My iPhone was stolen and Find My was switched off

Somewhere between the theft and the moment you got to a computer, you opened Find My and the truth landed: no device. Not offline, not “location not available”, just gone from the list. Find My was switched off, probably within minutes of the theft, possibly using your own passcode while someone watched you type it on the metro.

The feeling this produces has a name: helplessness. The one tool you thought you had, the map with the moving dot, was taken off the table before you could use it. So before anything else, one correction to the picture in your head, because it changes everything that follows: Find My is a location feature. Activation Lock is a security feature. The thief switched off the first. The second is still holding, and it is the reason your phone is worth a fraction of what they think they took.

Why it is not over

Understand what actually happened and what did not.

For Find My to be switched off, the thief needed your Apple ID password, which normally means they watched you enter the passcode and then exploited the short window before you could react, or in rarer cases used a technique to change the Apple ID password on the device. It is an ugly trick, but it is also narrow: it requires proximity, observation, and speed. If your phone simply vanished from Find My while showing offline for a while first, check again from icloud.com/find and confirm it is truly removed rather than merely unreachable; the distinction between offline and removed trips up a lot of people, and it is covered in the guide to Find My showing no location.

Here is what the thief does not have. Activation Lock binds the device to your Apple ID at a level below the operating system. It survives a factory reset. It survives a reflash in a repair shop. A phone carrying it cannot be set up as a new device or resold as working hardware without your credentials. Remove your Apple ID from that device and the lock disappears, so the most important discipline here is: never remove the device from your account, and never surrender your credentials to anyone who contacts you about “finding” the phone.

What they have, realistically, is a locked device to sell for parts: screen, board, battery harvested by the grey market. That is the outcome you are defending the rest of your data and money against, and it is a manageable one.

Five things to do today

Not this week. Today, in roughly this order, from any device with a browser.

1. Mark the device as unavailable in your Apple ID account. Sign in at appleid.apple.com, find the device under your list, and mark it lost or unavailable. This registers the device as lost on your account even with Find My disabled. If it turns out the phone is merely offline rather than removed, Lost Mode still reaches it the moment it reconnects.
2. Block the IMEI with your carrier. Find the IMEI on the original box, the purchase receipt, or your device list in your Apple account. Call the carrier, verify your identity, ask for the SIM to be suspended and the IMEI to be blocklisted. The blocked phone loses cellular service entirely, in your country and usually across partner networks, which cuts its value again. The exact procedure is in the IMEI blocking guide.
3. File a police report. Bring the IMEI, the purchase proof, the time and place of the theft, and any witnesses. Ask for the report number. This is not a formality for your feelings: insurers require it, carriers sometimes require it before sharing trace information, and stolen-device seizures are matched to reports, meaning an unrecovered phone with no report stays unrecovered forever.
4. Change your Apple ID password, then your email password. Do this from a clean device, not the browser you usually use on the stolen machine if you had passwords saved there. Start with Apple ID, then the email address that acts as the recovery key to everything else. While you are in there, review signed-in devices and sign out any session you do not recognise, and check whether your Apple ID has a recovery contact or key that needs attention.
5. Secure your money and your SIM. Freeze or reissue cards that were in Apple Pay; your bank can do this in minutes and Apple Pay cards are tokenised, but a fresh set costs you nothing and closes the question. Contact the bank about any banking apps on the phone. Then deal with the eSIM or SIM: suspended with the carrier already, but also re-key any account that used SMS codes to that number, because SIM-level access is the quiet path into email and banking that outlives the phone itself.

The phishing wave is coming

Expect a message in the coming days, and it will feel like a miracle. A text or email saying your iPhone has been found: at an airport, in a taxi, by an honest passerby, sometimes with a plausible location near where the theft happened. A link to “confirm ownership details”, or a polite request to share your Apple ID login so they can “verify the device is yours”.

It is the thief, or the fence, and the entire con is the password you would type into that link. With your Apple ID credentials they unlock the phone, disable Activation Lock, and convert their brick back into stock. The tell is structural: a genuine finder cannot do anything with your locked phone and has no need for your password; the only person who needs it is the person holding the phone.

So: never click the link, never reply, never enter credentials anywhere except apple.com typed in yourself. Report the messages to your carrier’s spam reporting and to the police, appending them to your existing report. A complete walkthrough of these fake Apple messages is in the Activation Lock phishing guide.

What Activation Lock actually does

Worth understanding properly, because it is doing more work for you right now than Find My ever did. Activation Lock pairs the device’s hardware with your Apple ID. When the phone is wiped, restored, or reactivated, setup stops and demands the credentials of the account that was signed in. No password, no phone. Repair shops know this instantly, which is why locked phones circulate as parts rather than products.

Layered on top since iOS 17.3 is Stolen Device Protection. It was built precisely for the theft you just experienced: a thief who watched your passcode. With it enabled, changing your Apple ID password, viewing stored payment cards, or disabling Lost Mode requires Face ID or Touch ID rather than just the passcode, and doing these things away from locations you frequent triggers an additional Security Delay of about an hour. That hour is the window in which you get the theft alert and change everything from a safe device. If it was on before your theft, the thief’s options were already narrow. If it was off, it is now the first setting on your next phone, and the stolen phone recovery guide has the full hardening checklist.

Realistic recovery odds

Honesty, because the honest version still contains real actions. Phones taken by professional thieves are usually not recovered one by one. They enter distribution within hours, often across borders, and police recover them in batches during raids on resale or repair operations. When that happens, matching happens through IMEI records and police reports, which is the reason your report and your IMEI documentation matter even when the trail feels cold.

So calibrate: your plan for the money is insurance or a card-chargeback route, not recovery. Your plan for the data is the locks and password changes you already did, which succeed regardless of where the phone is. Your plan for the phone is a modest, real chance that surfaces weeks later through a seizure or an honest repair shop, and it only pays off for people who reported properly. Keep the device marked unavailable in your account: a recovered locked phone is a recoverable phone.

Your next phone: three settings

When the replacement arrives, twenty minutes of setup closes the doors this theft walked through.

• Turn on Stolen Device Protection. It is the direct answer to the watched-passcode theft, gating Apple ID changes behind biometrics and adding the Security Delay away from home.
• Keep Find My on, with Find My network and Send Last Location enabled. Find My was off, and that decision is what cost you the map. Offline finding keeps recent iPhones reporting even powered off, for up to about a day, which is often the difference between a dot and nothing.
• Harden the passcode and kill SMS dependence. Use a longer alphanumeric passcode, disable message previews on the lock screen so codes arriving by SMS are not readable from the lock screen, and move critical accounts off SMS codes to an authenticator app. A six-digit code typed on a crowded tram is the beginning of this entire story.

The bottom line

Find My off does not mean defenceless. Activation Lock still holds, the IMEI block and the police report cut the phone’s value and keep the case alive, and the password and bank work protects everything that actually matters. Treat the incoming “found your iPhone” messages as what they are, phishing aimed at your Apple ID, and set the next phone up so this combination of toggle and passcode never costs you a device again.