The thief changed your password: the hour that decides everything
The email just landed: someone changed the password on your account. Here is the order of moves, minute by minute, to take control back before the thief locks every door.
The thief changed your Apple ID password, and you found out from an email. Apple or Google is telling you the password on your account was just changed, and it wasn't you. From this moment the thief isn't just trying to flip a phone. They're going after your account, and with it your photos, your saved passwords and your payment methods.
Good news: if you move in the right order, most of it can still be saved. Bad news: every minute spent calling your own number or hoping it sorts itself out is another minute for them. This guide follows Apple's and Google's official procedures and puts them in the order that actually matters.
Never remove the stolen device from Find My, even after you erase it. Apple is blunt about it: removing it turns off Activation Lock and makes the phone easier to resell. And don't put your number on the Lost Mode screen. If the phone was stolen, the thief can use it to call you pretending to be Apple and talk you out of a code.
The realityWhy thieves go after your account, not just the phone
A locked phone is hard to sell. A phone with a known passcode is a different story. In 2023 the Wall Street Journal documented a pattern hitting multiple victims in the US: the thief watches you type your passcode in a bar or another public place at night, grabs the phone, then changes the Apple ID password right in Settings. Some go further and turn on a recovery key, a 28-character code only they know. According to the investigation, Apple's policy then leaves victims virtually no way back in.
Apple has since added Stolen Device Protection, which requires Face ID or Touch ID plus a one-hour security delay for those changes when you're away from familiar places. But it has to be on before the theft, and Apple notes its extra safeguards only last for a period of time. That's why the next hour matters so much.
The trend isn't slowing. The Identity Theft Resource Center saw unauthorized access to computers and mobile devices jump from 15.3% to 27.2% of the identity compromises reported to it between April 2025 and March 2026, a 78% increase. For adults aged 35 to 64, hacked devices overtook scams as the top threat for the first time.
The timelineThe first 60 minutes, in order
Grab another device: a laptop, a tablet, a friend's phone. Everything below happens without your phone.
At iCloud.com/find, pick the device and choose Mark as Lost. Apple says you don't need a verification code to sign in there, precisely because your trusted device may be the one that was stolen. On Android, do the same from Google's device-finding page, covered in our Android theft protection guide.
If an iPad or Mac is still signed in to your Apple Account, change the password from its settings: it's the fastest route. Otherwise, go to iforgot.apple.com. On the Google side, the account recovery page exists for exactly this: someone changed your password or recovery phone.
Call your carrier and suspend the line. As long as it's active, text-message verification codes land in the thief's pocket. Apple lists this step in its official procedure. Next, read how to lock your SIM card.
Call your bank and freeze the cards stored in Apple Pay or Google Pay. Google advises contacting your bank whenever a hacked account holds payment details. The full playbook is in stolen phone fraud: protect your accounts.
Once you're back in, check the device list and your recovery email and phone, and remove anything you don't recognize. You can remove the stolen phone from your account's device list without removing it from Find My. In Gmail, Google also says to check forwarding rules and filters: that's where an intruder hides to keep reading your mail.
File a police report with the device's serial number, which you can find in your account even without the phone. Once you've given up on getting it back, erase it remotely: it can't be undone, but since iOS 15 the phone stays findable after erasing. The rest of the playbook is in the first 10 minutes after a theft.
This whole hour starts at the same moment.
The moment the phone leaves your hand. The LOCKÜP™ bracelet keeps it tied to your wrist at the bar, on the patio or on the subway, right where the thefts above begin. A phone that doesn't leave means an account nobody touches, and a night with nothing to recover.
- On and off in one second
- Both hands free
- Works with iPhone and Android
- Designed in Québec
Three scenariosWhere you stand, and what's still possible
Depending on how far the thief got, what comes next takes very different amounts of time.
An iPad, a Mac or another phone is still signed in to your account. Change the password from there, check your recovery methods, and it's handled in minutes, without going through the account recovery wait.
Start recovery at iforgot.apple.com. Apple emails a confirmation within 72 hours with the date you'll get back in, and the wait can take several days or longer. Apple Support can't shorten it. Turn off other devices signed in to the account while you wait: if the account is used, the request is canceled. If you set up an account recovery contact, they can save you that wait.
This is the hardest case. Without that key and without a trusted device, Apple warns you could be locked out of your account permanently. Focus on what you control: the police report, your bank, and a new password on every service whose codes go to that email or number.
On Android the logic is the same: if your Google account is still reachable from a computer, secure it right away; if not, use Google's account recovery page and answer as best you can.
Before it happensSix settings to fix tonight
Everything above moves much faster when these boxes are already checked. Budget ten minutes.
- Turn on Stolen Device Protection on iPhone, or theft protection on Android. Step by step in our iPhone guide.
- Add an account recovery contact to your Apple Account: someone you trust who can help you back in without waiting days.
- Check your Google recovery email and phone, and make sure at least one of them doesn't depend on your phone.
- Keep a second device signed in, a tablet or laptop. That's what saves you in scenario A.
- Switch to a longer passcode and shield it when you type it in public. The mistakes to avoid are in phone passcode theft mistakes.
- If you use a recovery key, keep it off the phone, on paper, at home.
For backup codes on your other services, the full list is in the 2FA backup codes checklist.
FAQStolen phone and changed password
Can a thief change my Apple ID password?
Yes, if they know your passcode and Stolen Device Protection is off: the change happens right in the iPhone's Settings. With the protection on, Apple requires Face ID or Touch ID plus a one-hour security delay for that kind of change when you're away from familiar places.
How long does Apple account recovery take?
Apple emails a confirmation within 72 hours with the date and time you can expect to get back in. The wait can take several days or longer, and Apple Support can't shorten it. If a trusted device is still signed in, change the password from there instead: it's instant.
Should I remove a stolen iPhone from Find My?
No. Apple explicitly advises against it, even after a remote erase: removing the device from Find My turns off Activation Lock, which makes it easier for the thief to erase and resell. You can, however, remove it from your account's device list.
How do I recover my Google account after my phone is stolen?
Use Google's account recovery page and answer the questions as best you can. Once back in, review your security activity, remove unknown devices, check your recovery phone and email, then look in Gmail for forwarding rules and filters you didn't create.
What is a recovery key and why is it dangerous after a theft?
It's a 28-character code that replaces standard account recovery. If a thief turns it on or regenerates it using your passcode, you lose the usual way back into your account, and Apple warns you could be locked out permanently without the key or a trusted device. That's why Stolen Device Protection should be on before anything happens.
The best emergency plan is the one you never need.
A phone that stays on your wrist gives nobody the chance to change your passwords.
Shop the LOCKÜP collection →Sources: Apple, "If your iPhone or iPad was stolen," published June 24, 2026: Lost Mode without a verification code, no contact info when stolen, never remove from Find My, contact your carrier, remove from the account device list · Apple, "How to use account recovery," December 5, 2025: confirmation email within 72 hours, wait of several days or longer, cannot be shortened, turn off other devices · Apple, "About Stolen Device Protection for iPhone": Face ID or Touch ID plus a one-hour security delay · Google, "Secure a hacked or compromised Google Account": recovery page, security activity, devices, bank, Gmail forwarding and filters · MacRumors, April 19, 2023, on the Wall Street Journal investigation (N. Nguyen and J. Stern) into 28-character recovery keys turned on by thieves · Identity Theft Resource Center, 2026 Trends in Identity Report, June 9, 2026: unauthorized computer and mobile device access up from 15.3% to 27.2% of compromises (+78%), April 2025 to March 2026, self-reported data from 6,188 people. Written by Équipe CARRY U. Updated September 24, 2026.
