My phone is lost or stolen and my social accounts were open on it. What should I do first?
The short answer
Use this guide when the physical phone is missing, even if no unfamiliar login alert appears. Your existing session may already be on it. From a safe device, start the phone’s official lost-device controls, contact the carrier and secure accessible accounts. These are separate tasks; completing one does not prove the others are safe.
What this answer is based onWhat to do
Prepare account usernames, a safe alternate device, any privately saved backup codes, the carrier’s known contact details and the device serial number or IMEI if available. Record when it disappeared and the actions taken. Do not put passwords, codes, identity documents or device identifiers in a public help post.
- From a safe device, open the official lost-device service yourself. For iPhone, use icloud.com/find and Mark as Lost; Find Devices can be used without a verification code. For Android, use android.com/find / Find Hub and its lost-device controls. Check whether the action actually took effect. Do not wait for the phone to reappear before protecting accounts. If theft is suspected, do not pursue the map location yourself; contact local police. Do not disclose codes to someone claiming to have found it.
- Contact your carrier through its known website or number and ask about suspending the missing SIM/eSIM and replacing it. Separately, from the trusted session you still control, review Instagram and Facebook security settings and end sessions on the missing phone. Keep your safe session available; do not deliberately log out of it just to start over. Labels may appear under Accounts Center or Meta Account. Secure the linked email and exposed passwords too. Do not keep requesting SMS to the missing phone. If your second factor is unavailable, use the lost-authenticator guide; if someone changed your recovery details, use hacked-account recovery.
- If recovery of the device is unlikely, review the official remote-erase warning and your backups before deciding: deletion is irreversible. Android factory reset ends Find Hub availability and may leave SD-card data. Do not remove a missing iPhone from Find My, even after erasing: that removes Activation Lock. Remote actions depend on the service and device state, so a submitted request is not proof of completion. If remote protection is unavailable, continue carrier and account security; use the related official recovery guidance for any account you cannot access.
The situation
Your phone disappears on the way home. Instagram was signed in, email was available and SMS went to that phone. Facebook still works on your home laptop.
The situation and an improvement
Wait for a new-login warning or assume blocking the SIM protects every account.
Check device protection, carrier action and account sessions separately.
More examples
The missing phone is offline
You sent a protection request but cannot confirm it reached the phone.
What to do
Keep the request status under review, but continue securing the mobile line, email and social accounts from a safe device. Do not interpret a last-seen location as current.
A message says the phone was found
A stranger sends a link and asks for a code or for the iPhone to be removed from Find My.
What to do
Do not supply the code or remove the device. Open the official service independently. Apple says it does not contact you to announce that a device has been found.
What this answer is based on
Apple · If your iPhone or iPad was stolensupport.apple.comApple · Find a lost iPhone or iPadGoogle · Find, secure or erase a lost Android deviceGoogle · Lock or erase your lost phone or computerMeta · Instagram security and login activityMeta · Meta Account settings transitionMeta · Protect accounts after credential exposurePrimary source readReview details
Source reviewed:
We read the official source listed for this topic. Other Meta rules are reviewed separately.
Official Apple, Google and Meta guidance read on 7 November 2026. This is a physical-device containment plan, not an account-recovery guarantee. No signed-in interface or carrier account was tested. Meta’s 2021 and 2022 articles support security principles; its April 2026 article explains changing settings names. The order and preparation checklist are ClearRules advice.
Include the guide link, language and wording that needs checking. Add an official source link if you have one. Do not send passwords, login codes or photos of identity documents.
Examples are made up to explain the guidance. Meta decides individual account and content cases.
Sources and related topicsPolicy Graph · Demo in development