Phone stolen abroad: how to lock down and regain money access

The first hour is a race between you and whoever holds your phone. Every minute it stays connected with a live SIM, it can receive the SMS codes that reset your passwords. So you work in a fixed order that closes doors by value: the device itself, your cards, your phone number, and finally the email account that can reset everything else.

You do not need your own device for any of this. A hostel computer, a travel companion’s phone or a hotel tablet is enough: Find My and Find Hub both work from any browser, card freezes sit one tap deep in issuer apps or web banking, and carriers handle SIM blocks by phone or chat. Memorise or store the logins you would need — that is the preparation half of this guide.

Organised phone thieves rarely care about resale hardware any more. The valuable theft is an unlocked phone, or a locked one with a known passcode — watched over your shoulder in a bar or metro before the snatch. With the passcode, a thief can open banking apps that fall back to the device passcode, approve payments in mobile wallets and read incoming SMS codes.

Worse, on both major platforms the passcode has historically been enough to change the Apple or Google account password, switch off tracking and lock you out of your own cloud. Newer stolen-device protection features add biometric checks and time delays to exactly these actions — turn them on before the trip, because they are the difference between annoyance and takeover.

Passcode hygiene abroad is simple and unglamorous: use Face ID or a fingerprint in public so there is nothing to observe, keep a long alphanumeric passcode instead of six digits, and shield it like a card PIN at an ATM on the occasions you must type it. Assume every busy tourist street has someone whose job is watching thumbs.

Recovery runs on connectivity, so the next task is getting a working device online. A cheap local handset or your backup phone plus a travel eSIM gives you data within the hour in most countries. If you travel with a second device already set up — even an old phone in the bottom of your bag — this step costs you minutes instead of a day.

Data is the easy half. The hard half is your home mobile number, because that is where banks send SMS codes, and account recovery stalls without it. Ask your home carrier to reissue the number as a new eSIM on your replacement device; many carriers do this online or through support chat. Until then, some banks can switch verification to email or an authenticator — ask, do not assume.

If you rely on a single physical SIM from home, think about converting it to an eSIM or adding a dual-SIM setup before the trip: a number that exists only as plastic in a stolen phone is the hardest one to get back quickly. And keep the home plan paid up — a lapsed number eventually gets recycled, and whoever receives it next inherits your SMS codes.

With a device and a number, rebuild access one institution at a time, starting with the account your trip depends on. Install the app, start the sign-in or new-device flow, and expect layered checks: a password, a code sent to your number or email, and often a fresh selfie or a short video for KYC re-verification. Fintechs in particular treat a new device as a risk event and re-run identity checks from scratch.

When automated flows fail — usually because the code goes to the blocked number — you land with support. They will ask for the details that prove you are you, so have them ready before the call, and write down every case number: insurers and banks will want them later.

Expect the full rebuild to take from an afternoon to a few days, depending on how many providers you use and whether your documents are at hand. That is another argument for the pre-trip setup in the last section: every app whose recovery you have tested at home is an app you restore in minutes rather than escalate for days.

Between the theft and full recovery there is a gap — hours or days — when your usual way to pay is gone. This is what the physical backup card is for: a card from a different provider than your main one, stored away from the phone (hotel safe, money belt, a companion’s bag), that works with no app at all. Chip-and-PIN needs nothing from your stolen phone.

A modest cash buffer does the same job for the first evening: food, transport, a phone call. If you have neither, you are down to slower routes — a money transfer picked up in cash from a nearby agent, or web banking from a borrowed laptop if your bank allows browser payments. All are survivable; all are worse than a card and notes you positioned in advance.

Keep the backup card genuinely independent: a different provider, ideally a different card network, and never stored in the phone case with the device it is supposed to rescue. Test it before departure with a small purchase and an ATM withdrawal so you know its PIN works — discovering a wrong PIN mid-crisis is a self-inflicted second emergency.

A mobile crypto wallet on a stolen phone is protected by the same wall as everything else: the passcode plus the wallet’s own PIN or biometrics. If there is any chance the thief knows the passcode, treat the wallet as compromised — restore it from your seed phrase on a safe device and move funds to fresh addresses immediately.

That is only possible if the seed phrase never lived on the phone. A seed in a photo, a note-taking app or a cloud drive turns phone theft into wallet theft in the same hour. Keep it on paper or steel, stored separately from the device, or better, keep travel funds behind a hardware wallet so the phone is just a viewer.

Exchange apps re-authenticate like fintechs: new device, email code, selfie. Many exchanges also freeze withdrawals for a cool-down period after a password or device change — inconvenient mid-trip, but it works in your favour after a theft. Log the theft with the exchange’s support so unusual activity is flagged from their side too.

Filing a report will not bring the phone back, but the report number is the key that opens every claim that follows. Travel insurers and phone insurers commonly require a police report filed within a short window — often a day or two — and refuse theft claims without one. Some banks also ask for it when you dispute fraudulent transactions made after the theft.

Go to the nearest station (or the tourist police in many destinations), bring your passport, and describe the theft factually. Ask for a written copy or at least the report number. You will also want the phone’s IMEI — you can usually retrieve it from your carrier account or the original box — because insurers and some police systems track devices by it.

For the claim itself, insurers typically want the report, proof of purchase and sometimes proof the phone was in your possession during the trip. Payouts are usually depreciated rather than replacement-value — check the policy and its limits before assuming a new flagship is covered.

Everything above gets dramatically easier if you spend one hour on settings before the flight. The goal is layers: even if a thief has the phone and the passcode, each layer they hit — SIM PIN, biometric-gated account changes, codes that live on paper instead of the SIM — costs them time and usually stops them completely.

Two tests are worth doing from your sofa: sign in to Find My or Find Hub from a browser and confirm you can see the phone, and walk through one bank app’s recovery flow to learn what it will demand. Store your IMEI, carrier support number and card-freeze paths somewhere that does not depend on the phone — a password manager plus one printed copy.