What to do if your phone is lost or stolen

The first call is to your bank, not your network and not the police. A current handset carries tokenised cards in a digital wallet, banking apps that may open on a face or a fingerprint, saved card details in the browser, and often a passcode the thief watched you type on the bus before taking it. Everything else on this page can be done in an hour with no additional loss. The money cannot.

Dial 159 from any phone you can borrow. It is a short code run by Stop Scams UK that routes you to your own bank's fraud team, it cannot be spoofed by anyone calling you, and Stop Scams UK says the participating banks between them cover more than 99 per cent of UK retail current accounts — Barclays, HSBC, Lloyds, NatWest, Santander, Nationwide, Monzo, Starling, Halifax, Metro, TSB, Revolut and many more. If your provider is not on 159, use the number on the back of a physical card.

Ask for four specific things, and write down the time you asked. Freeze the cards held in the wallet on that device. Block the banking app session and force a re-registration on any new device. Flag the account for review if the thief may have seen or known your passcode. And ask for written confirmation of the time you reported it, because that timestamp is the pivot on which your liability turns.

That is not a figure of speech. Regulation 77 of the Payment Services Regulations 2017 lets a payment service provider hold you liable for a maximum of £35 for unauthorised transactions arising from a lost, stolen or misappropriated payment instrument — and expressly removes even that where the transaction happened after you notified them, where they gave you no means of notifying them, or where they failed to apply strong customer authentication when it was required. Full liability only bites where you acted fraudulently, or with intent or gross negligence failed to keep the instrument's security features safe.

So the practical rule is: notify early, notify precisely, and record when you did it. Everything a thief spends after that moment is, as a matter of regulation, not your problem, and everything before it is capped at a low figure unless the bank can show gross negligence — a deliberately high bar the firm has to prove, not one you have to disprove.

If you gave the passcode away — someone shoulder-surfed it in a pub, or you were forced to unlock the phone during the robbery — say that out loud on the call. It changes the bank's response from freezing a card to treating the whole relationship as compromised, and it matters for a later dispute. If a payment has already gone and the bank refuses to put it right, the reporting and escalation route is set out in full on our guide to reporting a scam in the UK, and it does not change because the fraud started with a snatched handset.

In March 2015 the then Department for Culture, Media and Sport announced that EE, O2, Three, Virgin Media and Vodafone had all signed up to a code of practice capping a customer's liability for unauthorised use of a lost or stolen phone at £100, provided the loss is reported within 24 hours to the mobile network and to the police. It covered roughly 27 million pay monthly customers at the time. It is a voluntary undertaking by the operators rather than a statutory right, which is exactly why the 24-hour condition is applied strictly.

EE puts it in plain terms on its own help page: report within 24 hours and you are responsible for a maximum of £100 of unauthorised usage outside your allowance, and if a bill arrives for more than that you can ring 150 to have the excess credited back. Miss the window and, in EE's words, you are liable for the additional charges incurred. O2 caps liability for unauthorised calls and data at £100 on the same 24-hour basis and asks you to report a theft to the police within 24 hours as well.

Two limits are worth spelling out because they catch people. First, the cap is about out-of-allowance usage — premium rate calls, international dialling, roaming data — not about the monthly line rental or device plan, which you keep paying whatever happens to the handset. Second, Citizens Advice notes that the cap applies to monthly contracts, and that on pay as you go you may simply lose whatever credit was spent before you reported it, with no route to a refund.

Ring the network from any phone. The numbers below are the ones each operator publishes for exactly this, and all of them work from abroad, which matters because a great many phones are lost on holiday rather than snatched at a bus stop.

Ask the network for three separate things and check you got all three, because they are genuinely different operations inside the operator's systems: cancel or suspend the SIM so nobody can use your number and your allowance; bar the handset itself by its IMEI so it cannot register on any UK network; and issue a replacement SIM that reactivates your existing number. Vodafone will send a replacement SIM you activate on your original number, and EE will send one or let you collect free in store.

Finally, ask for proof of barring in writing. EE lists proof of barring and proof of purchase among the things it will supply for an insurance claim, and insurers routinely ask for both alongside the crime reference number. Getting them at the moment you report costs you nothing and saves a second call in a fortnight when the claim form asks.

Cancelling the SIM and barring the handset are two different acts, and a rushed call sometimes achieves only the first. Three describes them separately: cancelling the SIM stops anyone using your account, while blacklisting the phone is what makes the device itself useless. If you only cancel the SIM, the thief can drop in a cheap replacement SIM and carry on using the handset — and, more to the point, sell it as working.

Blacklisting works off the IMEI, the fifteen-digit International Mobile Equipment Identity burned into the handset. You find it by dialling *#06# on the phone, which is not much help after the phone has gone, so the single most useful thing you can do today is dial it now and store the number somewhere else — a password manager, a note in your email, the inside cover of a passport wallet. Failing that, it is printed on the original box, appears on the purchase receipt or contract, and is listed in your Apple or Google account against the registered device.

You do not strictly need the IMEI to report the loss — the network can find it from your account — but you do need it for the police report and for an insurance claim, and having it to hand shortens every conversation. Three asks for it when you report to the police for exactly that reason.

Barring is not instantaneous and it is not silent about that fact. Three publishes the timescale plainly: once blacklisted, the device is blocked on Three within 24 hours and on every other UK network within 48. That gap is a real window, and it is another reason the bank call cannot wait for the network call — for up to two days the handset may still be able to make calls and use data on someone else's SIM.

Be clear about what a bar does and does not achieve. It stops the handset registering on UK mobile networks. It does not stop the phone connecting to wifi, it does not by itself remove your data, and it has no effect on what somebody does with the device outside the UK. Those jobs belong to the remote lock and wipe tools in the next section, which is why doing one and not the other leaves half the problem alive.

If the phone turns up in a coat pocket a week later, the bar can usually be lifted — Vodafone runs an unblock form, and O2 asks you to call because the device will otherwise stay blacklisted and unable to use the network. The exception is a device replaced under an insurance claim: Vodafone states that where a replacement has been issued, the block on the original cannot be removed. At that point the handset belongs, in effect, to the insurer.

On an iPhone or iPad, sign in to Find My from another device or a browser and use Mark As Lost. Apple's own description of what that does is worth reading carefully: the device is locked with its passcode, it stops displaying alerts and playing notification sounds, you can put a message and a contact number on the lock screen, you continue to see its current location and any changes to it — and payment cards and other services on the device are suspended. That last line is why Mark As Lost is a money step as much as a hardware step.

On Android, Find Hub is the equivalent, reachable at android.com/find or through the Find Hub app on someone else's device. Google is explicit that it only works if the device still has power and a mobile data or wifi connection, is signed in to your Google Account, has Find Hub turned on and is visible on Google Play. Playing a sound rings it at full volume for five minutes even if it is on silent, which is the fastest way to settle the question of whether the phone is under the sofa or in someone else's pocket.

Marking an Android device as lost locks it with your PIN, pattern or password and lets you put contact details on the lock screen; on newer builds Google has added a two-step unlock requiring both a PIN or pattern and a fingerprint or face check. Google also offers Remote Lock at android.com/lock, which locks the screen using only your phone number — useful precisely because it works when you cannot remember your Google password under stress, and Google's own advice for a stolen phone points at it first.

Erasing is the last resort, and the reason is in Google's own documentation: a factory reset permanently deletes the data, but it may not clear an SD card, and after the erase the device's location is no longer available in Find Hub. In other words, wiping ends any chance of tracking it, and any chance the police recover it from a location you can give them. Lock first. Wipe when you have accepted the phone is gone, or when what is on it is more sensitive than the phone is valuable.

The consolation is that a wiped modern phone is close to worthless to a thief. Google notes you need the Google Account password to use the device again after an erase — factory reset protection — and Apple's Activation Lock does the same job on iPhones. When the Home Secretary convened Apple, Google and Samsung on phone theft in February 2025, these design features were exactly what was being pushed further: Apple's Activation Lock and Stolen Device Protection, Google's Theft Detection Lock, Offline Device Lock and Remote Lock, and Samsung's identity checks and security delays in One UI 7.

Turn those on before you need them. Theft Detection Lock uses the phone's sensors to spot the motion of a snatch and locks the screen automatically; Offline Device Lock locks the screen when the phone has been off the network for a while, which defeats the standard thief tactic of putting the handset straight into flight mode. None of them help if you enable them the day after.

If the theft has just happened, if you were hurt or threatened, or if you can see on Find My that the phone is moving down the street in front of you, call 999. Otherwise the route in England and Wales is 101 or your force's online reporting form, and Citizens Advice gives the same advice: ring 101 or go into a station, quote the IMEI, and note the crime reference number because you will need it for the insurance claim.

In Scotland, Police Scotland takes non-emergency reports on 101 and through its online reporting pages, with 999 reserved for someone in danger or a crime happening now. In Northern Ireland, nidirect sets out the same structure — 999 in an emergency, 101 for non-urgent matters, an online report-a-crime form on the PSNI site, and Crimestoppers on 0800 555 111 if you want to pass information anonymously. Wales uses the England and Wales arrangements and its own territorial forces.

If the phone went on a train, a platform or a station concourse, the force with jurisdiction is the British Transport Police rather than the local force. National Rail publishes BTP's discreet route: text 61016, monitored by contact handlers around the clock, for any non-emergency crime anywhere on Britain's railways, with 999 for an emergency. Reporting to the right force first avoids a transfer and a delay while the crime number is reissued.

Give the police the IMEI, the make, model and colour, the time and the exact location, and — this is the part people leave out — a screenshot of the last known location from Find My or Find Hub with the timestamp visible. That evidence is now more useful than it used to be. The Home Office's Crime and Policing Bill was introduced to give officers a power to enter premises without a warrant where stolen items have been electronically traced there and it is not practicable to get a warrant, using data from a find-my-phone app, wifi access points, Bluetooth, mobile network technology or a tracker. The stated purpose is to let police act inside the golden hour after a theft.

Do not expect the report itself to recover the phone, and do not let that stop you making it. Its immediate value to you is the crime reference number, which the networks and every insurer ask for, and which the voluntary £100 cap is conditioned on because the operators expect a police report inside 24 hours as well as a call to them.

Its wider value is statistical. Snatch theft is measured through categories like theft from the person, which the ONS recorded at 121,161 offences in England and Wales in the year to March 2026, alongside 57,693 robberies of personal property. Those are police-recorded figures, so an unreported theft is invisible to the hotspot mapping that decides where officers stand next month.

This is the part that outlasts the crisis. Your phone was probably the second factor for a dozen accounts, and the recovery route differs for every one of them. Start with email, because it is the reset route for everything else, and work outwards to anything holding money or identity. Then work through the government services one at a time — they do not share a recovery process, and none of them will accept another's evidence that you are who you say you are.

GOV.UK One Login sends security codes either by text message to a UK mobile number or through an authenticator app, and GOV.UK's guidance is that you can change your sign-in details, including the phone number or email address you use to get security codes. If the phone is gone and the code has nowhere to land, the One Login help desk is the human route — it publishes a phone number and a webchat staffed Monday to Friday, and it is the team that handles security-code and sign-in problems rather than the individual departments.

HMRC is a separate system with a separate fix. Its problems-signing-in page explains that access codes can go by text, voice call or authenticator app, and that to change the method — for example when you no longer have the registered number — you sign in with your Government Gateway user ID and password and choose the 'You can get help' option at the point the code is requested. It also states something people waste an afternoon not knowing: if the account is locked from failed attempts, advisers cannot unlock it and it clears automatically after two hours.

For the NHS App, the NHS login help centre describes the route for exactly this situation. Select 'I cannot log in using my mobile phone' during sign-in and you can either enter your previous number or have a security code emailed to you instead, then confirm the change through a link that expires 24 hours after it is sent. You do not need to register from scratch on a new handset.

For Universal Credit, the risk is not the account, it is the deadline attached to it. A to-do or a commitment sitting unanswered in a journal you cannot open can cost you money, so ring the helpline, say you have lost the phone you use to sign in, and ask for the journal entry and any appointment to be dealt with while access is restored. The number and hours are in the contacts below.

Then close the door behind you. If you used SMS codes, the priority is getting a replacement SIM with your original number, because until that lands the codes are going to a dead SIM — or worse, a live one. If you used an authenticator app, remember the codes lived on the device: set the app up again on the new phone from your backup, and if you have no backup, use the one-time backup codes each service issues. The NCSC's guidance on two-step verification is blunt about this — set up more than one second step, and keep backup codes, which are ideal precisely because they work without your phone.

Start from the default position, which is uncomfortable: Citizens Advice states that you normally have to pay for the calls made up until the time you reported the phone missing. The £100 network cap is the concession that sits on top of that default, it is voluntary, it is conditioned on a report inside 24 hours, and on pay as you go you may simply lose the credit that was spent. Everything you can prove about when you reported is therefore money.

If a bill arrives with a thief's roaming charges on it, complain to the provider in writing first, quote the date and time you reported the loss and the crime reference number, and ask which term of the contract they say makes you liable. If they will not move, the free escalation is the Communications Ombudsman, which handles mobile, broadband, landline and pay TV disputes. Since 8 April 2026 you can go to it after six weeks rather than eight, or straight away if the provider issues a deadlock letter. It can direct a provider to act, apologise or pay an award of up to £10,000, though it cannot fine them.

Note that this is a different ombudsman from the one that handles the bank side. A dispute about who pays for unauthorised card transactions is a financial services complaint; a dispute about who pays for calls and data is a communications complaint. People lose weeks sending the right complaint to the wrong body.

On insurance, check three places before buying anything new: a standalone mobile policy, your home contents policy — which often covers personal possessions away from the home as an add-on — and a packaged bank account, which frequently includes mobile cover people have forgotten they are paying for. Every one of them will ask for the crime reference number, most set a short deadline for notifying the theft, and many require proof that the handset was barred. That is why you asked EE, O2, Three or Vodafone for proof of barring at the time.

Losing the handset does not end the contract. The airtime plan and any device finance keep running, so the replacement SIM matters commercially as well as practically — you are paying for a service you cannot use until the number is back. Networks will normally send a replacement SIM keeping your original number, sometimes with a delivery charge or an administration fee, and EE lets you collect one free in store. If your phone used an eSIM, ask specifically for an eSIM reissue rather than a plastic SIM, because the activation route is different.

Two last things worth doing while the memory is fresh. Write your new phone's IMEI down somewhere that is not the phone, and turn on the anti-theft features the manufacturers put in after the Home Office summit — Stolen Device Protection and Activation Lock on iPhone, Theft Detection Lock, Offline Device Lock and Remote Lock on Android. And stop keeping passwords, passport scans and photographs of bank cards in a notes app. The thief who gets a locked phone gets a paperweight; the thief who gets an unlocked one gets whatever you left lying in it.