The Tool Desk
Outbyte Driver Updater FREEFix the driver behind crashes, sound loss and screen glitchesFind Drivers →Outbyte PC Repair FREERepair Windows errors before they cause bigger problemsFix Now →iTechGuides is reader-supported. When you buy through links on our site, we may earn an affiliate commission. As an Amazon Associate I earn from qualifying purchases. Learn more
Report the missing or suspicious phone to your employer’s IT or security team immediately, then contain both the handset and the accounts it can access. Ask whether the device is company-owned, fully managed, or your personal phone with a work profile; that distinction determines whether IT can lock, locate, remove work data, or erase the entire phone.
What to do in the first 15 minutes
Use a trusted phone or computer—not the potentially compromised handset—to contact IT/security and your manager through the organization’s normal incident channel. If you cannot reach them, use the carrier’s fraud or account-support channel when service, SIM, or eSIM misuse is possible.
- Report the incident. State that the phone is lost, stolen, misused, or possibly compromised, and give the last known time and place.
- Describe exposure. Tell responders whether the phone was unlocked, whether a passcode was visible to anyone, which work apps and accounts were signed in, and whether it held confidential files, customer data, authentication codes, device certificates, or saved passwords.
- State what you know about activity. Include unusual sign-ins, messages sent without you, password-reset notices, new mobile-service charges, or a person who may have handled the phone.
- Ask IT to contain the device and accounts. Do not assume that a command was delivered just because it was submitted in a management console.
- Do not confront a suspected thief or arrange a private recovery. Give location information to your employer and, where appropriate, law enforcement or the carrier.
Write down the report time, ticket number, people notified, and every action requested. This timeline helps responders coordinate and prevents two people from taking conflicting actions.
Tell IT exactly what kind of phone it is
Remote controls depend on ownership, enrollment, operating-system version, and whether the device is online. Before authorizing a wipe, ask IT to identify the management mode recorded for the phone.
#1 Best Overall
- POWERFUL SECURITY KEY: The YubiKey 5C NFC is the most versatile physical passkey, protecting your digital life from phishing attacks. It ensures only you can access your accounts
- WORKS WITH 1000+ ACCOUNTS: Compatible with popular accounts like Google, Microsoft, and Apple. A single YubiKey 5C NFC secures 100+ of your favorite accounts, including email, password managers, and more
- FAST & CONVENIENT LOGIN: Plug in your YubiKey 5C NFC via USB and tap it, or tap it against your phone (NFC), to authenticate. No batteries, no internet connection, and no extra fees required
- MOST SECURE PASSKEY: Supports FIDO2/WebAuthn, FIDO U2F, Yubico OTP, OATH-TOTP/HOTP, Smart card (PIV), and OpenPGP. That means it’s versatile, working almost anywhere you need it
- PRIMARY & SPARE KEYS: Just like having a spare house key, we recommend buying two YubiKeys - one for daily use and one as a spare. That way you’ll never get locked out of your accounts
| Phone situation | Typical organizational control | Personal-data consequence |
|---|---|---|
| Organization-owned and fully managed | Remote lock, locate, lost mode, passcode action, and full erase may be available if the device is eligible and connected. | A full erase normally removes all local content, including personal content placed on the device. |
| Organization-owned with a work profile | IT may be able to lock the device and remove the managed work profile or account; some platforms also support location. | A work-profile wipe is narrower than a full-device wipe, but the exact scope is controlled by enrollment and policy. |
| Personally owned (BYOD) with work management | Often limited to removing the work account, work profile, certificates, or managed applications. | Do not assume the employer can erase the entire personal phone. Confirm the enrolled mode before approving any destructive action. |
| Unmanaged personal phone used for work | IT can still disable accounts, revoke sessions, and reset credentials, but may have no handset command. | Device recovery and personal-data protection remain your responsibility unless the carrier or platform offers a separate control. |
Ask the administrator to read back the planned action in plain language: “remove the work profile,” “erase corporate data,” or “erase the whole device.” Those are not interchangeable commands.
Use the organization’s remote controls
Remote actions work only when the management service can reach the phone. Google states that management actions require the device to be powered on and connected to a network. Apple’s Managed Lost Mode likewise needs internet connectivity before a command can arrive. A console may show a command as pending while the phone is switched off, in airplane mode, out of coverage, or disconnected from Wi-Fi and mobile data.
Apple managed iPhone or iPad
Apple Business Managed Lost Mode applies to supervised iPhone and iPad devices enrolled in built-in device management. It can lock the device and display a contact message, and Apple says it does not require Find My to be enabled. The device must connect to the internet to receive the command.
For an eligible enrollment, an administrator can also issue remote erase. Treat the erase as unconfirmed until the management service reports that the device received and completed it. If the phone comes online before the erase, the organization may still be able to collect management status or apply a less destructive lock first, depending on policy.
Android Enterprise
Android Enterprise Lost Mode can lock and locate eligible company-owned devices and report location to IT. Documented availability is limited to specific combinations: Work Profile on a company-owned device requires Android 13 or later; fully managed devices require Android 11 or later. The organization must use an enterprise mobility management service that relies on the Android Management API.
Rank #2
- POWERFUL SECURITY KEY: The Security Key C NFC is the essential physical passkey for protecting your digital life from phishing attacks. It ensures only you can access your accounts.
- WORKS WITH 1000+ ACCOUNTS: Compatible with Google, Microsoft, and Apple. A single Security Key C NFC secures 100 of your favorite accounts, including email, password managers, and more.
- FAST & CONVENIENT LOGIN: Plug in your Security Key C NFC via USB-C and tap it, or tap it against your phone (NFC) to authenticate. No batteries, no internet connection, and no extra fees required.
- TRUSTED PASSKEY TECHNOLOGY: Uses the latest passkey standards (FIDO2/WebAuthn & FIDO U2F) but does not support One-Time Passwords. For complex needs, check out the YubiKey 5 Series.
- BUILT TO LAST: Made from tough, waterproof, and crush-resistant materials. Manufactured in Sweden and programmed in the USA with the highest security standards.
If the phone is a personally owned device with a work profile, do not infer that company-owned Lost Mode is available. Ask IT which enrollment type is recorded and whether only the work profile can be removed.
Google Workspace controls
Depending on the device and administrator configuration, Google Workspace may expose lock, passcode reset, device wipe, or work-account wipe actions. Google warns that an erase can remove work and personal information in some configurations, so consult the administrator before selecting it yourself.
Do these 3 things before closing this tab:
1Repair Windows errors before they cause bigger problems2Fix the driver behind crashes, sound loss and screen glitches3Clear out junk files and repair common Windows errorsMicrosoft Intune
Intune administrators may have a Locate Device action and other platform-specific actions. Microsoft documents that location data collected by Locate Device is encrypted in transit and at rest and retained for 24 hours; a last-known location may remain for up to seven days. Supported platforms, user notifications, and the precision of a location result vary by enrollment and policy.
Location is a recovery aid, not proof that the phone is currently at a particular address. A stale last-known result can reflect where the device was before it lost connectivity.
Contain every account the phone could use
A handset can be secured while an attacker continues using an active session, refresh token, certificate, or saved password. Ask IT to treat the phone as a credential exposure, not only as missing hardware.
Rank #3
- POWERFUL SECURITY KEY: The YubiKey 5 NFC is the most versatile physical passkey, protecting your digital life from phishing attacks. It ensures only you can access your accounts
- WORKS WITH 1000+ ACCOUNTS: Compatible with popular accounts like Google, Microsoft, and Apple. A single YubiKey 5 NFC secures 100+ of your favorite accounts, including email, password managers, and more
- FAST & CONVENIENT LOGIN: Plug in your YubiKey 5 NFC via USB and tap it, or tap it against your phone (NFC), to authenticate. No batteries, no internet connection, and no extra fees required
- MOST SECURE PASSKEY: Supports FIDO2/WebAuthn, FIDO U2F, Yubico OTP, OATH-TOTP/HOTP, Smart card (PIV), and OpenPGP. That means it’s versatile, working almost anywhere you need it
- PRIMARY & SPARE KEYS: Just like having a spare house key, we recommend buying two YubiKeys - one for daily use and one as a spare. That way you’ll never get locked out of your accounts
Revoke device and application access
- Revoke device certificates and mobile-management enrollment tokens where the organization uses them.
- Sign the device out of work applications and revoke active sessions and refresh tokens where the identity system supports those actions.
- Disable or reset the work account if there is credible evidence of misuse. Coordinate the timing so you do not lock responders out of logs or the incident ticket.
- Remove the device from approved, remembered, or trusted-device lists.
- Invalidate saved passwords and application-specific credentials that were stored on the phone.
Microsoft’s compromised-identity response guidance specifically includes active-session and refresh-token revocation. Ask the administrator which actions are available in your identity provider rather than assuming a password change terminates every existing session.
Change exposed passwords from a trusted device
From a computer or phone you know is safe, change passwords that may have been visible or saved on the missing device. Start with the work identity, email, password manager, virtual private network, remote-access tools, and any service that can reset other accounts. Use the employer’s password and multi-factor authentication policy; do not send replacement passwords through an unverified text message.
Protect the mobile service
Contact the carrier when the SIM or eSIM could be used to receive calls, texted codes, or account-recovery messages. Ask whether the line should be suspended, the SIM replaced, an account PIN reset, or port-out protections enabled. Carrier action does not replace IT’s session and credential revocation, and a carrier block does not erase data already stored on the phone.
Choose between locking, locating, and wiping
There is no universal “best” command. Decide with IT after considering the likelihood of recovery, the sensitivity of the data, the phone’s management mode, and the need to preserve evidence.
| Action | Use it when | Trade-off |
|---|---|---|
| Lock or Managed Lost Mode | The phone may be recovered, and you need to prevent casual access immediately. | Preserves local data and potential recovery clues, but does not remove data from the handset. |
| Locate | IT needs a current or recent position to support recovery or assess exposure. | Works only on eligible, connected devices; a last-known position can be stale. |
| Work-account or work-profile wipe | A BYOD or mixed-use phone contains organizational data that must be removed without unnecessarily deleting personal content. | Scope depends on enrollment. Some locally cached data or screenshots may remain outside the managed profile. |
| Full-device erase | The phone was stolen, was unlocked, or has a credible compromise and the exposure risk outweighs recovery value. | Destructive: it can remove personal and work data, and the command cannot arrive until the device reconnects. |
Google recommends consulting the administrator before erasing because the result can remove personal information as well as work information. Apple’s management erase also requires an eligible built-in device-management enrollment and a network connection.
Rank #4
- POWERFUL SECURITY KEY: The Security Key NFC is the essential physical passkey for protecting your digital life from phishing attacks. It ensures only you can access your accounts.
- WORKS WITH 1000+ ACCOUNTS: Compatible with Google, Microsoft, and Apple. A single Security Key NFC secures 100 of your favorite accounts, including email, password managers, and more.
- FAST & CONVENIENT LOGIN: Plug in your Security Key NFC via USB-A and tap it, or tap it against your phone (NFC) to authenticate. No batteries, no internet connection, and no extra fees required.
- TRUSTED PASSKEY TECHNOLOGY: Uses the latest passkey standards (FIDO2/WebAuthn & FIDO U2F) but does not support One-Time Passwords. For complex needs, check out the YubiKey 5 Series.
- BUILT TO LAST: Made from tough, waterproof, and crush-resistant materials. Manufactured in Sweden and programmed in the USA with the highest security standards.
Preserve evidence when misuse or compromise is suspected
Erasing a device can destroy useful evidence. Tell the incident responder about suspected misuse before issuing a wipe when circumstances permit. The responder can decide whether containment must take priority over collection.
- Record the discovery time, last confirmed possession, locations, and people who had access.
- Keep screenshots or exports of unfamiliar sign-ins, password-reset messages, sent messages, payment alerts, and management-console status.
- Do not factory-reset, repeatedly guess the passcode, or install a tracking application while responders are deciding what to preserve.
- Do not alter logs or delete suspicious messages from another device; preserve them in the format your organization requests.
- Ask whether law enforcement, legal, privacy, or regulatory teams must be notified because of the data involved.
Evidence preservation does not mean leaving a risky account open. Responders should balance access containment, operational impact, and the chance of recovering information needed to understand the incident.
If the phone is found
Do not immediately return it to normal use. Keep it isolated from work systems until IT confirms the lock or lost-mode status, checks management telemetry, and determines whether the device was unlocked or altered.
- Tell IT where and when it was recovered and whether it was unattended.
- Leave suspicious notifications, new applications, changed settings, or unfamiliar accessories in place long enough for responders to document them, unless there is an immediate safety risk.
- Have IT verify the device’s enrollment, compliance state, certificates, and recent sign-ins.
- Change any credentials that may have been exposed before reconnecting the phone to work services.
- Follow the organization’s decision on whether to re-enroll, inspect, or replace the handset.
If the phone cannot be recovered
Keep the incident open until IT confirms that device and account controls are complete. Obtain written confirmation of which actions succeeded, which remained pending because the phone was offline, and whether the device was removed from management or trusted-device lists.
Free tools Windows power users keep installed
One-click scans. No signup required.
Ask for replacement procedures that do not reuse the missing phone as the only second factor. Register the replacement device through the organization’s approved enrollment flow, install only approved applications, and restore data from a known-good backup rather than copying an unverified handset image.
Best Value
- FIDO2 & Passkey Ready: Business-ready and FIDO2 L1 certified. This key is supported by major management suites and is ideal for both individual and enterprise deployment. Works seamlessly with Gmail, Facebook, GitHub, Dropbox, Coinbase, and more.
- Universal Connectivity (USB-A ): Features a built-in USB-A connector—simply unfold the key and plug it into your compatible PC or laptop for seamless authentication on the go.
- Dedicated Manager App: Use the Thetis Manager App for the initial hardware PIN setup. Setting the PIN on the device first ensures a smooth registration process. Once the PIN is configured, you can begin registering the key across your favorite FIDO2-compatible online services.
- Ultra-Durable & Portable: Featuring a rotating metal cover, this key is water, crush, and tamper-resistant. It fits easily on a keychain and requires no batteries or network connectivity.
- Check FIDO2 compatibility before purchase - Known limitations: ID Austria is not supported (requires FIDO2 Level 2). Windows Hello login only works with Windows Enterprise editions that support Entra ID, and NFC is NOT supported.
Harden accounts after control is restored
Once access is stable, review the account as though an attacker had time to change recovery options.
- Review signed-in devices, recent sign-ins, sessions, and security events; remove anything you do not recognize.
- Check the recovery email address and phone number, forwarding rules, delegated access, and alternate authentication methods.
- Confirm that the organization’s multi-factor authentication policy is applied to every work service, not only email.
- For an Apple Account that may have been compromised, Apple advises changing the password, reviewing account details and recognized devices, and checking control of associated email addresses and phone numbers.
- Consider a FIDO2 security key only if the employer and identity provider support it, the account policy permits it, and you can maintain an approved backup method. A security key protects future sign-ins; it cannot locate, lock, wipe, or repair the missing phone.
Common failures and how to respond
The remote command says pending
Keep the command active and ask IT to confirm the device’s last check-in. A powered-off or disconnected phone cannot receive the action. Revoke accounts and sessions immediately rather than waiting for the handset to reconnect.
IT can see a location but cannot wipe
Location and erase have separate eligibility requirements. Confirm ownership, supervision, enrollment type, operating-system version, and whether the device is online. Continue account containment while the administrator determines whether a work-profile wipe or full erase is available.
Recommended Free Tools
You are worried about personal photos and messages
Stop before approving a full erase. Ask IT to identify whether the phone is BYOD, work-profile managed, or fully managed, and request the exact data scope in writing. A work-account or work-profile wipe may meet the organization’s requirement without deleting the entire personal device, but only the enrollment policy can establish that.
The phone was unlocked when it disappeared
Report that fact prominently. An unlocked handset can expose active sessions and locally cached files even if it later receives a lock command. Prioritize session, token, certificate, and password revocation while IT attempts remote containment.
You cannot reach the normal help desk
Use the security incident hotline, after-hours number, manager, or another trusted organizational channel. Contact the carrier in parallel when the mobile line or SIM could enable account takeover, and document every attempted notification.
Quick Recap
Printable incident checklist
- Trusted channel used to notify IT/security and manager.
- Last known time, place, possession, and network state recorded.
- Unlocked status and sensitive work data identified.
- Ownership and management mode confirmed.
- Lock or Lost Mode requested and delivery status tracked.
- Location requested where policy and platform support it.
- Work credentials, certificates, active sessions, and refresh tokens revoked as applicable.
- Exposed passwords changed from a trusted device.
- Carrier account, SIM, or eSIM protected where necessary.
- Wipe scope approved: work profile/account or full device.
- Evidence and incident timeline preserved.
- Recovery methods, recognized devices, and account details reviewed after replacement.
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
Quick wins for a faster PC:
Clear out junk files and repair common Windows errorsFree Scan →Fix the driver behind crashes, sound loss and screen glitchesFind Drivers →Repair Windows errors before they cause bigger problemsFix Now →
