Your Mac was stolen. The order to do things in
· 5 min read
A stolen Mac is two problems: the hardware, which is probably gone, and your accounts, which are recoverable if you move quickly. Almost everyone spends the first hour on the first problem and should spend it on the second.
Do these first, in this order
1. Mark it as lost in Find My. From another device or icloud.com. This locks the Mac remotely, displays a message with a contact number, and prevents anyone using it. It also keeps Activation Lock in force, so the machine cannot be set up by anyone else.
Do this before anything else. It is the one action that both protects your data and makes the hardware worthless to a thief.
2. Change your Apple Account password. From a device you still have. This severs any session on the stolen machine and stops anyone reaching iCloud with a saved login.
3. Change your email password, because it is the reset route for everything else.
4. Change banking and work passwords, particularly anything the browser had saved.
5. Sign out remotely where services allow it. Most have a “sign out of all devices” option.
6. Report it to the police and get a crime reference number. Insurers require it, and it matters if the machine is later recovered.
7. Tell your employer, immediately, if it was a work machine or held work data. This is not optional and delay makes it worse.
8. Contact your insurer.
What FileVault means here
If FileVault was on, the drive is encrypted and the contents are not readable without your password. That is the difference between a stolen laptop and a data breach, and it is the whole argument for having it on. FileVault covers what it does.
If it was off, assume everything on the drive is readable, and prioritise changing every password that was stored on it.
If you are not sure whether it was on, assume it was off and act accordingly.
What Find My can and cannot do
Can: lock the machine, display a message, erase it remotely, show a location if it connects to a network, keep Activation Lock in force.
Cannot: track it in real time reliably, work if it never connects to a network, or help once it has been erased in a way that clears the lock.
A Mac that is powered off or offline shows its last known location, which may be hours old. Do not treat that as where it is now. Find My on a Mac covers the limits.
Do not go and get it yourself
Worth saying plainly.
Location data is approximate. It has repeatedly led people to the wrong address, and confronting a stranger over a laptop has gone badly often enough that police forces advise against it.
Give the location to the police. That is the entire correct use of it.
Erase it remotely, or not yet?
A judgement call.
Erasing protects your data absolutely and usually ends any chance of tracking it, since an erased machine stops reporting. With FileVault on, the data is already protected, so erasing adds little.
Marking as lost without erasing keeps Activation Lock, keeps the message displayed, and keeps the possibility of a location update.
The reasonable order for most people: mark as lost, wait a few days, then erase if it has not been recovered. If the machine held genuinely sensitive material and FileVault was off, erase immediately.
Note that Activation Lock persists through a remote erase, so the machine remains unusable to a thief either way.
Afterwards
Do not remove it from your account. Removing the device clears Activation Lock and makes it usable and saleable. Leave it listed.
Watch for phishing. People who steal devices send convincing messages claiming the device has been found, to get your Apple Account credentials and clear the lock. Never sign in from a link in such a message. Phishing that targets Mac users covers the pattern.
Restore from backup onto a replacement. Restoring a Mac from a backup covers what to expect.
Preventing the next one
The setup that makes a theft an inconvenience rather than a crisis: FileVault on, Find My on, screen lock immediately on sleep, a current backup, and the serial number recorded somewhere that is not the Mac.
Setting up a Mac you will travel with covers the whole arrangement.
Questions
I did not have Find My on. Then remote locking is unavailable. Change every password immediately, and report the theft with the serial number.
Where do I find the serial number now? In your Apple Account device list at account.apple.com, on the original box, or on the purchase receipt.
Will the police recover it? Rarely, honestly. The report matters for insurance and for the record.
Can a thief use it if it is Activation Locked? Not as a Mac. It can be stripped for parts, which is why serial numbers matter.