Lock every phone that carries business email, know in advance how to wipe it remotely, and on the day one goes missing change the email password first, sign the phone out of every account and suspend the line.

What leaves with the phone

A phone slides out of a jacket at the rink, or stays on the back seat of a cab. The handset can be replaced by the end of the day.

What it was signed in to is another matter: the business inbox, years of customer names and numbers, the calendar, the banking app, the Facebook page and a browser full of saved passwords.

With no screen lock, whoever picks it up can read, reply and reset passwords as you. Even with one, new messages may appear on the screen as they arrive, login codes included.

The office gets locked every night. The phone carries much of what the office holds, yet often has no lock and no plan for the day it goes missing.

What a phone is usually signed in to

The fifth turns a lost phone into a lost account. Many services reset a forgotten password by texting a code to the phone on file, so whoever holds the phone can often take over the email.

The screen lock does most of the work

A passcode is the one protection that still works when nothing else was set up in advance.

On an iPhone, iOS 9 asks for a six-digit code by default, and a fingerprint makes it painless to use all day. Android phones offer a PIN, a pattern or, on newer models, a fingerprint.

Set the phone to lock itself after a minute or two, and turn off message previews on the lock screen so a locked phone does not display your login codes.

An iPhone with a passcode also encrypts its contents; many Android phones need encryption switched on in the security settings.

Switch on the finding service now

Remote locking and wiping have to be switched on before the phone goes missing.

On an iPhone that is Find My iPhone, in the iCloud settings. From any computer it can locate the phone, play a sound, lock it with a message and a number to call, and erase it.

Android Device Manager does much the same through the phone's Google account. Business email on Office 365 or an Exchange server can also send a wipe command to phones that sync with it.

Try the service once from a computer while the phone is in your hand, and note which account it uses.

The first hour

Call the phone first, since plenty are answered by whoever found them. If nobody answers, lock it with the office number on the screen, and erase it once it is clearly gone.

Then change passwords, starting with email, because every other password reset arrives in the inbox.

Do it from a computer you trust, then sign out every other session and remove the lost phone from the account's list of devices.

Call the carrier to suspend the line, so the number stops receiving login codes, and ask for a new SIM card with the same number.

If your two-step verification codes went to that phone, the backup codes printed when you set it up are how you get back in.

A worked example

A home watch company checks on about forty houses while their owners spend the winter somewhere warmer: weekly walk-throughs, mail, plants, and a call if anything looks wrong.

In February the owner's phone was left in a cab after a dinner downtown. It had no passcode; she checked it dozens of times a day and found the lock a nuisance.

Her inbox held each client's address, travel dates, alarm code and garage code, sent by the clients themselves, and the browser remembered the passwords for the scheduling app and the bank.

Nothing could be locked or erased, because the finding service had never been switched on. That evening she changed the email password from her laptop, removed the phone from the account, and called the carrier and the bank.

The next morning she phoned every client, and new alarm and garage codes were in place within the week.

The new phone has a passcode, the finding service and no lock screen previews. Codes now live in an encrypted password manager, and clients give them by phone rather than by email.

The passwords that come next

After email comes anything that can move money: the bank, by phone, and any app with a saved card.

Then whatever the browser remembered: the website's admin login, the hosting account and the domain registrar.

Facebook and Google each show which devices are signed in to your account, with a way to end each session. Booking and accounting apps are easy to forget, because they rarely ask for a password once set up.

Staff using their own phones

Staff often read work email on phones they bought themselves. Under Canadian privacy law, the business is still responsible for safeguarding the customer information on them.

Agree the basics in writing: a screen lock, the finding service switched on, and a call to the office the same day a phone goes missing.

Be clear, too, that a wipe sent through the email system can erase the whole phone, family photos included. That conversation is better held before it is needed.

The counter-case

A phone that only makes calls and takes photos, with business email kept on the office computer, carries much less risk and needs a shorter list.

Erasing is not always the right first move either. If the map shows the phone at the restaurant you just left, go back before wiping anything.

For any phone that does carry business email, though, the advice holds: a screen lock, a working way to wipe it, and a written list for the day it goes.

Before a phone goes missing

  1. Set a passcode on every work phone.
  2. Hide message previews on the lock screen.
  3. Switch on the finding service and test it.
  4. Write down the order of passwords to change.
  5. Keep the carrier's number with that list.
  6. Print backup codes for two-step verification.
  7. Agree the rules for staff phones.

Step four is the one that pays off on the day. Nobody thinks clearly in the first hour, and a written list that starts with email gets the important passwords changed first.

The recovery address behind the website, the domain and the hosting matters for the same reason, as covered in a website admin email at a personal Gmail account.

Frequently asked questions

What should I do first when a phone goes missing?

Call it, then use the finding service to lock it with the office number on the screen. Erase it once it is clearly gone, then change the email password.

Why change the email password first?

Because password resets for most other accounts arrive by email. Whoever controls the inbox can reset the website, hosting and social media logins one by one.

Does a screen lock really matter?

Yes. It is the one protection that works when nothing else was set up in advance, and on an iPhone it also encrypts what is stored.

When does remote wipe need setting up?

Before the phone is lost. Find My iPhone or Android Device Manager has to be switched on in advance, and is worth testing once from a computer.

Can a locked phone still give things away?

Yes. New texts and emails can appear on the lock screen as they arrive, including login codes. Turn message previews off for both.

What about staff using their own phones?

Agree in writing on a screen lock, the finding service and a same-day call to the office, and explain that a wipe through email can erase the whole phone.

West Coast Media Solutions Inc. provides web design, web development, hosting, digital marketing, and business consulting to organisations across Canada, drawing on more than twenty-five years in the field.

Business email on phones with no passcode?

Tell us which phones read your business email. We will set up locking, wiping and a list for the day one goes.

Start a Conversation