A lost phone with access to your work email involves more than a missing device. It may hold active sessions, saved passwords, downloaded messages and authentication codes. Your immediate aim is to restrict future access and establish which information might have been exposed. The options vary between services, apps and operating systems: changing your password helps, but it does not replace the other checks.
1. Establish what the phone could access and protect key accounts
Use a trusted device and notify whoever administers your business accounts. Record when you noticed the loss, whether the phone was locked and which work apps you used. Do not delay restricting access just to finish an inventory: you can continue gathering information while protective steps are under way.
- Identify the email addresses configured on the phone and the apps used to access them.
- Check whether it could access a central business account, domain management or hosting administration.
- Establish whether it received text message codes, generated authentication codes or approved sign-in requests.
- Include storage apps, your password manager and any shared accounts used by the team.
If a device location or remote locking feature is available, activate it through the official account associated with the phone. Its effectiveness may depend on the phone's connection and configuration. If the number is used for account recovery, contact your mobile network operator about suspending the SIM. Suspending it does not stop access over Wi-Fi or revoke app sessions.
2. Review active sessions and connected devices
In the security settings of your email service or identity provider, look for active sessions, connected devices or recent activity. Labels and available information differ. An account configured in an email client may not appear in the same list as browser sessions.
- Identify the phone using its name, operating system and the last activity shown.
- Revoke the session or sign the device out, if that option is available.
- If you cannot confidently identify the session, check whether you can sign out all sessions and consider the effect on colleagues.
- Review connected apps and their permissions separately.
An IP address or approximate location does not, by itself, prove unauthorised access. Mobile networks and VPN services can affect these indicators. Keep relevant details for the investigation without sharing passwords or authentication codes. If the controls are unclear, consult the service documentation and the frequently asked questions, then request clarification for your particular setup.
3. Change the password and check app passwords
Change the affected account's password from your trusted device and choose a unique replacement. If you reused the password elsewhere, change it there too. Do not assume a password change automatically closes every session. Behaviour depends on the service, and some authorisations need to be revoked separately.
App passwords and separate authorisations
Some services provide app passwords for email clients that do not use the primary authentication method. Review the list and revoke the password associated with the missing phone. If you cannot identify it, consider revoking all app passwords and reconfiguring legitimate applications. Do not assume that changing the main password invalidates them in every service.
Apps may also use OAuth authorisations based on tokens rather than storing your main password. Find the authorised apps list and withdraw the relevant access. If these controls are not available to individual users, ask your administrator which access revocation options exist at an administrative level.
Two-step verification and recovery
Remove the lost phone as an approval method where the service allows it, and check your alternative recovery methods. Generate new backup codes if the existing ones might have been stored on the phone. For passkeys, review registered credentials and how they are synchronised: removing a session does not necessarily remove those credentials. Do not switch off two-step verification simply to make signing in again easier.
4. Understand what remains on the phone after access is revoked
Changing the password does not erase emails that have already been downloaded. An email client may retain messages, attachments, contacts and search results locally. These may remain accessible without another sign-in, depending on the device lock, encryption and protection provided by the app.
Both IMAP synchronisation and POP downloads can leave local copies. Documents saved in other apps, screenshots and copies in personal storage may also exist. Revoking access mainly aims to restrict future connections and synchronisation; on its own, it does not give you control over every existing copy.
Remote locking or erasure may help if the feature was configured beforehand and its technical requirements are met. An offline phone may not receive the command immediately. Removing only work data is possible with certain device management configurations, not all of them. Before a full wipe, check the business's authority over the device, the consequences for personal data and whether evidence needs to be preserved.
5. Look for suspicious changes and document the incident
Once you have restricted access, check for changes that could allow continued access or redirect messages. Do not stop at the sent folder: some actions may leave traces elsewhere, or only in logs available to an administrator.
- Check forwarding rules and filters that move or delete messages.
- Review delegated access, shared mailbox permissions and authorised apps.
- Examine recovery addresses, authentication methods and recent account activity.
- Look for unusual messages, especially requests for money, documents or changes to bank details.
Record the actions taken and approximate times, including which sessions and credentials you revoked. If personal data or confidential information is involved, notify the relevant person in your organisation so they can assess the incident and any notification obligations. For questions about the service you use, visit the contact page. Describe the issue without including passwords, codes or unnecessary confidential content.
6. Prepare business devices before the next loss
An email security policy should cover both server access and locally stored data. For accounts associated with a web hosting service, check which email functions are available and who can administer them. Do not infer that particular security controls exist simply from the type of hosting package.
- Keep an inventory of authorised devices, their users and configured accounts.
- Require screen locking, updates and encryption where the device supports them.
- Separate business and personal data using suitable methods and clearly communicated policies.
- Prepare recovery methods that do not rely entirely on the same phone.
- Document how to revoke sessions, app passwords and authorisations where these features are available.
- Assign responsibilities and establish erasure rules for company devices and authorised personal phones.
The practical takeaway: when a phone goes missing, lock it if possible, restrict sessions and credentials, then review account settings and activity. Treat downloaded messages as a separate issue: future access can be restricted without making local data disappear. A procedure prepared in advance helps you respond methodically, without mistaking a password change for a complete resolution of the incident.
