Employee Lost a Work Phone? What to Do in the First Hour

In the first hour, do four things in this order: lock the device so nobody can open it, put a callback message on the screen, find out where it last was, and work out what was signed in on it. Erasing comes later, and usually not in the first hour.

The order matters. Most people start by trying to find the phone and only think about locking it once they have failed. Lock first. A locked handset with your number on the screen is both safer and more likely to come back.

Here is the full sequence, and what to do if you have no device management at all.

Minutes 0 to 5: get the facts

Before touching anything, ask three questions and write the answers down.

When was it last definitely in hand? Not “this morning”. A time and a place. This decides whether you are looking at a taxi, a customer site, or a theft.

Was it locked? If the screen lock was enforced by policy, you already know the answer is yes, which changes the urgency considerably.

What was signed in? Email, a CRM, a payments app, a customer database, shared drives. This is the list that determines how serious this is, and it is the list most businesses cannot produce.

If the honest answer to the third question is “I’m not sure”, note that. It is the thing to fix afterwards.

Minutes 5 to 15: lock it

Put the device into lost mode from your console.

Lost mode locks the screen immediately and displays a message you choose. Make that message useful: your business name, a phone number that someone will actually answer, and a short line offering a reward or thanks. “Company device. Please call 555 0134, reward offered” recovers more phones than a blank lock screen ever will.

While a device is in lost mode, NounDesk reports its location, and the lock screen says so. Outside lost mode we do not track location at all, which is the point: this is a recovery tool, not a way of watching where staff go.

A locked device is no longer an emergency. It is a problem. That is a meaningful downgrade and it buys you time to think.

Minutes 15 to 30: look at the location

Check where the device last reported and whether it is still checking in.

A device that is online and stationary at a customer’s address is a phone call. A device that is online and moving is worth reporting to the police with the location, rather than chasing yourself. A device that has not checked in since the moment it went missing is probably switched off or out of coverage, and commands you issue will queue and run when it comes back.

Resist the urge to go and collect it in person from an unknown address. That is what the police are for, and a phone is worth less than the alternative.

Minutes 30 to 45: contain the accounts

This is the part device management does not do for you, and it is often more important than the handset.

Change the password on anything critical that was signed in, and sign out other sessions where the service supports it. Email first, then anything with customer data, then anything that can move money.

If the phone was locked and encrypted, you have time and this is precautionary. If it was not, treat it as urgent.

Tell the person whose phone it is what you are doing. They are already embarrassed. Being methodical rather than annoyed gets you better information, which is what you need right now.

Minutes 45 to 60: decide about wiping

Do not rush this. A wiped phone stops reporting its location, so erasing ends any chance of recovery.

Wipe now if the device holds sensitive customer data and was not locked, or if you have reason to think it was stolen rather than lost, or if a client contract or regulator requires it.

Wait if it was locked and encrypted, it is somewhere plausible like a customer site or a taxi, and it is still checking in. Give it a day. Most phones that are going to come back come back within twenty-four hours.

When you do erase, factory reset protection stays in place, so the handset cannot simply be wiped and resold as clean. Our lost device feature page covers exactly what erase does and does not do.

If you have no device management

You can still do some of this, and it is worth knowing where the gaps are.

Google’s Find My Device may locate a personal-style Android account if location was enabled and the device is online. Change passwords on every account that was signed in, because that is now your only real control. Report the IMEI to your carrier so the handset can be blocked, and to the police for the crime reference your insurer will ask for.

What you cannot do is put your own message on the lock screen, guarantee the device was locked in the first place, or erase company data selectively. That gap is the argument for device management, and it is always clearest at exactly this moment.

Afterwards: the part that pays for itself

Once the phone is resolved, spend twenty minutes on the review while it is fresh.

Write down what was actually signed in on that device, because you will have discovered it the hard way. Check whether your screen lock policy was really enforced on every handset or only most of them. Ask whether the employee knew who to call and how fast they told you; if there was a two-hour delay because they hoped it would turn up, that is a process problem rather than a technology one.

Then decide whether the same thing happening next month would go any better.

What to do this week

1. Write the one-page lost phone card. Who to call, what happens next. Give it to everyone who carries a company device. Most delays are people not knowing it is fine to report it.
2. Check your lock screen message is set before you need it. Configuring the callback number during an incident is not when you want to be doing it.
3. List what is signed in on one phone. Pick any device. The list will surprise you, and it is the single most useful thing to know in the first five minutes.

FAQ

Should I wipe immediately?

Usually not. Wiping ends location reporting and any chance of recovery. Lock first, assess what was on it, and wipe if the data is sensitive or the device looks stolen.

Can I see where the phone is?

With NounDesk, only while it is in lost mode, and the lock screen tells the holder that location is being reported. There is no location tracking outside lost mode by design.

What if the phone is switched off?

Commands queue. Lock and erase will run the moment the device next connects. A device that never reconnects keeps whatever protection was already on it, which is why an enforced screen lock and encryption matter before anything goes wrong.

Does erasing stop someone reselling it?

It removes your data and leaves factory reset protection in place, so the handset cannot be set up as clean without the original credentials. It is not a brick, but it is far less useful to a thief.

The hour after a phone goes missing is not the time to be reading documentation. Decide the sequence now, while nothing is wrong.

See how lost mode works, or start a free trial and set your lock screen message today.