Protecting company accounts on a lost or stolen phone means closing the sessions that are already open on that device, not just changing the password. On an unlocked phone, email, file and messaging apps keep working without asking for a password again. In the first hour, sign the device out, reset passwords, lock the phone and record what happened.
Key takeaways
- Changing a password does not end an existing session on every system; revoke sessions separately.
- The first-hour order: close sessions, reset passwords, lock the device remotely, suspend the SIM, write it down.
- Multi-factor authentication makes new sign-ins harder, but it does not protect a session that is already open.
- If the phone held emails or files with personal data, treat the loss as a possible personal data breach under KVKK.
- Bringing accounts under a single identity shrinks the list of sessions to close to one screen.
Why are open sessions on a stolen phone so risky?
An employee's phone now carries company email, shared mailboxes, shared files and often admin panels too. Apps do not re-authenticate the user every time they open; a session token sits on the device and stays valid until it expires. Whoever gets past the screen lock can read mail, reply in the company's name and download files without any password.
Most attacks still target passwords. According to the Microsoft Digital Defense Report 2025, more than 97% of identity attacks are password attacks, and phishing-resistant multi-factor authentication (MFA) can stop over 99% of them. A thief holding your phone, however, needs no password: the session is already open. That is why even strong multi-factor authentication is no substitute for being able to close a session remotely.
Preparation is patchy as well. In a survey of 781 e-commerce businesses for the Turkish Ministry of Trade's E-Commerce Outlook Report 2025, only 43.7% said they apply security policies on company devices. In other words, more than half of the businesses surveyed did not report any security policy for company devices, so a lost phone often catches them unprepared.
What should you do in the first hour after a phone is stolen?
Following the same sequence every time makes sure no account is missed. Write it down in advance:
- Report it. The employee tells IT or their manager the moment they notice the phone is gone; note the time.
- Close company sessions. Remotely end that device's sessions in email, file storage, messaging and admin panels. If a service shows no device list, use "sign out of all devices".
- Reset passwords. Change the company account password and any other passwords that may be saved on the phone. If any mailbox runs on a shared password, change that too.
- Review MFA methods. If the authenticator app was on the missing phone, remove that device as a sign-in method and enrol the new one.
- Lock or wipe the device. For a company phone, lock it remotely through your device management tool; wipe it if it is clearly not coming back. On a personal phone, make that decision with the employee.
- Suspend the SIM. A working SIM lets whoever holds it read text-message codes; ring the mobile operator.
- Check the logs. Look for emails sent, files downloaded and forwarding rules changed after the phone went missing.
- Write it up. Record when the loss was noticed, which accounts were open and when each step was taken, in one place.
If you find signs that an account has already been misused, move on to our guide to the first 24 hours after an email account is compromised.
Which accounts and sessions should you check on a lost phone?
Often nobody knows where the open sessions are. The table lists the company sessions typically open on a phone and what to do about each.
| Account / app | Risk if left open | What to do |
|---|---|---|
| Company email app | Reading mail, sending as the company, forwarding rules | Revoke the session, reset the password, review sent items |
| Shared mailboxes (info@, accounts@) | Access to customer and supplier correspondence | Remove the person's access; change any shared password |
| Mail client on the phone (IMAP) | May keep working with its own password | Revoke the app password |
| File-sharing app | Downloading contracts, invoices, HR documents | Revoke the session, review shared links |
| Messaging apps | Customer groups, internal chats | Log out of linked devices |
| Admin and accounting panels | Adding users, changing payments and settings | Revoke the session, reset the admin password |
| Authenticator app / SMS | Completing the second step of new sign-ins | Remove the device as a sign-in method, suspend the SIM |
Keeping this list per employee takes most of the chaos out of the first hour. The same inventory pays off when you close every account of an employee who leaves; in both cases the question is the same: where does this person have an open session?
Remote wipe or session revocation?
The two are not interchangeable. A remote wipe erases the data on the device, but the command may never arrive if the phone stays offline, and on a personal phone it needs the employee's consent. Companies without mobile device management (MDM) often have no wipe option at all.
Session revocation, by contrast, happens on the server. Even if the phone is switched off or offline, the account refuses access the next time the app tries to connect. Mail and files already downloaded to the phone may still remain on it, which is why screen lock and device encryption matter as well. So the first step is always to close the session; locking or wiping the device comes second.
On some systems a password change closes existing sessions, on others it does not; test this in advance for each service. We cover password rules and the risks of shared passwords in our business password security guide.
Is a lost phone a personal data breach under KVKK?
If the phone held emails or files containing customer, supplier or employee details, it falling into unauthorised hands can amount to a personal data breach. Article 12 of Türkiye's Law No. 6698 (KVKK) requires the data controller to take technical and organisational measures that ensure an appropriate level of security. It also requires notifying the data subject and the Board if personal data is obtained by others unlawfully.
The Personal Data Protection Authority's 2025 Annual Report, citing Board Decision 2019/10, restates that notification to the Board must be made without delay and within 72 hours at the latest of becoming aware of the breach. We walk through the assessment in our guide to data breach notification within 72 hours. Device encryption, fast session revocation and a written record of both are your strongest evidence when judging the level of risk.
How can you prepare for a lost phone in advance?
These measures, taken beforehand, turn the first hour into a few minutes:
- Make screen lock and device encryption mandatory. The rule should be identical on every phone that runs company apps.
- Turn on MFA for every company account. Make sure the backup sign-in method is not tied to the same phone.
- Bring accounts under one identity. Ten apps with ten passwords means ten separate sign-outs; single sign-on (SSO) with central session management brings that down to one screen.
- Stop sharing passwords for shared mailboxes. If access is granted per person, a lost phone does not force a password change that disrupts the whole team; see mailbox permissions and delegation.
- Make sure staff know what to do. Reporting a lost phone is not embarrassing, it is urgent; include it in your security awareness training.
How does Smart360 make this easier?
In the Smart360 family developed by Digital Bridge, SmartMail, SmartFiles, SmartOperator and SmartPass all use one identity, SmartID. In a lost-phone situation, that means the sessions you need to close are visible in one place. Smart360 lists open sessions together with device details; you can close a single device, or every device except the one you are using, remotely. When the password changes, sessions on all devices are closed.
A concrete scenario: an operations lead at a logistics firm has their phone stolen on site. The phone has SmartMail open with the shared operations@ mailbox, plus customs documents in SmartFiles. From an office computer, the employee opens the session list, recognises the phone and closes only that device's session. They then change their password, which closes sessions on any other devices too.
The rest of the team does not need a new mailbox password, because in Smart360 mailbox passwords are generated by the system, stored encrypted and never handed out to staff. Access is a permission granted to a person, not a password. If needed, an administrator can remove the employee's access from one place, and the permission change shows up on open screens immediately. SmartFiles download and preview links expire within minutes, so an old link left on the phone soon stops working. You can explore the whole family on our Smart360 product page.
How can Digital Bridge help?
Digital Bridge, based in Adana, has been building software and providing consultancy for organisations since 2013. For the lost-device scenario we first map which employee is signed in to which app, then write your first-hour procedure with you. This work can be carried out as part of our cyber security consultancy.
When you move to Smart360, we set up users, departments and shared mailboxes, plus domain and DNS settings, with guidance from the Smart360 team. More articles on the subject are collected in our Cyber Security & Compliance hub.
Next step: test your lost-phone plan today
Run a five-minute drill: assume one employee's phone is gone and time how long closing all their company sessions takes. If it takes too long, or some apps offer no way to close a session at all, it is time to bring your accounts under one identity. For a wider checklist, see our SME cyber security checklist.
To buy the Smart360 family, use the Smart360 purchase page; product details are on our Smart360 page. If you would like us to review your current set-up with you, get in touch through our contact page.