What to do if your phone is lost or stolen

Borrow a laptop or someone else's phone and open your device-finding service before you do anything else. On Android that is Find Hub, on Apple devices it is Find My. Google's instruction for a missing handset is to use Secure device, which it describes plainly: it "Locks your device with your PIN, pattern, or password". On Android 17 and later it can also require "Fingerprint or Face Unlock" and disable "access to notifications, widgets, and quick access" — which matters, because a locked phone that still shows message previews on the lock screen is still leaking your one-time codes.

Locking is reversible. Erasing is not, and it costs you the one thing you might still want. Google says a factory reset from Find Hub will "permanently delete all data on your device, but may not delete SD cards", and then adds the line most people miss: "After the device is erased, its location won't be available in Find Hub." A wipe closes the door and blinds you at the same time. Lock first, watch the location for a while, and reach for the wipe when the phone is clearly gone or when what is on it genuinely cannot be exposed.

If the map shows you where the phone is, tell the police rather than going yourself. Victoria Police's own mobile phone security guidance asks for exactly this: "If you have tracking software installed on your device, let us know. Apps such as 'Find My Phone' or 'Find My Device' can often help find a mobile device that has been lost or stolen." A location pin is evidence for an officer, not an address to knock on. Phones are commonly taken by people who are prepared for the owner to turn up.

While the lock is going on, change the password on your email account from the borrowed device. AMTA's advice for a lost or stolen mobile is to change the passwords on "email, banking, social apps" — and email comes first because it is the reset path for everything else. If your email account is still signed in on the missing handset, every other account you own is one password-reset link away. Sign out all sessions if the provider offers that option, not just change the password.

Then look at money, and be honest about lost versus stolen. Victoria Police tells people to "notify your bank if you notice any unusual transactions", and a phone that held a digital wallet held tap-to-pay cards; freezing a card in the banking app takes seconds and can be undone. A phone left in a taxi is likely to come back and is worth locking and waiting on. A phone taken from your pocket — or snatched out of your hand mid-message, unlocked — is not coming back, and there is no reason to delay the carrier call by an hour.

These are two different requests and you should ask for both by name. Suspending the service stops the SIM — Telstra describes a suspended service as one that cannot "Receive or make calls", "Receive or send SMS" or "Use mobile data". Blocking the handset is separate, and is what stops the physical device working with any other SIM. A caller who only asks to "stop my phone" often gets the first and not the second, and then discovers weeks later that the handset is happily running on a prepaid SIM from another network.

The block runs on the IMEI, the 15-digit electronic serial number that identifies the handset rather than the account. AMTA says "Every mobile has a unique 15-digit electronic serial number – the International Mobile Equipment Identity (IMEI) number" and that you can find it by dialling *#06# on the device. That is not much help once the phone has gone, which is why the IMEI is also on the original box, on the purchase receipt, and often in the account record your carrier already holds.

AMTA publishes the reporting number for each carrier, and the list is short enough to be worth saving now. Once your provider has taken the report, AMTA describes what happens next: the IMEI goes onto "a national blocking list managed in partnership with AMTA", "All Australian mobile networks receive the block", and the effect is to block the IMEI "on all networks, making it inoperable in Australia". AMTA is equally direct about the point of it — it "protects you from paying for calls made by a thief" — and says the blocking service is provided "at no cost to consumers".

Be clear about what the block does not do, because a lot of people call expecting a search party. AMTA's wording is blunt: "Your carrier does not track lost and stolen mobiles and they cannot be pinpointed", and "IMEI blocking cannot locate or track your phone. It only prevents it from being used on Australian networks." The geographic limit is real too — AMTA says "IMEI blocking only applies to Australia", and that where a phone is lost or stolen while you are travelling internationally, "Australian network operators cannot block it".

Expect paperwork on prepaid and bring-your-own handsets. Telstra's published position is that for month-to-month services on a device it supplied, it already holds the IMEI, but for "Pre-Paid services, or if you're using a non-Telstra device" you will "need to supply your IMEI number and proof of purchase of your device". Suspension is not free of consequences either — Telstra states that for Upfront plan customers "your monthly plan fees and other recurring charges will continue to apply while your service is suspended", so a suspension is a security measure, not a billing pause.

Finally, the block is reversible. AMTA says "If your handset is found, your service provider can unblock your mobile for you", and puts numbers on how often that happens — roughly "150,000 mobiles blocked every year in Australia with 50,000 unblocked at the request of the owner because they have been returned". Only the provider that made the report can lift it, which is exactly why a blocked handset is worthless to whoever ends up holding it.

Call 000 only if the offence is happening now or someone is at risk. For everything else, the Australian Federal Police points to the same number the states share: "Call 000 if you need urgent help" and ask for police, and otherwise use the Police Assistance Line on 131 444 to reach your local police. Every state and territory answers that number, and every one of them also runs some form of online report you can lodge without waiting on hold.

The reason to bother is the reference number. Victoria Police says that after an online report "You will receive a Notice to the Victim form with: a reference number for your insurance purposes". Queensland's is staged: an online reference on submission, then "a Qld Police report number to the nominated personal or business email address or mobile phone number within 3 days". The Northern Territory says "the actioning officer will contact you to provide your police reference number". Insurers, and often carriers, will ask for one before they act.

Know what police will ask for before you start. Victoria Police is explicit: "When reporting, you will need to let us know your missing device model and serial number." That serial number is the IMEI, which is the same string your carrier needs, so digging it out of the receipt once does two jobs. Have the date, time and place, whether the phone was locked, what was on it, and whether tracking is still reporting a location.

The online channels are not identical across the country and the differences catch people out. Western Australia caps its form at property "up to the value of $10,000" and excludes vehicles, trailers, caravans and payment cards. Queensland requires photo identification — "Australian/Queensland Drivers Licence/18+ card, passport" — plus a current email address or mobile number, which is awkward when the mobile number is the thing you have lost. Victoria lets you "save and continue" within 30 days. Tasmania's form takes theft on its own definition and otherwise directs you to "call the Police Assistance Line on 131 444". The Northern Territory's covers "theft, lost property, property damage, abandoned vehicle, absence from residence". In the ACT, the AFP sends residents to ACT Policing's online services portal.

New South Wales routes lost-property and theft reports through the NSW Police Force Community Portal, which Service NSW lists alongside its own "Report theft" and "Report lost property" entries. Service NSW gives the same instruction to digital driver licence holders in as many words: report a lost phone immediately on 131 444, or create a police report online. South Australia answers 131 444 as well; SA Police blocks automated access to its own site, so confirm the current online options directly with them rather than relying on a summary.

One distinction to get right on the form: a phone left behind is lost property, a phone taken is theft, and insurers read those two words very differently. Report what actually happened. An inaccurate report is worse than a weak claim, because the same report may later be used to support an identity-fraud case where the honesty of the original account is the whole point.

This is where the money is, and it is the part people leave until Monday. Your handset was probably the second factor for myGov — the front door to the ATO, Centrelink and Medicare — and it may have carried myID, a digital driver licence and a state services account. myGov's rule on the mobile number is unforgiving: "If you have a new phone number, you'll need to update it in your myGov account before you can use it as your multifactor authentication option." If you can still sign in, go to Profile, then Contact details, and change the number now, while you still have access to change it with.

If you cannot sign in, myGov states the position plainly and it is not comfortable: "If you don't have access to your old number to sign in, you can sign in to myGov using Digital ID or create a new myGov account." Creating a second account is the trap, because your services stay linked to the first one and merging is not a self-service button. Before you go anywhere near a new account, phone the myGov helpdesk on 132 307 — open Monday to Friday 7 am to 10 pm and weekends 10 am to 5 pm — and work through the recovery options. Our page on being locked out of myGov walks the full decision tree by failure mode.

Do not count on the old code-generator app as a fallback: myGov says it "is no longer available to download from app stores". Where you cannot reach an authenticator, myGov's listed alternatives are a backup multifactor option, "your Digital ID you've connected to your account", or "a passkey you've created for myGov". Note too that an SMS backup "must be an Australian mobile number" — a live problem if you lost the phone overseas and bought a local SIM.

Once you are back in, one update can do several jobs. myGov says "When your details are updated, you can choose to send them to these services, if they're linked to your myGov account", with the ATO, Centrelink, Medicare, the State Revenue Office Victoria and Workforce Australia among the eligible services — provided those services are linked, your address is Australian, and "the date of your update is today or in the past". Name and date of birth are the exception and must be changed with the service itself. Check each linked service afterwards rather than assuming the push worked.

myID behaves differently from an ordinary app. Its identity strength "is unique to each device based on the documents you've verified on each individual device", so a new handset starts from nothing until you re-verify. To rebuild it, "download the app and select I am an existing user", then heed the warning that catches most people: "Enter your latest myID email address. You can't set up with a different email address. If you do, this will lock your myID and you'll be unable to use it."

Then clean up behind you: myID lets you "delete your myID off other devices", and the stolen handset belongs in that list. Our myID guide covers identity strength levels and the full new-device rebuild in more detail.

State accounts matter more than they look, because the mobile number is written into more than the login. Service NSW says that "When you add or change your mobile number, we'll update the mobile number on your MyServiceNSW Account, when used for MFA, on your Driver Licence and Vehicle registration" — so one stale number can silently break licence and registration notices as well as sign-in. Where the phone itself is gone, Service NSW's instruction is to "call us on 13 77 88 or go to a service centre". The equivalent path for every other state and territory is set out in our guide to recovering a state government account.

The number is worth more than the handset, and organised offenders know it. In the Australian Federal Police's account of a bulk porting operation, the mechanism is described in one sentence: "The scammer can then bypass multi-factor authentication settings to access bank accounts and other sensitive information." The AFP examined more than 190 suspicious attempts in that case, identifying 193 port-in attempts against 86 numbers across different networks, of which 44 were successfully ported without authorisation.

The tell is silence. The AFP's public warning points at two signs: "unexpected text messages from your mobile service provider saying 'you' have requested your number be ported", and a service that disconnects or drops to "SOS only". If you still have the handset and it goes to SOS only for no reason, that is not a coverage problem — it is the signature of your number having moved to somebody else's SIM. Act on it in minutes, not after a night's sleep.

Your consent is the legal hinge. The ACCC's position is a single line: "Your service provider can only transfer your phone or internet service if you agree." The Telecommunications Industry Ombudsman puts the same obligation on providers from the other direction — it expects them to "Get your agreement before transferring your service", says "the transfer should be clear, timely and authorised by you", and instructs consumers that "If you notice a transfer you didn't authorise, contact your provider as soon as possible." The ACCC's companion rule is flat: "Never give your personal information to someone who calls you out of the blue."

There is a regulatory floor under all of this. The ACMA made the Telecommunications Service Provider (Customer Identity Authentication) Determination 2022 under the Telecommunications Act 1997, and it was registered on 6 April 2022. It is the instrument behind the extra identity checks you now meet when you ask for a SIM swap or a number transfer — the reason your provider will not take your word for it over the phone. Treat the friction as protection you are buying, not an obstacle.

If a transfer has already happened, the sequence is fixed. The AFP's advice is to "contact your mobile phone provider immediately, as well as your bank to take steps to put a freeze or hold on banking transfers and cancel any potentially affected cards", and to "report the incident to ReportCyber". The bank call is not optional and it is not second — a number in someone else's hands defeats every SMS confirmation your bank sends, so the freeze has to go on while the porting dispute is still being logged.

The escalation path is the Telecommunications Industry Ombudsman, not the ACCC. The ACCC says so itself: "We don't investigate or resolve individual complaints about internet or phone services. This is the role of the Telecommunications Industry Ombudsman." The TIO takes complaints on 1800 062 058, and is direct about the order of operations — "First try to raise your problem with your provider. Skipping this step adds five extra days to your case." Give the provider a genuine attempt, keep the reference number, then escalate.

myGov lists a passkey and a connected Digital ID among the ways to sign in when you cannot reach a code, which means a phone number is not the only factor available to you on the country's most important account. Where a service you rely on offers one of those, or an authenticator app, setting it up is work done in advance rather than during a crisis.

Work out which policy covers you before you lodge anything — a home contents policy that may only extend to portable items away from home when they are specified, a travel policy, or cover attached to a card or an employer-supplied device. Read the excess first; on a mid-range handset it can cost more than the replacement. Whatever the policy, the police reference number is the gate, and Victoria, Queensland and the Northern Territory all issue one for exactly this purpose. Lodge the police report on day one and the claim afterwards; the other order usually stalls while the insurer waits for a number you have not asked for yet.

If you buy a replacement second-hand, check the IMEI first. AMTA runs a public status lookup, and its own advice is to verify a used device before purchase by entering the IMEI. Note the caveat attached to it, though: the same 72-hour lag applies, so a handset stolen yesterday can still read as clean today. A seller who will not give you the IMEI before you meet, or who has "forgotten" the password on the account still signed in to it, is telling you something.

A blocked handset is not a bargain and cannot be quietly fixed. AMTA's position is that unblocking is done by the provider that took the report — "If your handset is found, your service provider can unblock your mobile for you" — which means the person who can lift the block is the person the phone was taken from, not the buyer. A blocked phone is a camera and a wi-fi tablet, and no repairer can lawfully change that.

Expect the replacement SIM step to be the slowest part. Telstra's published limits are that it will not issue a replacement SIM online where, within three months, you have "signed up as a new Telstra customer", "changed your billing or email address", or "requested two or more replacement SIMs for this number". Those rules exist because the SIM swap is the fraud, and they will apply to you as readily as to an offender. Budget for an identity check, at a store or over the phone, with real documents.

One last cost to watch while all this runs. Telstra states that on Upfront plans "your monthly plan fees and other recurring charges will continue to apply while your service is suspended", so a suspension protects you from a thief's calls but not from your own bill. If the replacement will take weeks, ask what your options are — a suspension, a temporary SIM on the same number and a change of plan are different conversations, and they will not all be offered unless you ask.

A locked handset with no documents in it is a hardware loss and an account chore. A phone taken alongside a licence, a Medicare card and a bank card is an identity matter, and it needs a wider response than blocking an IMEI — run our lost-wallet checklist in parallel with this page rather than after it.

If you suspect someone actually got into the phone rather than simply having it, myGov publishes a recovery sequence worth following in order: "run a virus scan on your computer or device and remove any malware", "contact your bank or financial institution to secure your accounts", "change the password to any accounts someone could access, such as your bank, superannuation, myGov and email accounts", "warn your family and friends not to open any strange links or email attachments", and "report it through ReportCyber on the Australian Cyber Security Centre (ACSC) website". It also directs people to IDCARE for free support.

IDCARE is the free national identity and cyber support service, and the way in is its Get Help Form, which routes you to the right support based on what was exposed. It is worth using rather than working from a generic checklist, because the correct order of replacement depends entirely on which documents were on or with the phone. Services Australia also runs a Scams and Identity Theft Helpdesk on 1800 941 126, which ID Support NSW publishes alongside its own line on 1800 001 040.

Where a document number has been compromised rather than just a device, replacement is the point. ID Support NSW's instruction for a licence is to "Replace or renew your driver licence so that it receives a new card number" — a fraud reissue with a fresh number, not a like-for-like replacement that keeps the compromised one. Every state and territory registry handles this differently, and the full document-by-document sequence is in our page on what to do if your identity is stolen.

Draw the line between this page and the account-takeover pages deliberately. If someone has actually signed in to your myGov, changed bank details on an agency record or linked a service you did not link, that is a different repair and it is set out in our guide to a hacked myGov or ATO account. If money has already moved, the recovery levers — unauthorised transaction rules, mistaken payments, chargebacks and AFCA — are in our guide to getting your money back after a scam payment.

Keep a file while you go. One document with the date and time of the loss, the police reference number, the carrier references for the suspension and the IMEI block, the IMEI itself, and the date you changed each account. Identity matters move between organisations over months, and the person who has every reference number in one place spends a fraction of the time on hold that everyone else does.

Write down the IMEI and store it somewhere that is not the phone. Dial *#06# now, photograph the screen from another device or type the fifteen digits into a password manager, and keep the purchase receipt. AMTA's process cannot start without that number, and hunting for a receipt from three years ago while a stranger is holding your handset is not the moment to discover it has gone.

Set the lock properly. Victoria Police's prevention advice is to "Use a password, PIN, fingerprint or Face ID to secure your device. Ensure your device is set to lock automatically." The automatic part is the half people skip — a phone that locks after fifteen minutes is unlocked for fifteen minutes after it is taken, which is long enough to read a recovery email and change a password. Turn off message previews on the lock screen while you are in there.

Put a PIN on voicemail and back up on a schedule you do not have to think about. AMTA's two lines here are "Protect your voicemail with a secure PIN" and "Back up your data regularly. This will help reduce the impact if your phone is ever lost or stolen." An unprotected mailbox reachable from any handset is a standing bypass for services that read a code out loud when the SMS goes unanswered, and a current backup is what makes the wipe decision easy.

Move your important accounts off SMS as the only factor, and do the myID housekeeping while you still have the device. Keep the registered myID email address you started with, delete handsets you no longer use, and know which documents you verified with — identity strength "is unique to each device based on the documents you've verified on each individual device", so you will need them again.

Finally, carry the boring backups and save the boring numbers. A plastic driver licence in the wallet, your carrier's lost-and-stolen number stored somewhere other than the phone, and 131 444 for the police report. Service NSW's guidance to carry the plastic card as a backup to the digital licence is written for interstate travel, but it is exactly as useful on the day your battery dies in a police stop or your handset disappears from a café table.