Employee Loses a Phone: What Happens to Company Email? First 30 Minutes

A sales manager calls at nine in the morning: the phone fell out of a pocket while getting out of a taxi. It holds company email, customer chats, a banking app and the authenticator that generates sign-in codes. Whether the phone turns up or not, what happens in the next thirty minutes sets how bad this gets.

Most companies have no written order for this. Everyone says “first we should call it”, the phone turns out to be switched off, and the whole thing stalls.

Which risk do we close first?

A lost phone carries two separate risks, and they need different fixes.

1. Data on the device if the lock is bypassed. With a strong screen lock and disk encryption (the default on current iPhones and Android phones), pulling data off the device is hard. The real weak spot is a PIN that someone has watched being typed.
2. Sessions the phone keeps open. Email, Teams, SharePoint, VPN. These live in the cloud, so a switched-off phone does not close them. If someone gets past the lock, everything is waiting.

I close the second one first, because it can be done remotely and immediately.

The first 30 minutes, in order

Minutes	Action	Who
0-5	Reset the user’s password and revoke open sessions	IT / admin
5-10	Put the device in lost mode and lock it (Lost Mode on iPhone, Find Hub on Android)	User or IT
10-15	Move the second sign-in factor to the new device and delete the old registration	IT
15-20	Send a selective wipe request for company data (a full wipe if the device is company-managed)	IT
20-30	Have the carrier block the SIM and file a lost-or-stolen report for the IMEI	User

Password and sessions

With Microsoft 365, the Entra admin center has a revoke-sessions option on the user page. Use it together with the password reset. One catch: access tokens can stay valid for roughly an hour, so revocation is not instant. That is exactly why this is step one and why we do not wait.

When the phone is the second factor

The same phone often carries the authenticator app. Someone who gets past the lock already holds half of the second step, even without the password. So remove the old device’s registered method, issue a temporary access code and have the user set the factor up again on the new device. If you use SMS codes, calling the carrier is part of this step.

Wipe: full or selective?

On a company-managed (enrolled) device you can wipe everything. On an employee’s personal phone that is a problem, legally and humanly: the photos of their child go too. The answer is an app protection policy. In Microsoft Intune this is called selective wipe, and it removes only the data of managed apps such as Outlook and Teams. According to Microsoft’s documentation, the user has to open the app for it to take effect, and it can take around 30 minutes. If the phone is off, the wipe waits. That is why session revocation at minute five comes before the wipe.

The Türkiye side: carrier and IMEI

The user does three things: asks the carrier to block the line, finds the IMEI (dial *#06#, or check the box and receipt), and files a lost-or-stolen report. In Türkiye the report can go through the e-Devlet government portal’s IMEI service, through the telecom regulator BTK’s 120 line, or through the police. Once approved, the device is cut off from mobile networks in Türkiye. Check the current steps on the e-Devlet screen, since the interface changes now and then.

There is a limit: an IMEI block does not stop the phone being used abroad or on Wi-Fi only, so it does not replace the earlier steps.

What to prepare before it happens

• Screen lock of at least a 6-digit PIN, biometrics on. Remove any policy that allows 4-digit PINs.
• Company email only in managed apps. Do not let the account be added to the phone’s built-in mail app. With an app protection policy you can also restrict copy-paste and screenshots.
• Find-my-device switched on. It cannot be enabled after the phone is gone.
• A one-page lost-phone procedure. Who to call, which number, how fast. A panicking employee only has to read it.
• A backup sign-in method. Every user should have two registered methods, not one phone.

If the phone held personal data such as customer chats or lists, the incident may count as a data breach, and the 72-hour notification clock under Türkiye’s data protection law (KVKK) starts running. Keep the session logs and the time of the wipe request.

Frequently asked questions

If the phone is found, does everything go back to normal?

No. If you changed the password or deleted the second-factor registration, it has to be set up again. And a recovered phone is best reset to factory settings before anyone trusts it.

Can I impose company policy on an employee’s personal phone?

An app protection policy does not manage the device, only the data inside company apps. You still need to tell the employee in writing and get their consent. Spelling out the scope also heads off an argument later.

The employee says “I’ll find it”, should we wait?

No. A password reset and session revocation take a minute and can be undone. The cost of waiting cannot.

If you want a lost-phone procedure written, or the mobile devices in your company reviewed, get in touch.