What to do when your mobile device is missing or stolen

For more tips and how-to’s, visit our tech blog

Whether you’ve lost a phone in an Uber or need to find a missing laptop, few things invoke instant panic like our favourite and most vital technology going missing. These devices are with us for a good part of our lives, and the data held on them includes files, personal financials, apps, passwords, pictures, videos, and so much more.

Your digital footprint is often more important than cash in your wallet. The data on these devices and their access to cloud storage or websites being in the hands of a stranger is quite scary.

There are approximately 70 million lost smartphones every year. The owners only recover about 7% of them. The workplace is where 52% of stolen devices go missing.

In 2020, Lifespan Health System paid a $1,040,000 HIPAA fine. This was due to an unencrypted stolen laptop breach.

If it’s a work laptop or smartphone that goes missing, even worse. This can mean the company is subject to a data privacy violation. It could also suffer a ransomware attack originating from that stolen device.

The Minutes after the loss of your device are critical

Depending on if the lost device is for business or personal use, the information on it could be misused at any time so the minutes after discovering it’s lost are crucial to locking down as much access as possible.

Your first priority will be to Lock the device, then report the device missing (or stolen) if it’s for business use, then – depending on severity – revoke access or wipe data remotely.

Steps to take immediately after losing your device

Take a deep breath. Anything you can lock down now will help overall, and the more risk you mitigate for a breach of personal or business information.

Here are steps you should take immediately after the device is missing.

Lock the device

Most mobile devices and laptops will include a “lock my device” feature. It allows for remote activation if you have enabled it. You will also need to enable “location services.” While good thieves may be able to crack a passcode, turning that on immediately can slow them down.

Apple/iPhone device lock on iCloud.com/find, Android/Google device lock on android.com/find, Windows device lock on Microsoft Find My Devices. More info on these below.

Report the device missing or stolen to your company if it’s used for work

If you use the device for business, notify your company immediately. Even if all you do is get work email on a personal smartphone, it still counts. Many companies use an endpoint device manager. In this case, access to the company network can be immediately revoked on the missing device.

Reporting your device missing immediately can allow your company to act fast. This can often mitigate the risk of a data breach, which will be much worse than the risk of a disappointed manager.

Log out & Revoke access to cloud storage

It’s very important to include cloud storage applications when you revoke access. Is your missing device syncing with a cloud storage platform? If so, the criminal can exploit that connection. They could upload a malware file that infects the entire storage system. They could also reset your device to resell it, and in the process delete files from cloud storage.

Depending on what service you / your company uses, (Dropbox, SharePoint, Google Drive, etc.) log in to your account from a secure device and log yourself out at all other locations under Account Settings.

Active a "Wipe my device" feature

Hopefully, you are backing up all your devices. This ensures you have a copy of all your files in the case of a lost device.

Does it look like the device is not simply misplaced, but rather stolen or lost for good? If so, then you should use a remote “wipe my device” feature if it has been set up. This will wipe the hard drive of data. See below methods for locating lost devices and locking or wiping them.

What about "Find my device" features?

In your phone or laptop settings, depending on manufacturer, there is usually a “Find my device” feature.

While you may not want to come face-to-face with a criminal, this can be useful to determine if the device has been stolen or simply misplaced. Below are instructions to locate your missing devices.

Health IT does not encourage vigilante behaviour!

Find My iPhone: Go to iCloud.com/find and enter your iCloud login username and password. If you try signing in to iCloud.com the normal way, it may prompt on the lost device for 2-Factor Authentication with your current location, which you may want to avoid.

iPhone Lost Mode: When in the Find my iPhone screen, choose your device from the dropdown at the top and click on ‘Lost Mode’ in the info popup. You’ll get an email to your iCloud email address to set a message on the device to return it, and any credit card services are suspended on the device. You can also see any updates to device location.

Find My Android: If you have your Google Account connected to your Android phone, use the Google Find My Device page. Select the phone from the dropdown at the top of the screen. The lost phone will get a notification. You will now be able to lock the phone with a passcode/pattern, or erase all data on the device.

GMail & Google Drive: If your device has signed into Google via GMail or the YouTube app, you can track its activity in the Google Account screen. Navigate to Security and click ‘Find a lost device‘. You’ll then be able to select the device you’ve lost and try calling it or signing out of your Google account on that device.

Windows Devices: You’ll need to turn on Find My Device first, by going to Start > Settings > Update & Security > Find My Device.
Once enabled, you can go to the Microsoft Devices web page and sign in. From here click ‘Find My Devices‘ and select the device you want to find. From the map, you can choose to Lock the device.

Consider what types of information your device holds

When a criminal gets their hands on a smartphone, tablet, or laptop, they have access to a treasure trove. This includes:

Documents
Photos & videos
Access to any logged-in app accounts on the device
Passwords stored in a browser
Cloud storage access through a syncing account
Emails
Text messages
Multi-factor authentication prompts that come via SMS
And more

It’s absolutely vital to lock down anything you can, and be aware of any loose ends that may lead to further damage.

Need mobile security?

If you’re already a Health IT client, you’ll know how serious we are about security. If you’re new to our ecosystem, reach out and see how your devices stack up!

Article used with permission from The Technology Press.