carrying around what doesn't need to be carried. Review what your device contains:
- photos of identity documents, bank cards, bank details;
- notes containing passwords in plain text;
- screenshots of recovery codes;
- work apps with permanent sessions;
- a location history that's been switched on for years.
Each of these turns the theft of an object into an identity leak. Deleting them takes fifteen minutes.
Afterwards: watching for weak signals
Once the line is restored and the accounts secured, vigilance continues for a few weeks. Fraudulent use isn't always immediate: resold data circulates, sometimes months later.
Three signals warrant an immediate reaction:
Sudden loss of network with no explanation: this is the classic symptom of a fraudulent line transfer (SIM swapping). Contact your carrier within the hour.
Unusual sign-in notifications: access from a country you've never visited, or from a device model you don't own.
Letters or emails from unfamiliar services: confirmation of an account opening, a credit application, a change of address. This points to identity theft.
In case of identity theft, the official platform Cybermalveillance.gouv.fr offers a free assistance pathway and directs you to the appropriate steps. The CNIL remains the point of contact for anything involving the misuse of personal data, and the Perceval service allows you to report bank card fraud. For victims of digital offences, the association France Victimes (116 006) offers free support.
Also get into the habit, for two or three months, of checking your bank statements line by line. Fraudsters often test the waters with micro-charges before moving on to significant amounts.
The moves that make everything worse
To finish, a short list of reflexes to avoid, all of them observed regularly:
- Posting "I've lost my phone" on social media with your new number in plain sight. You've just handed it out to thousands of strangers and publicly linked it to your identity.
- Replying to "your device has been located" messages. This is almost invariably phishing aimed at your iCloud or Google credentials, sent precisely because your number was showing on the lock screen.
- Rushing out to buy a new phone and reinstalling everything identically. A loss is the ideal opportunity to start over with a clean configuration, without the accumulated apps.
- Waiting "in case it turns up". Every hour without a block widens the window for exploitation.
- Being careless with a recovered device. A phone retrieved after several days in unknown hands must be completely reset before being used again. A phone storage holder with a shielded pouch can also stop the device from rattling around at the bottom of an open bag, which is where it most often disappears.
Conclusion: resilience rather than panic
Losing a smartphone is a full-scale test of your digital hygiene. It reveals, without mercy, whether your accounts hang on a single object, whether your second factor is solid, whether you know how to stay reachable without exposing yourself.
That test can be prepared for. Write down your IMEI tonight. Re-enable the SIM PIN. Hide notifications on the lock screen. Order a security key and keep it elsewhere. Write ten numbers on paper. These steps take an evening and radically change the outcome of an incident that, statistically, will eventually happen to you.
Anonymity and privacy aren't decided solely by the choice of an encrypted messaging app. They're also decided by your ability to get through a material accident without leaving behind a trail of identifiers, open sessions and numbers handed out in a hurry.
