▲ 4 points

Steps to take in advance in case your phone gets stolen

by ColinWright·9mo ago·5 comments·view on hn ↗

From a friend:

Two people I know have had their phone stolen within the last few weeks. The cost of replacing a phone can be significant - but both people have said that the stress and hassle is even worse.

If you're not careful, your phone becomes a single point of failure: loss or theft can make it impossible to log in to your accounts. Even if you can log in, you might be unable to change your password or security details. And you may struggle to block the person that stole your phone.

Here are some precautionary measures to take before disaster strikes. Some are Apple specific, and I don't know Android's security features - hopefully someone can add some Android-specific guidance in the comments.

(Apple only) vital if you only have a single Apple device: add a recovery contact, to ensure you can log in to iCloud.

(Apple only) turn on "find my <x>". Even if you don't want to share your location with friends/family, it can help if your device is lost or stolen.

(Apple only) ensure "Stolen Device Protection" is on.

(Apple only) teach other members in your iCloud family how to use "Find my <X>". In theory, "Find My" app can remotely erase family devices - but it prompted us for a verification code that had been sent to the stolen phone. (But also teach your family members to be cautious of "Hey Dad, this is Lisa, I'm on a new phone" style messages!)

ensure your device has a PIN that's hard to guess, and hard to shoulder-surf.

create a recovery email account: an address that you use only for recovering access to accounts. Don't add that email account to any of your devices - only ever access it via webmail, in conjunction with a strong password.

limit what your phone has access to. E.g. separate savings from day-to-day spending, and only let your phone see your day-to-day spending account. The thieves (somehow??) managed to transfer money from a savings account into a current account, and were trying to spend that money via Apple Pay.

practice using the account recovery systems. When your phone is stolen, your stress levels are through the roof and you're under pressure to act quickly. That's not a good time to be dealing with an unfamiliar UI.

look up how you tell your phone provider that your phone has been stolen. E.g. giffgaff's system is very easy to use once you find it - but the link didn't show up in any of our web searches. It is easily found in the "Help" section after logging in, but we ended up having to wait for a giffgaff support agent to answer a query, and that delay further increased the stress.

make sure you've got a good (preferably automated) backup policy, and test it.

Maybe:

get a dumb phone to use in high-risk scenarios. (I hate this suggestion, though - it's like saying "get a nice phone, but be too afraid to use it")

get a YubiKey, or similar, to separate your phone number from 2FA verification.

To my many security guru connections, what have I missed?

Links:

Apple recovery contact:

    - https://support.apple.com/en-gb/102641
    - https://support.apple.com/en-gb/102608
    - https://support.apple.com/en-gb/118574

iPhone Stolen Device Protection:

    - https://support.apple.com/en-gb/120340

giffgaff lost phone:

    - https://help.giffgaff.com/en/articles/233996-i-lost-my-phone-what-should-i-do

https://www.moneysavingexpert.com/mobiles/steps-to-take-befo...

Check whether any two factor authentication apps you use support backup, and plan how you will regain access to accounts that require them.

That was posted elsewhere, but links to that site don't work on HN, hence the wall of text.

Some of the comments posted in response on the other site may be copied here.

Also, remember the important case of a phone that suddenly dies defectively.

Another consideration: some apps are locked to the particular device using secure enclave chip so even if you had a full backup of the phone, data, and apps it's possible some apps won't even work on a new phone. You would need to have a second active handset (perhaps the one you retired because the battery was dying?) with some of your apps so a replacement handset for the stolen device can have the ultra-secure app authorized onto the new handset. Right now only one of my apps is this secure but I don't understand why more apps aren't this secure.

Prioritising the request people make that they can easily move to a new device, over the security that it offers?