The phone was there when you left the meeting. Now the pocket is empty, and it has your work email, client messages and sign-in codes on it.
Start with a call to your IT contact or the person who handles security. Use another phone and a number you already trust. Tell them the device is missing, even if you think it will turn up. You can keep looking while they work out what needs protecting.
For a small business, the awkward part is often knowing who can actually do something. A device might belong to an employee, the mobile contract might be in the director’s name, and the email account might be managed by an outside supplier. Bring those people together early.
Give the responder something useful to work with
Write down what you know. A rough timeline is better than trying to reconstruct everything later.
- Who used the phone and whether it belongs to the business or the employee.
- When and where it was last seen.
- Whether it was locked when it went missing, if known.
- Which work accounts and authentication apps were on it.
- Whether files, email attachments or customer photographs were stored locally.
- Whether anything suspicious has happened since, such as unexpected sign-in prompts.
Keep passwords, recovery codes and device PINs out of this incident note. Your responder needs to understand the exposure, not collect everyone’s secrets in a shared document.
Be clear about uncertainty. “Usually locks after a minute” is different from knowing it was locked. The administrator may be able to confirm settings from the device management service.
Lock the phone and deal with work access
Ask the authorised administrator to use the controls available for that device. These might include remote locking, marking it as lost or restricting work access. Available actions depend on how the phone was set up before it disappeared.
Microsoft’s Intune device actions guidance explains that remote commands depend on device enrolment, permissions and connectivity. A command waiting to be delivered is not confirmation that the phone is protected.
For an iPhone, Apple’s lost-device instructions cover Find My and Lost Mode. They also explain contacting the mobile provider and police. Use official apps or websites. A message claiming someone has found the phone could be another attempt to get the account password.
Ask the IT contact to check access separately from the device itself. Work email, accounting software and messaging services may have their own sessions. Depending on the circumstances, the responder may need to block sign-ins, revoke sessions or change affected credentials.
Microsoft’s emergency access guidance makes an important distinction here. Applications can control their own sessions, so access does not necessarily stop everywhere immediately after one central action. Locally stored data also remains a separate concern. Record what has been done and what still needs checking.
Decide carefully before erasing anything
A full device wipe can remove personal photographs and messages as well as business information. It can also destroy information that might help an investigation. The person responsible for the response should decide what to preserve and which action is appropriate.
For a personal phone used for work, follow the agreed device policy and check the organisation’s authority. Where supported, removing managed work data may be the appropriate option. Don’t assume that permission to manage a work app means permission to erase the whole phone.
Microsoft distinguishes retiring a managed device from a full wipe. The effect varies by platform and configuration, so have the administrator check the current instructions for the exact device. For an offline iPhone, Apple says remote erasure begins when it next comes online. Keep watching the status instead of treating the request as a completed task.
Assess the information involved
Ask whoever handles data protection to assess whether a personal data breach has occurred and the risk to people. Consider what information was accessible and the protections actually in place. An encrypted, locked phone and an unlocked phone showing customer records present different facts.
Under UK GDPR, a breach must be reported to the ICO unless it is unlikely to result in a risk to people’s rights and freedoms. A reportable breach must be notified without undue delay and within 72 hours of awareness, where feasible. High-risk breaches also require affected people to be told without undue delay. Keep a record of breaches and the reporting decision. The ICO’s breach guide explains these thresholds and how to report before every detail is available.
Get the person working again safely
Assign someone to arrange a replacement device and an approved way back into work accounts. Losing the only authentication device can otherwise leave a colleague locked out while urgent work piles up.
Use the organisation’s identity checks before resetting authentication. A rushed request for a new sign-in method still needs checking, even when the name is familiar. Keep the replacement process separate from the missing-device investigation so neither gets forgotten.
Before closing the incident, give each unfinished action an owner. That might mean confirming a pending command, checking recent account activity or replacing a weak recovery arrangement. Add the incident contact number to somewhere staff can reach without their work phone. A response plan saved only on the missing device is difficult to use.