There's the movie version of a phone theft: a hand darting out on the subway, a chase, a device vanishing into the crowd. And there's the real version, far more mundane: a bag left on a café table for five minutes, a back pocket that's a little too accessible, a phone forgotten on a train station counter. In both cases, the immediate reaction is almost always the same — you think about the device, its price, the photos.
That's the wrong order of priorities. A stolen smartphone, today, isn't first and foremost an 800-euro object. It's an active mobile line, in someone else's hands. And that line receives your text messages: bank validation codes, "forgot my password" links, account notifications. In short, it holds the spare key to half your digital life.
The good news: the window of risk is short and closes quickly if you act in the right order. Here is that order.
Why the thief cares about your messages, not your phone
The market for stolen phones is a market of spare parts and resale abroad. It pays little, and it pays fast. But over the past few years, a second economy has grafted itself onto the first: exploiting the line in the hours right after the theft.
The text message, that universal keyring
Despite its well-documented weaknesses, SMS remains the most widely deployed second authentication factor in the world. The European PSD2 directive made strong authentication standard for online payments, and a large share of French banks still rely, wholly or partly, on a code sent by message. Add to that the platforms offering to "receive a sign-in link by text," and you get a simple situation: whoever receives your messages can impersonate you on an alarming number of services.
A locked screen is not a wall
Many owners reassure themselves: "it's locked, they can't do anything." That's partly true for the content stored on the device. It's far less true for incoming messages, because by default many phones display notification previews on the lock screen. A six-digit code fits comfortably in a preview. There's no need to unlock anything at all.
Worse: if the thief pulls out the SIM card and slots it into a basic handset, they receive your texts without ever touching your phone. This is where the SIM card PIN — the one so many users disable because it's "annoying" — regains all its importance.
Passive reconnaissance
Finally, there's the quietest scenario of all: the thief does nothing right away. They simply watch the notifications roll in for an hour to work out which bank, which carrier, which apps you use. That free mapping is worth its weight in gold: it turns an opportunistic theft into a targeted impersonation attempt, possibly sold on to someone else.
The first 60 minutes: the order that matters
Nothing that follows requires technical skill. What matters is the sequence.
Step 1 — Have your carrier suspend the line (absolute priority)
This is the move that cuts off access to your texts. Every French carrier has a 24/7 emergency line:
| Carrier | Number from France |
|---|---|
| Orange | 3900 (or 0 800 100 740 from abroad) |
| SFR | 1023 |
| Bouygues Telecom | 1064 |
| Free Mobile | 3244 |
Explicitly ask for the suspension of the line, not just a block on the handset. Note the time and the name of the adviser: that information will be useful if a fraudulent transaction has to be disputed later.
One detail many people don't realise: suspending a line does not cost you your number. Your carrier will issue a new SIM card or a new eSIM, with the same number, generally within 24 to 72 hours. It's precisely for situations like this that it pays to keep at home a small stash of unremarkable accessories that become impossible to find at the worst moment: a spare USB-C wall charger and a SIM card adapter are often enough to put an old phone back into service the same evening.
Step 2 — Lock or wipe remotely
From a computer or a friend's phone:
- iPhone: iCloud.com → Find My → turn on Lost Mode, then, once hope of recovery fades, Erase.
- Android: android.com/find → Secure device, then Erase.
Lost Mode / Secure device has one advantage over an immediate wipe: it locks the device, hides notifications and displays a contact message, while still tracking its location. Erasing, by contrast, is irreversible and ends the tracking. Best practice is to lock first, then erase if the device stops moving or heads off in an improbable direction.
And one absolute rule, repeated by every police force: never go and retrieve a located phone yourself. Pass the location on to law enforcement.
Step 3 — Alert your bank and check for payments
Call your bank and report the loss of the device that hosts your banking app and receives your codes. Ask for:
- Deregistration of the device (the famous "trusted device").
- Suspension of contactless payment via mobile wallet.
- Heightened monitoring of outgoing transfers over the next 72 hours.
In the event of a fraudulent debit, Article L133-18 of the French Monetary and Financial Code provides for the reimbursement of unauthorised transactions, subject to prompt reporting and the absence of gross negligence. Hence the importance of a written timeline from the very first hour.
Step 4 — Take back control of your key accounts
From a computer you trust, change the passwords of the accounts that act as gateways to all the others: your main email, your Apple or Google account, your social networks. Then sign out of all active sessions — the option exists in the security settings of each of these services.
It's also a good moment to notice whether you were relying too heavily on SMS. A FIDO2 security key kept in a drawer, or an authenticator app installed on a second device, would have made this entire paragraph unnecessary.
What happens next: IMEI, police report and insurance
Once the first few hours have passed, you move into the administrative phase. It's less urgent, but it determines whether you get compensated and whether the device is blocked for good.
The IMEI number, your best piece of evidence
The IMEI is the handset's unique identifier, independent of the SIM card. Passed on to your carrier, it allows the device to be added to the EIR blacklist shared by French operators: the phone becomes unusable on national networks, whatever SIM is inserted.
Of course, you have to know it. You'll find it:
- on the phone's original box;
- on the purchase invoice;
- in your Apple or Google account, under "Devices";
- by dialling
*#06#— but only as long as you still have the phone in hand, which is precisely the problem.
The habit that saves you: photograph or copy down your IMEI now, and store it somewhere other than the phone. A paper notebook is enough; a small password notebook kept at home does the job perfectly for this kind of backup information.
Filing a report and the 17Cyber portal
You can file a report at a police station, a gendarmerie, or online via the French Interior Ministry's pre-complaint service. For the digital fallout — impersonation, compromised accounts, fraudulent debits — the reference public scheme is now 17Cyber, launched in late 2024 by the Interior Ministry and Cybermalveillance.gouv.fr: it points you to the right contacts and lets you speak with a specialist operator.
Cybermalveillance.gouv.fr also publishes free step-by-step guides on device theft and identity fraud, updated regularly. The CNIL, for its part, sets out what to do when personal data has been exposed.
Insurance: read the clause before, not after
The "loss" and "theft" coverage in phone insurance policies is notoriously restrictive. Two points come up systematically in refused claims:
- the notion of theft without assault or forced entry, often excluded (a phone lifted from a pocket may not be covered);
- the reporting deadline, generally 2 to 5 working days.
Also check whether your premium bank card includes coverage for portable devices: it's common, and often forgotten.
The settings to change today, while all is well
Everything above plays out in an hour. What follows takes ten minutes and cuts the damage tenfold.
Hide notification content on the lock screen
This is the highest-return setting in this article.
- iPhone: Settings → Notifications → Show Previews → "When Unlocked".
- Android: Settings → Notifications → Notifications on lock screen → hide sensitive content.
Your texts will still arrive, but their content — and therefore the codes — will no longer be visible to anyone glancing at the screen.
Re-enable your SIM card PIN
It prevents your SIM from being used in another device. On iPhone: Settings → Cellular → SIM PIN. On Android: Settings → Security → SIM card lock. And of course, replace the carrier's default code.
Move from a 4-digit code to a long one
A 6-digit unlock code is the bare minimum; an alphanumeric passcode is considerably stronger. Watch out too for the most underestimated gesture of all: unlocking your phone in public under a watchful eye. Many smartphone thefts are preceded by nothing more than someone observing the code. A privacy screen protector for smartphones drastically narrows the side viewing angle, on the subway as much as in an open-plan office.
Reduce your reliance on SMS for authentication
Verification texts are still useful, but they shouldn't be the only safety net. Wherever possible, enable an authenticator app (codes generated offline) or, for your most sensitive accounts, a physical security key in USB-C or NFC format. Kept on a keyring or in a drawer, it survives the disappearance of your phone — which is precisely the point.
Back up your messages and turn on location tracking
An up-to-date backup turns the loss of a device into a mere annoyance. Check that automatic backup is switched on (iCloud or Google One), and for important conversations, export them regularly. If you often carry your phone in risky settings, a Bluetooth tracker for bags won't locate the phone itself but will often locate the bag it travels in — a modest addition, but a useful one.
Avoid exposing your personal number
Part of the risk is decided upstream: the more your number circulates, the more it feeds the databases used for smishing and impersonation. For classified ads, one-off sign-ups or an exchange with a stranger, sending a text online without disclosing your personal number mechanically limits your exposure. The less public a number is, the less it gets targeted.
Key takeaways
| Timeframe | Action |
|---|---|
| 0–15 min | Suspend the line with your carrier |
| 15–30 min | Lost Mode / Secure the device remotely |
| 30–45 min | Call the bank, block the mobile wallet |
| 45–60 min | Change key passwords, sign out of sessions |
| Day 1 | File a police report, provide the IMEI, EIR blocking |
| Day 2 to 5 | Notify your insurer, monitor your accounts |
A lost or stolen phone is a material incident. It only becomes an identity incident when the mobile line stays accessible for too long. The difference between the two is measured in minutes — and it is prepared, to a very large extent, before anything happens at all.
Sources and useful resources: Cybermalveillance.gouv.fr (step-by-step guides on device theft and identity fraud), the Interior Ministry's 17Cyber portal, CNIL (personal data breaches), ARCEP (allocation and portability of mobile numbers), French Monetary and Financial Code, Article L133-18.
