Lost or stolen work phone: a 10-minute checklist

For a tradie, a support worker or anyone who works on the road, the phone is the office. It holds email, job details, client addresses, photos of sites and often the app that approves sign-ins. When it goes missing, the first 10 minutes matter. Pin this checklist in the office and make sure every mobile worker knows who to call.

Before it happens: three things to set up

The checklist only works if the groundwork is done:

• Enrol phones in Microsoft Intune. Company-owned phones should be fully managed. Personal phones used for work can be enrolled so company data can be removed separately.
• Enforce a passcode. Microsoft is clear that remote lock is only effective if a passcode or PIN is already set. Without one, the screen may just turn off and anyone can still use the phone.
• Agree the call. Staff ring the office or IT provider the moment they realise the phone is gone. They should not wait until the end of the day.

Minute 0 to 2: report it and note the details

The staff member calls the office from another phone. Write down:

• Whose phone it is and whether it is company-owned or personal.
• When and where it was last seen.
• Whether it was lost or taken. If it was stolen, the staff member should report it to police and should not try to get it back themselves.

Minute 2 to 4: lock it and try to find it

In the Intune admin center, under Devices, select the phone and use these actions:

• Locate device shows the approximate location of the device on a map.
• Lost Mode for supervised iPhones locks the phone and shows a custom message and phone number on the lock screen. Write something like "This phone belongs to [business]. Please call [number]." The phone stays locked until an administrator turns Lost Mode off.
• Remote lock locks a managed device so the existing passcode is needed to continue. It is available on iOS, iPadOS and corporate-owned Android devices.

If the phone shows up somewhere sensible, such as the site office or the supplier's counter, a locked phone buys you time to collect it.

Minute 4 to 6: decide between wipe and retire

If there is no quick recovery, remove the data. Intune offers two choices:

• Wipe restores the device to factory settings and removes all data and settings. Use this for company-owned phones that are stolen or unlikely to come back.
• Retire removes company data and settings and leaves personal data intact. Use this for a staff member's own phone, so their family photos are not deleted.

Only one of wipe, retire or delete will run if several are pending, so choose the one you want and send it once. Do the account steps below regardless.

Minute 6 to 8: secure the account

Whoever has the phone may still have a signed-in email app. Close that door:

1. Reset the user's password. Microsoft advises not sending the new password by email, because an attacker could have access to the mailbox. Give it to the staff member by phone or in person.
2. Revoke sessions. In the Microsoft Entra admin center, open the user and select Revoke sessions. By default, access tokens last for one hour, so some apps may keep working until the token expires.
3. Remove the lost phone as an MFA method. Delete the Authenticator registration or passkey on that device, then help the staff member register a new phone.
4. Update app passwords if the account uses any. Microsoft notes they are not revoked automatically when you reset a password.

Minute 8 to 9: check the mailbox for tampering

If there is any chance someone used the phone before it was locked, check the mailbox. Microsoft lists these signs of a compromised account:

• Inbox rules that forward email to unknown addresses.
• Rules that move messages to the Notes, Junk Email or RSS Subscriptions folders.
• Recently added external email forwarding.
• Strange messages in Sent Items or Deleted Items.

Remove anything you did not set up, and tell your IT provider.

Minute 9 to 10: call the telco

Ring your mobile provider and ask them to suspend the service on that number, and ask about blocking the handset. Suspending the SIM stops anyone using it for calls or texts, including any text message codes still linked to the number. Ask for a replacement SIM to be sent to the staff member, not to an address given by someone else.

Afterwards: is it a notifiable data breach?

Losing a device that holds personal information can be a data breach under the Notifiable Data Breaches scheme, which covers businesses with annual turnover above $3 million and some smaller ones, such as health service providers. A breach is only notifiable when serious harm is likely and you have not been able to prevent it.

The OAIC gives a direct example: an employee loses a phone on public transport, and IT remotely wipes it before anyone could realistically access the data. That is not an eligible breach, and no notification is needed. Strong encryption can also make access unlikely. If the phone was not wiped in time and held client details, you must assess the situation promptly and take all reasonable steps to finish within 30 days. This is a plain-English summary, so check with the OAIC or your adviser for your situation.

Keep a short record of what happened, the time of each action and the outcome. If you ever need to show the OAIC or a client what you did, that record is your evidence.

The 10-minute checklist

1. Staff member calls the office from another phone.
2. Note owner, company or personal, time and place.
3. Locate device, then Lost Mode or Remote lock.
4. Wipe a company phone, or retire a personal phone.
5. Reset the password and give it over by phone.
6. Revoke sessions and remove the phone as an MFA method.
7. Check inbox rules and forwarding.
8. Call the telco to suspend the SIM.
9. Record every step and assess whether it is a notifiable breach.