Losing a Phone With Everything on It

What is actually on it

For most small businesses, more than any other single item they own.

The diary. Customer names and numbers. Photographs of jobs. Quotes and invoices in an app. The email account that resets every other password. Banking. And frequently the authenticator holding the codes for everything.

That concentration is genuinely useful and it makes the phone a single point of failure for the whole business.

Which is worth thinking about carefully before it goes missing, rather than during the afternoon it does.

The four things that matter

1. A screen lock, which is the difference between a lost device and an open one.
2. Remote wipe enabled, so it can be cleared from elsewhere.
3. A current backup, so a replacement restores rather than starts empty.
4. Recovery codes stored separately, so two-factor does not lock you out.

The fourth is the one that turns an inconvenience into a genuine crisis, and it is the one nobody sets up.

If your authenticator was only on that phone, and the recovery codes were only in a note on that phone, you are locked out of your own accounts with no route back.

A worked example

A plumber whose phone went into a customer's flooded basement.

He had a backup, so the replacement restored his photographs, contacts and messages within an hour.

What he did not have was any copy of his authenticator codes.

His email, hosting, banking and supplier accounts all had two-factor enabled, correctly, and the only device that could produce the codes was at the bottom of a basement.

Recovering access took eleven days, most of it spent proving identity to various support departments.

The fix afterwards took ten minutes: printing the recovery codes for each account and putting them in a folder at home.

His comment afterwards was that the security had worked exactly as designed, against him rather than for him.

The screen lock

The most basic measure and still not universal.

A phone without one, found by somebody, gives them the email account, which gives them everything else.

A biometric lock is convenient and works with gloves rarely, which is why trades frequently disable it and then disable the passcode too.

A six-digit code is a reasonable compromise, and modern phones do not ask for it constantly.

Also worth setting: how long before the screen locks itself. A phone that stays unlocked for fifteen minutes sitting on a counter is effectively an unlocked phone.

Remote wipe

Available on every current phone and frequently not switched on.

It lets you locate the device, lock it with a message, or erase it entirely from any other computer.

The locating part is genuinely useful for a phone left in a van rather than stolen, which is the more common situation.

Setting it up takes two minutes and requires knowing the account password, which is another argument for the password manager.

Test that you can actually reach it before you need to, because the moment to discover you are not signed in properly is not the afternoon the phone goes missing.

The insurance question

Worth checking, because most people assume more cover than they have.

A phone used for business may not be covered by home contents insurance, and business equipment cover frequently has conditions about how devices are secured.

Some policies exclude devices left in vehicles, which for a trade is exactly where a phone is most likely to be lost.

And the replacement value matters less than the disruption, which is rarely covered by anything.

A five-minute check of what your policy actually says is worth doing once, and it frequently prompts a small change that costs very little.

What to back up

More than people assume, and most of it is automatic if configured.

Photographs, which for a trade are business records rather than snapshots. Contacts. Messages, which frequently contain agreements. App data for anything holding quotes or job records.

What is frequently not backed up: authenticator codes, some messaging apps by default, and anything stored only in a note.

Check what your backup actually includes rather than assuming everything, because the exclusions are exactly the things you would miss.

The counter-case

Where the answer is not more phone security.

A business whose phone holds too much, where the better fix is moving the important things off it: job records into a proper system, photographs into cloud storage, quotes into something reachable from anywhere.

Then the phone becomes a device that reaches things rather than the place they live, and losing it becomes much less serious.

That is a better arrangement than locking down a device that remains a single point of failure, and it solves several other problems at the same time.

What to do in the first hour

If it has already gone, the order matters.

Try to locate it first, because a phone in a van or a customer's hallway is the most likely outcome and everything else becomes unnecessary.

If it is genuinely gone, lock it remotely rather than wiping immediately. A locked phone displaying a contact message is frequently returned, and wiping removes that possibility.

Change the password on your email account, from another device, because that is the account everything else depends on.

Contact your mobile provider to suspend the number, which prevents anybody receiving text-based verification codes.

Then wipe it, once you have accepted it is not coming back, and start the replacement from your backup.

The order matters because each step forecloses the previous one, and rushing to wipe loses the chance of getting it back.

The separate work phone question

Worth considering and not obviously right.

Two devices separates business from personal, means a lost personal phone does not affect the business, and lets you leave one behind at the weekend.

It also means two devices to charge, carry and lose, and most people end up using one anyway.

For a sole trader the practical alternative is one phone with a second number, which achieves the separation that matters without the second device.

Where a business has staff, work phones become more clearly worthwhile, because a departing employee's personal phone full of customer data is a problem you cannot easily do anything about.

The half hour

Everything above, done once.

Set a lock and a short timeout. Enable and test remote wipe. Check the backup runs and what it includes. Print the recovery codes for your four or five important accounts.

Then put those codes somewhere physical that is not the phone, and tell one other person where they are.

Half an hour, once, and it converts the worst version of this into an afternoon of annoyance.

What those codes protect is covered in turning on two-factor everywhere that matters.

Frequently asked questions

West Coast Media Solutions Inc. provides web design, web development, hosting, digital marketing, and business consulting to organisations across Canada, drawing on more than twenty-five years in the field.