Set these up before your phone is stolen

Every one of the settings below has to be on before the phone leaves your hand. Apple's and Google's lost-phone pages both start from the assumption that you did this already. Google's list of what a lost Android needs before it can be found includes "Is signed in to a Google Account" and "Has Find Hub turned on." There's no turning it on after.

The thief isn't after the handset, either. Activation Lock and factory reset protection have made a stolen phone hard to resell for years. What's valuable is what the phone opens. Apple's reason for its theft mode is that it "helps protect your accounts and personal information," and the things it guards are saved passwords, credit cards, Apple Pay, and the Apple Account password that resets everything else. Google's first-hours list is about "cutting off access to your email, photos" and "any cards linked to your Google Wallet." A four-year-old phone with a cracked screen and a saved bank login is not a worthless phone.

One. Turn on finding, with the offline options

iPhone. Open Settings, tap your name, tap Find My, then Find My iPhone, and turn it on. Two more toggles sit under it. 'Find My network' lets the phone be found when it's offline, through what Apple describes as "a crowdsourced network of over a billion Apple devices" that relay its location anonymously. 'Send Last Location' sends Apple the phone's position when the battery runs low. Turn on all three. Apple's feature page hedges about which ones. "Some devices, like iPhone, can still send their location for up to 24 hours after they've been turned off or have low battery life." Apple prints no model list.

Turning on Find My also turns on Activation Lock by itself. Apple's words are that "Your Apple Account password is required before anyone can turn off Find My, erase your device, or reactivate and use your device." That's what makes the phone a brick to resell.

Android. Google renamed Find My Device to Find Hub, so that's the word to look for. Open Settings, then Security, then Find Hub, and check that 'Allow device to be located' is on. Then, in Settings, then Google, then All services, then Find Hub, tap 'Find your offline devices'. You get four choices, from Off to 'With network everywhere', and the last one casts the widest net. Google says that on supported phones like the Pixel 8 series, the network "can still locate the phone for several hours after it's turned off." On older phones, offline means the last place it was seen while online.

Two. Turn on the theft mode your phone already has

Both phones now have a mode built for the moment a thief has the handset and has watched you type your passcode.

iPhone: Stolen Device Protection. It needs iOS 17.3 or later, Face ID or Touch ID, two-factor on your Apple Account, Significant Locations, and Find My. Open Settings, then Face ID & Passcode, and look for Stolen Device Protection. Apple says it "might be turned on by default," which means check, don't assume. When it's on and you're away from familiar places like home and work, the sensitive actions need Face ID or Touch ID "with no passcode alternative or fallback," and changing the Apple Account password makes you "wait an hour and then perform an additional Face ID or Touch ID authentication." Apple's own description of the threat is a thief "who has stolen your iPhone and knows your passcode." At home the extra steps switch off, unless you set 'Require Security Delay' to 'Always', which is the setting I'd pick.

Android: Theft protection. Open Settings, then Google, then All services, then 'Theft protection'. Turn on 'Theft Detection Lock', which Google says "uses AI, your device's motion sensors, Wi-Fi, and Bluetooth" to lock the screen if the phone is snatched out of your hand. Turn on 'Offline Device Lock', which locks the screen after a short stretch offline. Turn on 'Remote Lock', which lets you lock the phone from any browser at android.com/lock with your phone number and a captcha, no sign-in required, as long as the SIM card is still in the phone. If 'Identity Check' is listed, turn that on too and set your trusted places. Google says it's "available on certain devices," and if your phone doesn't list it, yours isn't one. The first three need Android 10 or newer and arrived through Google Play services rather than a system update, so a phone still getting Play updates has them. Identity Check needs Android 15 and a phone that supports it.

Three. The passcode

Biometrics exist so you almost never type the code in public. Six digits rather than four, a number that isn't your birthday, and Face ID or your fingerprint doing the daily unlocking. Apple built Stolen Device Protection because a watched passcode used to be the master key. The less often it's typed where someone can see it, the less anyone learns by watching.

Four. Know the buttons before the day

iPhone. From any browser, iCloud.com/find, or the Find My app on someone else's Apple device. 'Mark as Lost' locks the phone with your passcode, suspends your Apple Pay cards, and puts a message and a phone number on the screen. Use a friend's number, since yours is the one that's gone. Apple notes the phone "won't appear online and in Lost Mode until the device is turned on and connected to Wi-Fi or cellular," so a phone in a thief's bag shows up when it comes out of the bag. Then call your carrier and ask them to disable the line.

Erase is the last step. Apple's page tells you to make sure "that you've tried everything else to find it, because erasing your device can't be undone," and an offline phone erases "the next time it's online." One more thing, in Apple's words. "Don't remove the device from Find My, even if you remotely erase it. Removing the device from your Find My list removes Activation Lock, which will make it easier for the thief to unlock and resell your device."

Android. From any browser, google.com/android/find, or the Find Hub app. 'Secure device' locks it with your PIN, pattern or password, shows a message, and signs your Google Account out of the phone. If you set up Remote Lock in advance, android.com/lock does the same lock with your phone number and a captcha, as long as the SIM is still in it. Then call the bank about cards in Google Wallet, call the carrier, who Google notes "can also block the device's unique IMEI number, which stops it from being used on their network," and file the police report. Erase last. After a factory reset the phone drops out of Find Hub, and Google says "to use your device again, you need your Google Account password," which is the thief's problem.

What this doesn't do

The phone has to be on and connected, or a recent model with the offline network on, for any of the finding to work. A thief who powers it off in the first minute leaves you the offline window, which Apple puts at up to 24 hours on the devices that support it and Google describes as "several hours" on supported phones like the Pixel 8 series. On a phone that supports neither, you get the last known location, which Apple holds "for up to seven days." The theft modes guard Apple's and Google's own features. A banking app with its own four-digit PIN is guarded by that app's settings, not by these.

Check it tonight

Open Settings and look at four things. Find My or Find Hub on, with the offline option. The theft mode on. A six-digit code you don't type in public. And you know which website to open from someone else's phone. If all four are true, the worst day with your phone is an expensive annoyance instead of the start of something longer.

Did you find the theft mode already on, or off? Apple says "might be," and I'd like to know how that's playing out on real phones. joel@freshfromcache.com