A phone number is the only way an account is identified, and nothing else is collected about you. That has a blunt consequence: whoever controls the number controls the account. Act in this order.
1. Contact your carrier first
Ask them to block the old SIM and issue a replacement carrying the same number. This is the most important step, because recovering the number is what makes recovering the account possible.
2. Terminate the stolen device's session
- On any device where you are still signed in, open Settings, Devices, shown on some versions as Privacy and Security, Active Sessions.
- Terminate the session belonging to the stolen phone. Whoever holds it cannot sign back in without your password.
- If you are not signed in anywhere, wait for the replacement SIM, sign in with your number, then do the same.
3. Turn on two-step verification
Under Settings, Privacy and Security. With it enabled, the phone number alone is not enough to sign in.
How much risk is there, realistically
Ordinary thieves usually discard the SIM immediately, because it makes the phone harder to trace, then wipe the device and sell it. In routine theft the data is rarely the target. If you have specific reason to worry and cannot terminate the session, wipe the device remotely through Apple's or Google's find-my-device service. That only works if it was set up beforehand.
Other options
- Switching to a new number? Open Settings, tap your phone number and change it, rather than starting a fresh account.
- Want the account gone entirely? You can delete it if you are signed in on at least one other device, mobile or desktop.
- No access to anything? An inactive account self-destructs on its own, after 18 months by default.
Updated