Julien's bag disappears on a Saturday evening, on the terrace of a café in Lisbon. Inside: a wallet, some keys, and a smartphone locked with a fingerprint. He reassures himself the way most of us would: "it's locked, they won't get anything".
On Sunday at 9:40 a.m., his bank declines a payment at the airport. On Monday, he discovers three outgoing transfers that were approved — each one confirmed by a code received via text message.
The phone was indeed locked. The SIM card was not.
That's the whole misunderstanding around losing or having a mobile stolen in 2026: we measure the loss by the value of the device, when the real asset is the small piece of plastic that receives your banking verification codes. And that asset transfers into any ten-euro phone.
What your SIM card keeps doing without you
A lock screen protects the contents of the phone: photos, apps, history. It does not protect the phone line. If the SIM card isn't itself protected by a PIN code — and a majority of users have disabled it over the years to avoid typing it at every restart — it's enough to pull it out and slot it into another device.
From that point on, whoever holds the SIM:
- receives all your incoming text messages, including the one-time codes sent by banks, email providers, marketplaces and public services;
- receives your calls, including automated verification calls;
- can launch password resets on any service that accepts "receive a code by text message" as a recovery method.
That last point is the most underestimated. A text message isn't only a second factor: on many services, it's also a recovery factor. In other words, it lets someone bypass the password rather than add to it. France's cybersecurity agency, the ANSSI, regularly points out that SMS-based authentication remains better than a password alone, but that it becomes the weak link the moment the line is compromised.
Some screens also display notification previews without unlocking. A six-digit code is perfectly legible on a standby screen. Check that setting today, not afterwards.
A realistic theft timeline: the first 90 minutes count
French Interior Ministry statistics on thefts with or without violence show that the phone is one of the most frequently stolen objects in France. But the window of exploitation is short: resellers want to move the hardware fast, and fraudsters want to exploit the line before it gets cut off.
| Timeframe | What the opportunistic thief does | What you should do |
|---|---|---|
| 0–15 min | Turns the device off or puts it in airplane mode to kill location tracking | Try remote location tracking before it's switched off |
| 15–60 min | Removes the SIM, tests it in another device | Have the line suspended by your mobile operator |
| 1–6 h | Launches password resets by text message | Change the passwords of critical accounts from another device |
| 6–48 h | Payment attempts, resale of the device | IMEI blocking, police report, card cancellation |
The order matters more than raw speed. Many victims start by reporting the theft at the police station, which takes two hours — during which the line stays active.
The right sequence, in order
1. Suspend the line with your operator
This is action number one, before anything else. Orange, SFR, Bouygues Telecom and Free all have a 24/7 line-blocking number, reachable from abroad too. Suspension stops texts and calls from being routed to the stolen SIM. It's reversible: if you find your phone again, the line is reactivated.
Note these numbers somewhere other than in your phone. A card the size of a bank card, tucked into your wallet, or a note in a hardcover travel notebook — the most ordinary object in the world, and yet the only one that still works when the battery is dead and the phone is gone.
2. Cancel your payment methods
If your phone had a banking app, a contactless payment wallet, or simply if your cards were in the same bag: call the interbank card-cancellation hotline, available around the clock. The Fédération bancaire française points out that cancellation must be immediate and confirmed in writing.
3. Change critical passwords from another device
In this order: your main email account first (it's the keystone — it can reset everything else), then your bank, then online marketplace accounts and social networks.
You'll only manage this if you know your passwords — which, in practice, means having a password manager accessible from a browser, or failing that a paper password notebook kept at home. That solution makes purists wince, but France's data protection authority, the CNIL, itself concedes that a strong password written on paper and stored in a safe place beats a weak password reused everywhere.
4. Block the device via its IMEI number
IMEI blocking makes the phone unusable on French networks, whatever SIM is inserted. You request it from your operator, armed with the fifteen-digit IMEI number. That number appears on the original box, on the purchase invoice, and in your customer account. Photograph it now and store the photo somewhere other than your phone.
5. File a police report
The report is necessary for insurance, for IMEI blocking in some cases, and above all as evidence if fraudulent transactions are disputed. The Interior Ministry's online pre-report system saves time at the station itself.
The nastiest scenario: the text message that arrives afterwards
Once the line is suspended, many victims think they're in the clear. That's often where the second phase begins.
You've reported your theft. You're stressed, you're waiting for news from your operator, your bank, your insurer. You're in exactly the mental state that smishing is looking for: a legitimate expectation of an official message.
The messages that then land on your replacement line look like this:
"THEFT TRACKING: your device IMEI 35xxxx has been located in Marseille. Verify your identity within 24 h to begin the procedure: suivi-imei-restitution.net"
"Your claim declaration no. SIN-2026-77401 is incomplete. Complete your bank details for reimbursement: espace-assure-mobile.com/fr"
No operator, no insurer and no police service will ever ask you for bank details, a verification code or banking credentials by text message. The location of a stolen IMEI is never communicated to the victim by automated message.
How do the scammers know you've just been robbed? Often, they don't: they send out mass messages, and you simply happen to be at a moment when the message lands just right. Sometimes the information circulates via "lost phone" appeals posted on social media, where people share their number so they can be contacted "if anyone finds the phone". Never post your mobile number in a public message of that kind.
Prevention: five settings that change everything
Re-enable your SIM card PIN code
This is the most worthwhile and most neglected setting. An active SIM PIN makes the card unusable in another device after three attempts. On Android as on iPhone, the setting is found under security or cellular data settings. Change the default code (0000 or 1234).
Hide notification contents on the lock screen
Set the display to "hide content": the notification shows that a message has arrived, without revealing its text. Your banking codes stop being readable over your shoulder — on the metro as much as at a café table.
Replace text messages with an authenticator app wherever possible
Text messages remain essential for many French services, but wherever an authenticator app (TOTP) or a physical key is offered, it renders SIM theft useless. For the most sensitive accounts — main email, secondary banking portal, professional platforms — a FIDO2 security key fits on a keyring and depends on no network at all. The ANSSI ranks this type of device among the most robust authentication methods available to the general public.
Enable remote location tracking and emergency locking
"Find My Device" on Android and "Find My" on Apple let you, from any browser, display the location, make the device ring, lock it with a message or erase it remotely. Test the procedure once, calmly, before you need it.
Reduce physical exposure
A good share of holiday thefts are snatch-and-grab or pickpocketing, not sophisticated burglaries. An anti-theft shoulder bag worn in front of you, or a simple travel pouch worn under your clothing for your documents and a backup card, removes the opportunistic grab. It isn't glamorous, it is effective.
The particular case of being abroad
Outside France, two extra difficulties arise.
Reaching your operator. Freephone 0800 numbers aren't always accessible from abroad. Each operator publishes an alternative number in +33 format. Write it down before you leave.
Dependence on a single device. If your phone is your train ticket, your boarding pass, your payment method and your digital ID, losing it leaves you stranded. Taking a compact power bank doesn't solve theft, but it avoids the flat battery that strips you of your tools at the worst possible moment; keeping a paper copy of your bookings and a second payment method stored separately does the rest.
Also think about eSIMs: keeping a secondary eSIM already installed on an old phone left at the hotel lets you restore a working line in a few minutes. Several operators offer multi-SIM on the same number.
And if the fraud has already happened?
If banking transactions were approved using text-message codes received on your stolen line, you are not legally defenceless. Article L133-19 of the French Monetary and Financial Code governs the payer's liability: after notification of the loss or theft, no fraudulent transaction can be charged to you, barring fraudulent conduct on your part. Before notification, liability is capped at €50 for transactions linked to a lost or stolen payment instrument.
The bank may invoke "gross negligence", a notion regularly ruled on by the Cour de cassation, which has repeatedly stated that it is for the institution to provide proof of that negligence — not for the customer to prove their innocence.
In practical terms:
- Dispute the transactions in writing with your bank, by registered letter, attaching the police report receipt and the operator's line-suspension confirmation.
- If they refuse, refer the matter to the institution's banking ombudsman.
- Report fraudulent text messages to 33700, and data-harvesting sites via the PHAROS platform or cybermalveillance.gouv.fr.
The key takeaways
A stolen phone can be replaced. An active line in someone else's hands is a keyring of digital keys.
The three actions that count, in order: suspend the line, cancel your bank cards, change your passwords from another device. The rest — police report, IMEI, insurance — can wait an hour. Those three cannot.
And if you only do one thing after reading this article, do it now: re-enable the PIN code on your SIM card. Three minutes of settings against several thousand euros of risk — the best effort-to-protection ratio in all of mobile security.
