Add up what is on your phone. Your bank. Your email, which is the reset button for every other account you own. Photos of your kids. Your cards in the tap to pay app. The codes that prove you are you when a website asks. Thirty years ago that was a filing cabinet, a safe, and a wallet, and you would not have left any of them on a restaurant table.
None of this is a reason to panic. It is a reason to spend twenty minutes on settings you already have, because phones ship with good protections partly off and most people never revisit them. Everything below is free and built in. We will also cover the first hour after a phone goes missing, because knowing that in advance is the difference between an annoying day and a bad month.
A SIM Swap Steals Your Phone Number Without Touching Your Phone
This is the attack most people have never heard of, and the one worth understanding first, because it goes around almost everything else you do. The Federal Trade Commission describes it in its guidance on SIM swap scams. A scammer calls your cell phone company, says your phone was lost or damaged, and asks the provider to activate a new SIM card connected to your number, on a phone they own. Your number now rings on their device, and every text meant for you goes to them.
That matters because so many accounts use a texted code as proof of identity. Once someone controls your number, they can request password resets and receive the codes, while your phone never left your pocket.
The FTC says the warning sign is your phone suddenly stopping: no data, no texts, no calls, sometimes with an unexpected notification that your SIM was activated on a new device. If that happens and you are not somewhere with bad reception, treat it as urgent, not a network glitch.
Lock the Carrier Account, Not Just the Phone
The good news is that you have more protection available than a few years ago, and most of it sits unused. The Federal Communications Commission adopted rules in 2023 to address SIM swap and port-out fraud. Under those rules, wireless providers must securely authenticate a customer before a SIM change or a port-out, must notify customers immediately of any such request before it happens, and must “offer all customers, at no cost, the option to lock or freeze their account to stop SIM changes.” A port-out is a request to move your number to a different carrier.
Call your carrier or open their app and do three things:
- Set an account PIN or passcode. The FTC’s advice is direct: set up a PIN or password on your cellular account. Pick something not tied to you, not the last four of your Social Security number, not a birthday.
- Turn on the SIM lock and the port freeze. Carriers use different names, so ask for the setting that prevents your number from being moved or your SIM from being changed. It is free, and there is no good reason to leave it off.
- Confirm where notifications go. Make sure the carrier has a current email address, so an alert about a SIM change does not arrive only as a text to a number you no longer control.
Then reduce what a stolen number is worth. Wherever an important account offers a choice, move off texted codes. The FTC recommends an authenticator app or a security key if you are concerned about SIM card swapping. A code generated on your device, or a key in your pocket, cannot be redirected by anyone at a phone store. We compared the options in YubiKey vs passkey vs MFA.
The Lock Screen Does Two Jobs
The first job is keeping people out. Most phones default to a short numeric code, and most people pick a year. A birth year, a wedding year, a child’s birth year. Anyone who has seen your social media can try the ten most likely ones in a minute, and thieves do exactly this. In your phone’s security settings, find the passcode or screen lock option and switch to a longer code or an alphanumeric password. Six random digits beats four, and a short passphrase is better still. Face or fingerprint unlock handles most of the day anyway, so the real cost is a few seconds a week.
The second job is controlling what a stranger can read without unlocking anything. Glance at a locked phone and you can often see message previews, calendar entries, and the exact verification code a bank just sent. Look for the notification settings that control lock screen previews, and set them so message contents stay hidden until the phone is unlocked. You still see that a message arrived. A stranger sees nothing useful. Check which apps and shortcuts are reachable from the locked screen too, and switch off anything that does not need to be.
Turn On Find My and Remote Wipe Before You Need Them
Both major phone platforms include a device locator that also lets you lock the phone remotely, display a message on it, and erase it from another device or a web browser. It is free, and useless if you turn it on after the phone is gone.
Find it in settings under your account name, in the section covering find my device or device tracking, and turn it on for every phone in the house. Verify two things. That it works when the device is offline, which most modern phones support. And that you know your account password without looking it up on the phone you just lost. Also confirm the phone is backing itself up, because remote wipe is much easier to press when everything already exists somewhere else.
The First Hour After You Lose It
Order matters, because the goal is to cut off the most damaging paths first. Work through this on a laptop or a borrowed phone.
- Mark the device lost. Sign in to your platform’s find my device site and use lost mode. It locks the phone, keeps tracking on, and lets you post a callback number. Do this before deciding whether to erase it, because a phone left in a restaurant is a different problem than a stolen one.
- Call your carrier and suspend the line. This stops the number from being used, and stops anyone from talking a store into a SIM swap while you are distracted.
- Change your email password. Email is the master key, because it resets everything else. Do it from a computer, and sign out all other sessions if the service offers it.
- Check your financial accounts. The FTC’s advice after a SIM swap fits here too: check your credit card, bank, and other financial accounts for unauthorized charges.
- Erase it if it does not come back. Once you are sure the phone is gone for good, wipe it remotely. If your backups are current, you lose nothing that matters.
Worth writing on a card in your actual wallet. Nobody thinks clearly in the first ten minutes after realizing a phone is missing.
The Bottom Line
Your phone carries more of your life than your wallet ever did, and it deserves at least the same care. Put a PIN on the carrier account and turn on the free SIM lock. Use a passcode longer than four digits. Hide message previews. Turn on find my device and check that backups run. Move important accounts off texted codes where you can.
That is one sitting, and then it protects you quietly for years. The people who come through a lost phone with nothing worse than an insurance claim are the ones who did these things on an ordinary Tuesday, long before they needed them.
If you work through this and something does not match what you see on your phone or in your carrier’s app, ask us. We do this for businesses around Denton County all week, and we are glad to help a neighbor sort out a setting. Contact us today.
Sources:
Comments are closed