What to do if a work or personal phone with company data is lost

If the phone had a SIM, call your mobile carrier and ask them to suspend the line or SIM. A thief who can receive your texts can receive text-message verification codes and password resets for email, banking and social media.

While you're on the phone, ask about adding a port-out or account PIN so the number can't be moved to another carrier or SIM without it. SIM-swap fraud is a common way to bypass SMS-based MFA, and carriers in Canada offer account security features to make it harder.

Use Find My (Apple) or Find My Device (Google) to locate the phone and put it in lost mode. Then decide on wiping, which depends on who owns it.

• Revoke the user's sign-in sessions in Microsoft 365 or Google Workspace so Outlook, Teams, OneDrive and Gmail on the phone stop working.
• Reset the account password if the phone wasn't locked with a strong PIN or biometric.
• Remove the device from the user's mobile devices list in Exchange or Workspace.
• Check sign-in logs from the time of loss onward for activity from that device.

This step is the one people forget. If the phone held the Microsoft Authenticator or Google Authenticator app, received SMS codes, or held a passkey, those methods must be removed from every account and replaced. Otherwise a person who unlocks the phone still holds the second factor.

Use a Temporary Access Pass in Microsoft Entra ID, or backup codes in Google, to get the user signed in on a replacement device and register new methods. Then delete the old ones. Do the same for personal accounts that use the phone number for recovery.

Ask what the phone could reach: client emails, health information, HR files, photos of documents. If it was locked with a strong passcode and encrypted (modern iPhones and Android phones are encrypted by default when a passcode is set), exposure is often low. If it was unlocked, or the passcode was weak or shared, treat it as possible access.

Under PIPEDA you must keep a record of every breach of security safeguards involving personal information, and report to the OPC and notify individuals if there is a real risk of significant harm. Record what you found and why, even if you decide no report is needed.

• Require a strong device passcode and automatic lock through device management or app protection policies.
• Use app protection policies on personal phones so work data stays inside managed apps and can be removed alone.
• Move staff off SMS codes to authenticator apps or passkeys, with more than one method registered.
• Set up carrier account PINs for company lines.
• Make 'report a lost phone right away' part of onboarding, with a phone number staff can call from any device.