The First 90 Minutes After Your Phone Is Stolen: A Prioritized Action Plan
The first ninety minutes after a phone is stolen decide most of the outcome. Not because the thief is quick — because your panic is. Everyone knows "change your passwords," but panic plus poor order means you change the wrong things first and let the clock run out on the ones that matter. This plan is deliberately ordered: credentials first, hardware second, paperwork third, evidence fourth. Print it, memorize it, or keep it in your laptop's notes. When it happens, you will be glad the thinking happened now.
Minute 0–5: Contain, Don't Chase
The best first action is the least heroic: do not chase the thief, and do not keep reaching for your phone. Lock the device remotely if you can, and switch your brain from "get it back" to "protect what is on it." If you have CleanSlate (or Google's Find My Device as a backup), you now have a remote control that outruns any foot chase.
Minute 5–20: Kill Credentials in This Order
- Your password manager — revoke access and change its master password. This is the key to everything else.
- Primary email — change the password and sign out all sessions. Email is the reset-password router to every account you own.
- Banking and payment apps — lock cards from the app on a laptop or another phone before the thief's session expires.
- Any 2FA apps on the phone — use your recovery codes (stored off-device, you prepared those) to re-protect the accounts.
This order works because each step protects the next: a compromised password manager is a compromised bank account in seconds.
Minute 5–20: Trigger the Remote Wipe
While you change credentials, open the CleanSlate reset page in a laptop browser and enter your User ID and Reset Code. Confirm the wipe. CleanSlate does not need a SIM card or Google services — it waits for the phone to hit any Wi-Fi or data connection and executes the reset within about a minute. If the thief powers the phone on to check it, sell it, or use it, the erase fires. Its absence of dependence on a carrier is the difference between "wiped when the thief turns it on" and "wiped only if the thief cooperates."
If you did not set up CleanSlate, use Google's Find My Device erase as a fallback for devices with Google services — and treat this moment as the reason setup happens before, not after, the emergency.
Minute 20–45: Protect the Phone Number
The SIM and eSIM are a lever you cannot see. Whoever holds the number can receive the verification texts your other accounts now want. Call or chat your carrier immediately:
- Block the SIM and report the device IMEI so it cannot be re-registered in your country.
- If the device used an eSIM, ask the carrier to suspend that eSIM profile.
- Ask whether your account has a verification PIN — and if your carrier allows it, request one so a thief cannot socially engineer a SIM swap later.
Minute 20–45: File the Report That Policies Demand
Insurance claims, carrier blacklists, and some account-recovery procedures require a police report. You do not need to wait — most jurisdictions take phone theft reports over the phone or online. Grab the IMEI from your box, purchase receipt, and report the serial number. Even a thin report is better than no report when a claims adjuster asks for proof of the event.
Minute 45–90: Review the Blast Radius
The cleanup is easier than the panic implies, once the immediate fires are out:
- Check your account security pages (Google Security, Apple ID, Microsoft) for a "signed-in devices" list and revoke the stolen phone.
- Change the passwords of accounts you can reach — you have the laptop you are reading this on.
- Reach out to one trusted person to double-check any odd messages that came "from you" — the thief may try to use your accounts while they are still warm.
- Write down exactly what happened: location, time, witnesses, police case number. Future you will not remember.
Frequently Asked Questions
Q: Should I really wipe the phone if it might be returned?
A: Ask yourself which you would rather miss: a few contacts (recoverable from backup) or your bank account (not recoverable). Wipe now, recover later. A returned phone can be set up from a backup; a drained bank account cannot be.
Q: What if I cannot reach a laptop?
A: Borrow one, or use a public computer. The reset page needs only a browser. If you stored your recovery codes on paper or in a password manager on another device, you can also rebuild from there.
Q: Does the police report matter for my carrier?
A: It helps. Some carriers require it for IMEI blocking or insurance; even if it is optional, the paper trail protects you if the device shows up in someone else's hands.
Q: I never set up CleanSlate. Is it too late now?
A: For this phone, mostly — but do not hand the thief your next phone too. Set up CleanSlate on your replacement the day it arrives. Meanwhile, follow every other step above; they still work without a wipe.
The Ninety Minutes That Decide Everything
Nothing about this plan is complicated, and none of it is optional once the phone is gone. What it buys you — a wiped device, protected accounts, a carrier that cannot be abused, and a report on file — is the difference between a bad afternoon and a months-long identity mess. Read what thieves actually do with stolen phones to understand what you are racing against, and trust the remote wipe layer to run the race for you.