What happens if a mobile payment device is lost?

A lost mobile payment device should be treated as an operational incident. Stop using the missing device, notify the responsible manager, use previously configured device-management controls, contact the payment provider through a verified channel, and review relevant account activity before placing a replacement into service.

The exact response depends on whether the missing item is a phone, tablet, card reader, or standalone terminal; whether it is company-owned or personally owned; and which payment and device-management services are involved. A reader may store different information from the phone or tablet running the payment app, so do not assume that every lost component creates the same exposure.

Start with a calm, documented response

Confirm what is missing. Identify the device type, asset number, assigned user, business location, last known use, and whether any connected phone, tablet, reader, or accessory is also missing.
Stop access where supported. Use the organization's approved management console or payment dashboard to lock the managed device, revoke its session, or remove its access according to the provider's instructions.
Contact the payment provider. Use a bookmarked dashboard or a support number from official documentation. Ask what account, reader-registration, or replacement steps apply to that specific deployment.
Preserve a factual record. Note when the loss was discovered, who was notified, actions taken, and relevant support case numbers. Do not copy passwords, full account numbers, cardholder data, or recovery keys into the incident note.
Review before restoring service. Check authorized dashboard activity and device assignments, then enroll a replacement through the normal controlled setup process.

Use device controls that were prepared ahead of time

Company-managed Apple devices

Apple documents Managed Lost Mode for supervised iPhone and iPad devices. An administrator can lock the device, display a recovery message, request its location, and play a sound. Apple also documents remote erase, but the responsible administrator should choose that action under the organization's existing policy rather than improvising during the incident.

Company-managed Android devices

Google documents Lost Mode for supported company-owned Android deployments. It can lock the device, block apps, display contact details, and report location after the alert period. Google distinguishes Lost Mode from wiping and notes that support varies with ownership, Android version, and management mode.

Payment account access

Review the payment provider's documented account-security tools. Where the provider supports session review, individual staff access, device codes, or remote removal, use the official dashboard and instructions. Do not assume that every payment application exposes the same controls.

Separate readers and terminals

Determine whether the missing hardware stores account information, pending transactions, or neither. Square states that some readers do not store personal or account information, while its app or servers hold other data. Different hardware and providers can behave differently, so verify the exact model.

These controls work best when the device was enrolled and assigned before it disappeared. See how mobile payment devices should be managed for an inventory, permissions, update, and retirement framework.

Check for pending and unusual payment activity

Review the provider dashboard for recent logins, device status, user changes, and transactions that fall within the period when the device was unaccounted for. Focus on facts that the platform actually exposes. Do not label activity fraudulent solely because it is unfamiliar; confirm it against receipts, staff records, and provider guidance.

Ask staff whether the device had accepted offline payments that had not yet uploaded. This matters because some systems keep pending offline transactions on the local device. Square specifically warns that factory-resetting, deleting its POS app, signing out, switching modes, or switching locations while offline payments are pending can cause those payments to be lost. Follow the selected provider's instructions before remotely erasing or resetting a device when pending activity may exist.

If account access may have been exposed, change or revoke the affected credentials through the provider's official workflow, require fresh sign-in where supported, and review staff permissions. The related guide on removing a former employee's access explains the same principle of promptly removing access that is no longer needed.

Decide between recovery, lock, and erase

Remote lock or Lost Mode can preserve the possibility of recovery while restricting normal use. Remote erase is a stronger step with different consequences: it may remove business data, affect personal data depending on ownership and management mode, make the device harder to locate, or eliminate pending local activity. The available options are controlled by the operating system, enrollment state, management product, and provider configuration.

NIST's enterprise mobile-device guidance describes remote wipe as one layer within a broader protection strategy, not a control that should stand alone. Use screen locks, least-privilege access, managed applications, current software, encryption where supported, and an inventory so the response does not depend entirely on reaching an offline device.

Never attempt to locate or recover stolen equipment in a way that puts an employee at risk. Follow the organization's safety and incident procedures, and involve appropriate authorities when management determines that is necessary.

Restore payment service without creating a second problem

Confirm that the missing device has been locked, removed, or otherwise addressed according to the documented response decision.
Register the replacement as a distinct asset and assign it to the correct account, business location, and authorized user.
Install the payment application only from an approved source and apply supported operating-system and app updates.
Use individual employee access or provider-supported staff credentials instead of sharing an owner login.
Verify receipt identity, network access, device assignment, and dashboard visibility before normal customer use.
Reconcile recent transactions and any provider-confirmed pending activity before closing the incident.

Keep the replacement record consistent with the process described in the payment-terminal inventory guide. For more mobile acceptance topics, visit the mobile payments and contactless FAQ hub.

Prepare before another device goes missing

Assign an owner for the response process and keep a short checklist where managers can reach it without the missing device. Record each device's model, serial number, provider assignment, management status, and responsible person. Test who can activate Lost Mode, revoke a session, contact support, and approve a replacement. Keep recovery codes and administrative credentials in an approved secure system, never in a general incident worksheet.

Train staff to report loss immediately without attempting unsupported resets or sharing credentials with an unverified caller. A brief rehearsal can expose gaps such as an outdated support contact, an unenrolled device, a shared administrator login, or an inventory record that does not match the dashboard.

Map the response to your payment setup

List the phones, tablets, readers, terminals, payment apps, staff roles, and management tools involved. Then confirm loss-response and replacement steps with each selected provider before another device enters service.

Discuss mobile payment requirements

Share only business contact details and a high-level description of the workflow. Do not submit cardholder data, passwords, bank credentials, complete account numbers, security codes, device recovery keys, or secret API keys through a general form.

To learn more about how TSYS can help improve the way your organization accepts payments, markets to new customers, or manages its HR responsibilities, get in touch by calling 585-981-8463 to get started.