Protecting a lost device
What to do, in order, when a phone or laptop that was signed in to your account is lost or stolen.
On this page
A lost phone or laptop can hold three things an attacker wants: a signed-in session, a passkey, and an authenticator app. You can cut off all three from another device. This page puts the steps in the order that matters most.
If you have no other device that is signed in, jump to If you cannot sign in at all.
Do these in order#
- End every session. On a device you trust, sign in and open Devices. Select Sign out everywhere, at the top right. The dialog is titled Sign out of every session? and says you will sign in again. This ends every session on your account, including the one you are using, and the apps those sessions signed in to lose access. A copy of your session that sits in the lost device stops working. Sign in again afterwards. If this session began with the emailed-code fallback for a lost passkey, the page first asks you to confirm with a passkey or an authenticator code.
- Forget the device. Open Devices, then the Trusted devices tab. Find the device and select Remove. The dialog says that signing in from it again makes it a new device. If you are not sure which one it is, Untrust all devices marks every device as Not trusted and makes each count as new on its next sign-in.
- Remove its passkey, if it held one. Open Security, then Passkeys, find the passkey you named after that device and select Remove passkey. The dialog says it stops working here and that other signed-in devices are signed out. Your device may still list the passkey until you delete it there too, which you cannot do for a lost device, so removing it here is the step that counts.
- Replace the authenticator app, if it was on that phone. Open Security, then Two-step verification. Select Turn off and confirm, then set up the app again on a new device with Set up an authenticator app.
- Create a fresh set of recovery codes if the old ones were on the lost device. Create a new set stops the old codes working. See Keeping recovery codes safe.
- Change your password on the Password tab if the device held it, for example in a browser that remembers passwords. Saving signs your other devices out and keeps this one. The form also offers Also revoke my personal access tokens.
- Review connected apps. Open Apps and access and revoke any app you do not recognise. See Connected applications.
Some of these steps are sensitive changes, so the page may ask you to confirm with a passkey or an authenticator code first. If your confirmation method was on the lost device, use another passkey, or an authenticator code from another device, or go to If you cannot sign in at all.
What each step does and does not do#
| Step | Stops | Does not stop |
|---|---|---|
| Sign out everywhere | A stolen live session, and app connections made through it. | Someone who can sign in again with a passkey or password the device holds. |
| Remove the device | The account treating it as known. | Its passkey. Remove that too. |
| Remove the passkey | Sign-in with that passkey. | A password that the thief knows. |
| Change the password | Sign-in with the old password. | A passkey still on the device. |
| Turn off the app | Codes from that app. | Recovery codes you did not replace. |
That is why the list covers all of them. No single step is enough.
You will get emails#
Each change emails a security alert to every verified address on your account. They say, for example, Passkey removed., Password changed., Authenticator app disabled. or Every session on your account was signed out from your account page. These are your own actions coming back to you. See What a security alert email means.
If you cannot sign in at all#
- Try another method you have: another passkey, or your password. If your second step was on the lost phone, use Use a recovery code where your organization allows it, or, when the lost passkey was your only second step, type your password and choose Email me a code instead (a sign-in one level lower than a passkey; your other addresses are told). Email me a sign-in link works only for an account with no passkey.
- If nothing works, start account recovery from a browser you control. See If you are locked out. Recovery signs you out everywhere and lets you set new sign-in methods.
- When you are in, follow the steps above.
Recovery can have a wait before anything changes, and the platform emails you in that time. If you did not start a recovery, you can cancel it from that message.
If the lost device is not yours alone#
If the lost device is a work laptop that also holds an organization session, tell your organization's administrator as well. Ending your TDACorp sessions does not wipe the device.
Prevention#
- Keep a second passkey on a different device, so one loss does not lock you out.
- Keep recovery codes away from the device that holds your authenticator app.
- Put a screen lock on every device that holds a passkey. A passkey needs your face, fingerprint or screen lock to use, so a lock is what stands between a thief and it.
- Do not tick Keep me signed in on this device on a device you do not control.
- Add a second verified email address so losing one mailbox does not cut you off.