Report the phone to your employer’s IT or security team immediately, then have them lock or locate it, revoke its access, and decide whether a work-profile or full-device wipe is justified. Do not assume a remote command worked while the handset is powered off or offline. Treat a wipe as potentially destructive to personal information, and preserve incident evidence before erasing when misuse or compromise is suspected.
What to do in the first 15 minutes
Use a different trusted device or a phone number you know is safe to contact your IT/security desk and manager. Do not wait to search for the handset before reporting it. Tell them:
As an Amazon Associate I earn from qualifying purchases.
- When and where you last had the phone.
- Whether it was unlocked, whether its passcode may be known, and whether a SIM or eSIM was active.
- Which work accounts, certificates, authenticator apps, VPN profiles, or sensitive files were on it.
- Whether you see suspicious messages, sign-ins, password-reset notices, new mailbox rules, or other signs of misuse.
- Whether the phone is personally owned with a work profile or organization-owned and fully managed.
Ask the mobile provider for help protecting the phone number or service when appropriate. CISA advises reporting a lost phone to the organization and/or carrier, while Google’s work-device guidance tells users to notify their administrator.
Immediate containment checklist
- Report: Open an incident with IT/security and provide the facts above.
- Contain the handset: Ask the administrator to issue the appropriate lock, Lost Mode, locate, or wipe command.
- Revoke access: Have IT revoke device certificates, stored work credentials, active sessions, and refresh tokens where the identity system supports those actions.
- Change exposed passwords: From a separate trusted device, change passwords that may have been visible or stored on the phone.
- Preserve evidence: Save relevant alerts, screenshots, timestamps, and messages before actions that could destroy useful evidence, if responders say preservation is needed.
A command shown as pending is not proof that the phone is locked or erased. Google states that management actions require the device to be powered on and connected; Apple likewise requires internet connectivity for Managed Lost Mode commands. Ask IT to confirm the final status in its management console.
#1 Best Overall
- POWERFUL SECURITY KEY: The YubiKey 5C NFC is the most versatile physical passkey, protecting your digital life from phishing attacks. It ensures only you can access your accounts
- WORKS WITH 1000+ ACCOUNTS: Compatible with popular accounts like Google, Microsoft, and Apple. A single YubiKey 5C NFC secures 100+ of your favorite accounts, including email, password managers, and more
- FAST & CONVENIENT LOGIN: Plug in your YubiKey 5C NFC via USB and tap it, or tap it against your phone (NFC), to authenticate. No batteries, no internet connection, and no extra fees required
- MOST SECURE PASSKEY: Supports FIDO2/WebAuthn, FIDO U2F, Yubico OTP, OATH-TOTP/HOTP, Smart card (PIV), and OpenPGP. That means it’s versatile, working almost anywhere you need it
- PRIMARY & SPARE KEYS: Just like having a spare house key, we recommend buying two YubiKeys - one for daily use and one as a spare. That way you’ll never get locked out of your accounts
Why ownership and enrollment change the answer
“Work phone” describes the business use, not necessarily the management model. The same handset can have very different remote controls depending on how it was enrolled.
| Situation | Likely organizational control | Personal-data impact |
|---|---|---|
| Organization-owned, fully managed device | Administrator may be able to lock, locate, display a contact message, reset a passcode, revoke credentials, or erase the device, subject to platform and enrollment requirements. | A full erase normally removes everything stored on the handset. |
| Personally owned phone with a work profile or managed account | IT may be able to remove the work profile or account and revoke work access. Full-device actions depend on the specific enrollment and policy. | A work-only wipe can preserve personal content; a full wipe can remove it. Confirm which command is being proposed before approving it. |
| Unmanaged personal phone used for work | IT can still disable accounts, revoke sessions and tokens, and require password changes, but may have no device-management command. | Personal data is generally outside an employer’s direct device controls, although work data may remain exposed until account access is revoked. |
Do not promise yourself that an employer can erase only business information. Google warns that erasing a managed device can remove work and personal information in some configurations. The enrollment record, not the ownership label alone, determines what can be wiped.
Use the least-destructive device action that contains the risk
Lock or Lost Mode
A lock prevents casual access while preserving the possibility of recovering the phone. A managed Lost Mode can also show a contact message and, on supported platforms, provide a location to administrators. Choose this first when the phone may be recovered quickly, the passcode is still secret, and responders do not need an immediate destructive action.
Work-profile or work-account wipe
This removes the managed work container, account, or corporate data while aiming to leave personal content intact. It is often the right balance for a personally owned device, but the exact result depends on the enrollment mode and platform. Ask IT to state explicitly whether the command is a work-only wipe, what data it removes, and whether it can be reversed.
Full-device erase
A full erase is appropriate to discuss when theft is likely, the unlock code may be known, sensitive data was stored locally, or compromise is credible. It is irreversible for data that has not been backed up and may remove personal photos, messages, and accounts. Coordinate the decision with IT/security rather than issuing a personal erase command before the incident is classified.
Rank #2
- POWERFUL SECURITY KEY: The Security Key C NFC is the essential physical passkey for protecting your digital life from phishing attacks. It ensures only you can access your accounts.
- WORKS WITH 1000+ ACCOUNTS: Compatible with Google, Microsoft, and Apple. A single Security Key C NFC secures 100 of your favorite accounts, including email, password managers, and more.
- FAST & CONVENIENT LOGIN: Plug in your Security Key C NFC via USB-C and tap it, or tap it against your phone (NFC) to authenticate. No batteries, no internet connection, and no extra fees required.
- TRUSTED PASSKEY TECHNOLOGY: Uses the latest passkey standards (FIDO2/WebAuthn & FIDO U2F) but does not support One-Time Passwords. For complex needs, check out the YubiKey 5 Series.
- BUILT TO LAST: Made from tough, waterproof, and crush-resistant materials. Manufactured in Sweden and programmed in the USA with the highest security standards.
| Action | Security benefit | Main trade-off | Ask before using it |
|---|---|---|---|
| Lock | Stops ordinary access without destroying data. | Does not remove credentials already copied or sessions already active. | Will the device receive the command, and is its status confirmed? |
| Locate | Can help recovery and establish the last known position. | Eligibility and accuracy vary; it does not itself revoke account access. | Who can view the location and how long is it retained? |
| Work-profile/account wipe | Removes managed corporate data with less effect on personal data. | May leave an unmanaged personal portion of the phone in place. | Exactly which profile, keys, and files will be removed? |
| Full-device wipe | Removes local data and makes the handset harder to misuse after it checks in. | Destroys personal data and potential evidence; cannot act until the phone connects. | Has evidence been preserved, and is the device eligible for remote erase? |
What the major management platforms can do
Apple managed devices
Apple Business Managed Lost Mode applies to supervised iPhone and iPad devices enrolled in Apple’s built-in device management. Apple says Find My does not have to be enabled for this managed feature. When the device reaches the internet, the administrator can lock it and display a contact message. A remote erase also requires eligible built-in device-management enrollment and a network connection.
If the console reports that the command is waiting, treat the phone as potentially accessible. Keep account containment running in parallel; the device might not reconnect for hours or ever.
Android Enterprise
Android Enterprise Lost Mode can lock a device and report its location to IT, but availability is conditional. The documented cases are Work Profile on company-owned devices running Android 13 or later, and fully managed devices running Android 11 or later. The organization’s enterprise mobility management system must use the Android Management API.
Those requirements mean an Android phone that merely has a work account added is not automatically eligible. Have IT verify the Android version, enrollment type, and management integration before relying on Lost Mode.
Google Workspace controls
Depending on the device and administrator configuration, Google Workspace users or administrators may see options such as lock, passcode reset, device wipe, or work-account wipe. Google cautions that a full erase can remove personal information in some setups. Management actions require the phone to be on and connected to a network.
Rank #3
- POWERFUL SECURITY KEY: The YubiKey 5 NFC is the most versatile physical passkey, protecting your digital life from phishing attacks. It ensures only you can access your accounts
- WORKS WITH 1000+ ACCOUNTS: Compatible with popular accounts like Google, Microsoft, and Apple. A single YubiKey 5 NFC secures 100+ of your favorite accounts, including email, password managers, and more
- FAST & CONVENIENT LOGIN: Plug in your YubiKey 5 NFC via USB and tap it, or tap it against your phone (NFC), to authenticate. No batteries, no internet connection, and no extra fees required
- MOST SECURE PASSKEY: Supports FIDO2/WebAuthn, FIDO U2F, Yubico OTP, OATH-TOTP/HOTP, Smart card (PIV), and OpenPGP. That means it’s versatile, working almost anywhere you need it
- PRIMARY & SPARE KEYS: Just like having a spare house key, we recommend buying two YubiKeys - one for daily use and one as a spare. That way you’ll never get locked out of your accounts
Microsoft Intune
Intune’s Locate Device action collects location when an administrator initiates it. Microsoft documents that location data is encrypted in transit and at rest and stored for 24 hours; a last-known location may remain for up to seven days. Platform support, user notifications, and the exact available actions vary, so IT should verify what the enrolled device supports rather than assuming every Intune command is universal.
Do these 3 things before closing this tab:
1Fix the driver behind crashes, sound loss and screen glitches2Clear out junk files and repair common Windows errors3Scan for outdated or missing drivers - takes under a minuteSecure accounts even if the phone is locked
Locking the handset does not undo credentials that were copied, tokens that remain valid, or sessions opened before the loss. Ask IT to perform the identity-side actions that apply to your environment:
- Revoke device certificates and mobile-management credentials.
- Invalidate active sessions and refresh tokens where supported.
- Disable or reset the missing device’s authenticator registration.
- Remove the device from approved or recognized-device lists.
- Revoke VPN, email, cloud-storage, password-manager, and business-application access.
- Check for new mailbox forwarding rules, suspicious OAuth grants, changed recovery details, or unusual sign-ins.
Change any password that could have been exposed, including a device passcode reused elsewhere. Perform the change from a trusted computer or phone, not from the missing handset. If the phone contained a password manager, treat the stored credentials as potentially exposed and prioritize the highest-impact accounts first.
When the phone may have been misused
Tell responders exactly what you observed rather than trying to “clean up” the account yourself. Examples include messages sent that you did not write, new sign-ins from unfamiliar locations, a changed recovery number, an unexpected multi-factor prompt, or a corporate file being downloaded. IT can correlate those times with identity-provider and application logs.
Balance containment with evidence preservation
A wipe can stop further access, but it can also remove the local evidence needed to determine what happened. If compromise or deliberate misuse is suspected, ask the security or incident-response team whether to preserve the device state before erasing it.
The Tool Desk
Outbyte PC Repair FREERepair Windows errors before they cause bigger problemsFix Now →Outbyte Driver Updater FREEFix the driver behind crashes, sound loss and screen glitchesFind Drivers →Rank #4
- POWERFUL SECURITY KEY: The Security Key NFC is the essential physical passkey for protecting your digital life from phishing attacks. It ensures only you can access your accounts.
- WORKS WITH 1000+ ACCOUNTS: Compatible with Google, Microsoft, and Apple. A single Security Key NFC secures 100 of your favorite accounts, including email, password managers, and more.
- FAST & CONVENIENT LOGIN: Plug in your Security Key NFC via USB-A and tap it, or tap it against your phone (NFC) to authenticate. No batteries, no internet connection, and no extra fees required.
- TRUSTED PASSKEY TECHNOLOGY: Uses the latest passkey standards (FIDO2/WebAuthn & FIDO U2F) but does not support One-Time Passwords. For complex needs, check out the YubiKey 5 Series.
- BUILT TO LAST: Made from tough, waterproof, and crush-resistant materials. Manufactured in Sweden and programmed in the USA with the highest security standards.
Record the timeline while it is fresh: last confirmed possession, discovery of the loss, reports made, alerts received, commands issued, and status changes in the management console. Keep relevant emails, text messages, sign-in alerts, and screenshots in the organization’s approved incident location. Do not confront a suspected thief, attempt unauthorized access to the phone, or install investigative software.
Evidence preservation does not mean leaving a dangerous account active. Responders should weigh exposure risk, operational impact, and evidentiary value. Revoking tokens and disabling accounts may be urgent even if a full device image cannot be obtained.
Contact the mobile provider when service itself is at risk
The carrier may be relevant when the phone, SIM, or eSIM could receive calls and text messages used for recovery. Ask IT or the provider what service-protection steps are available for your account and region. This is separate from device management: a carrier action may protect the number while the management console is still waiting for the handset to reconnect.
Do not treat a suspended line as proof that work accounts are safe. Applications may continue using existing sessions, and Wi-Fi can allow a phone to reconnect without cellular service. Account revocation and device containment remain necessary.
Recommended Free Tools
After access is restored: rebuild trust
Review identity and recovery settings
From a trusted device, review signed-in devices, recent sign-ins, account details, recovery email addresses, recovery phone numbers, and multi-factor methods. Remove anything you do not recognize. Apple’s account-compromise guidance specifically recommends changing the account password, reviewing recognized devices and account details, and confirming control of associated email addresses and phone numbers. Apply the equivalent checks to your employer’s identity provider.
Best Value
- FIDO2 & Passkey Ready: Business-ready and FIDO2 L1 certified. This key is supported by major management suites and is ideal for both individual and enterprise deployment. Works seamlessly with Gmail, Facebook, GitHub, Dropbox, Coinbase, and more.
- Universal Connectivity (USB-A ): Features a built-in USB-A connector—simply unfold the key and plug it into your compatible PC or laptop for seamless authentication on the go.
- Dedicated Manager App: Use the Thetis Manager App for the initial hardware PIN setup. Setting the PIN on the device first ensures a smooth registration process. Once the PIN is configured, you can begin registering the key across your favorite FIDO2-compatible online services.
- Ultra-Durable & Portable: Featuring a rotating metal cover, this key is water, crush, and tamper-resistant. It fits easily on a keychain and requires no batteries or network connectivity.
- Check FIDO2 compatibility before purchase - Known limitations: ID Austria is not supported (requires FIDO2 Level 2). Windows Hello login only works with Windows Enterprise editions that support Entra ID, and NFC is NOT supported.
Re-enroll deliberately
Have IT reissue certificates, enroll the replacement phone, and register a new authenticator rather than copying an old backup whose trust status is unclear. Confirm that the replacement has a screen lock, current operating-system updates, encryption, and the organization’s required management profile before using it for work.
Consider a hardware security key
A FIDO2 security key can add a phishing-resistant sign-in factor after recovery. It does not locate, lock, wipe, or repair a missing phone. Use one only if the work identity provider, account policy, and employer support it, and register a spare key according to company procedure. Apple lists security keys as an additional protection option for Apple Accounts; work-account compatibility must be checked separately.
Check for secondary damage
- Review email sent items, forwarding rules, calendar changes, cloud-file sharing, and recent downloads.
- Ask application owners to inspect high-risk actions made during the exposure window.
- Confirm that payroll, finance, customer, and administrative accounts have their own sign-in reviews.
- Document which credentials were revoked and which devices were removed from management.
Decision playbooks for common situations
The phone is probably nearby and was locked
Report it, request a lock and locate action, and ask IT to monitor the command status. Avoid a full wipe until the search and evidence decision is complete. Revoke high-risk sessions if the phone was unlocked at any point.
The phone was stolen and contained sensitive files
Report the theft and contact the carrier as appropriate. Ask IT to revoke credentials and tokens immediately, then evaluate a full erase. If the phone was unlocked or the passcode may be known, the risk threshold for wiping is lower than for a merely misplaced, locked device.
A personal phone has a work profile
Tell IT that it is BYOD and ask which enrollment mode is recorded. Prefer a work-profile or work-account wipe if it removes the corporate data you need to protect. Do not authorize a full-device erase until you understand the effect on photos, messages, backups, and other personal information.
You see suspicious activity but still have the phone
Disconnect it from work services only as directed by responders, preserve alerts and timestamps, and avoid resetting or wiping it before the incident team decides. Account sessions and tokens may need revocation even though the handset is physically present.
The management command is still pending
Assume the command has not taken effect. Keep credentials revoked, continue account monitoring, and ask IT whether the phone has checked in. A powered-off or offline handset cannot receive a remote command until it reconnects.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
Mistakes that make a lost-phone incident worse
- Waiting until the end of the day to notify IT because the phone may turn up.
- Changing one password while leaving active sessions, refresh tokens, certificates, or authenticator registrations valid.
- Assuming a work profile means a full-device wipe is impossible, or assuming an employer can wipe only work data without checking enrollment.
- Issuing an erase before saving alerts, timestamps, or other evidence when misuse is suspected.
- Relying on a pending console command instead of confirming that the phone checked in.
- Using the compromised phone to change passwords or approve unexpected multi-factor prompts.
- Buying a security key without confirming support from the employer’s identity provider and account policy.
A reusable incident checklist
| Stage | Owner | Completion test |
|---|---|---|
| Report and describe exposure | Employee, manager, IT/security | Incident number or documented report includes time, place, lock state, data, and suspicious activity. |
| Contain handset | IT/security | Lock, Lost Mode, locate, profile wipe, or erase is selected according to enrollment and risk. |
| Confirm delivery | IT/security | Management console shows a completed status, not merely pending. |
| Contain identities | IT/security and employee | Credentials, sessions, tokens, certificates, authenticators, and exposed passwords are addressed. |
| Preserve evidence | Incident responders | Alerts, screenshots, logs, and a timeline are retained when compromise or misuse is suspected. |
| Recover and harden | IT/security and employee | Replacement device is managed, account details are reviewed, and approved stronger authentication is enabled. |
The practical rule
Report first, contain both the phone and its accounts, and verify every remote action. Locking or Lost Mode preserves recovery options; wiping is more destructive and may erase personal data or evidence. The correct choice depends on ownership, enrollment, operating-system version, connectivity, identity-provider capabilities, and your employer’s incident policy.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
