Account Security
Part of Mobile devices for work
Protecting work data on a lost phone
Respond to a missing work phone by containing account access, checking remote actions and assessing exposed data.
When a phone with work access or data goes missing, report it to the organisation’s nominated contact immediately, even if it may turn up. Record when it was last seen, contain access, use the device controls available and assess what information may be exposed. A remote command is not proof that the phone received or completed it.
Give staff one reporting route
Set one internal reporting route, including outside office hours, and tell workers whom to contact. Ask for the assigned user, phone number or asset identifier, last known place and time, and whether the phone held customer records, downloaded files or work messages.
A worker who suspects theft should report it without confronting anyone to recover the device.
Record each response action and its result. This shows the response owner which accounts were secured, which device commands completed and what still needs attention.
Immediate actions after reporting a lost phone
- Report to designated contactUse the single internal reporting route, including outside office hours.
- Provide device detailsShare user name, phone number, asset ID, last known location and time.
- Confirm data exposure riskIndicate if customer records, downloaded files or work messages were on the device.
- Do not confront suspected thiefReport without attempting recovery to avoid escalation.
Contain access
Use account administration to end work sessions or revoke access where the service allows it. Check whether credentials, authentication prompts or recovery codes on the phone create further risk, and change credentials where warranted.
If the phone number itself could be misused, ask the mobile provider about suspending the service or replacing the SIM. Arrange another way for the worker to receive essential calls.
For an organisation-managed Apple device, check the management console for Managed Lost Mode or remote wipe, issue the available command and record its status. If the phone is offline, treat a lock or wipe as pending and check the console again; a pending command is not confirmation of completion.
For other devices, check the management console and relevant platform guidance to confirm which controls are available and their status. Use the management controls set up before the loss.
For a personally owned device, check the management console and organisation policy to confirm whether work data can be removed and what effect the action will have on personal data.
Remote wipe vs. Managed Lost Mode: pros and cons
- Remote wipe (pros)Removes all data permanently; prevents unauthorised access to sensitive information.
- Remote wipe (cons)Irreversible; may delete personal data on personally owned devices.
- Managed Lost Mode (pros)Locks device with a message, enables tracking, and preserves data for later recovery.
- Managed Lost Mode (cons)Does not remove data; requires active monitoring and follow-up.
Assess what may be exposed
Check the device’s lock and encryption status, its last management contact, the work information stored locally and any unusual account activity. Include copies in personal apps or downloads if the work process allowed them. A screen lock and encryption can reduce risk, but neither settles the assessment on its own.
If personal information may be involved, follow the organisation’s data-breach process and consult OAIC guidance on Part IIIC of the Privacy Act. Notification depends on whether the incident is an eligible data breach and whether it is likely to cause serious harm.
Key data breach risks from lost phones in Australia
- Encryption statusReduces risk if enabled; not sufficient alone.
- Screen lock presenceHelps limit access but does not prevent data extraction.
- NDIA scheme applicabilityMay trigger notifiable data breach if personal information is involved.
- Serious harm thresholdNotification required if likely to cause serious harm under Privacy Act Part IIIC.
Restore work safely
Document the old phone’s work-access status before issuing a replacement. Enrol the replacement, restore work through approved systems and check that the worker can perform essential tasks.
If the old phone returns, keep it out of use until its state has been checked and a reset or reassignment decision made.
Record any response gap, such as an unclear reporting route or a personal device that cannot be managed, for follow-up.
