Question Stolen phone - find/wipe issues

[Steerpike58]

My phone was stolen while on vacation in Rome. Samsung S23, fully updated. I tried to use Google's 'find my phone' (from an Android tablet I have with me) to locate and wipe the phone. Google said phone last seen in California - where I was 2 days prior. I'd been using the phone all day in Rome with Google maps (had international voice and data plan on phone) so this made no sense to me. I issued a wipe command but no confirmation it succeeded. Next day after the theft, 'find my phone' (FMP) said the phone was at the Vatican - our location hours before the theft. Later that day, FMP said the location was the Rome termini station - near the site of the theft. But last seen time was around 9am, not 7pm when the theft occurred. Days later it finally indicated last seen as 7pm, Rome termini. How could this be so slow to update?

I also tried Samsung's tools to lock and wipe the phone. This was totally confusing, but I ended up at some point on a 'smartthings' page that offered to do the wipe ... With inconclusive results. At different times during this effort it seemed like Samsung was cooperating with Google and relying on Google's find my phone feature but at other times, it seemed like Samsung was trying to do everything itself. I really had no idea what the relationship between Samsung and Google was in terms of remote location and remote wipe of a Samsung Android phone. Does anyone have a good understanding of how Samsung and Google independently deal with this device location and wipe situation? I have to confess, despite having owned five or six Samsung phones over the past 10 years, I've never done anything other than the absolute minimum with my Samsung account so I was a little out of my depth trying to deal with the Samsung locate/wipe capability

Google also has a 'recent activity' screen. For the phone in question, at different times, it showed activity from an s23 device, from an Android device, and even from a Linux device. I have no Linux devices. It even showed a change password event from a Linux device, and the timestamp seemed to correlate to the time I changed the Samsung password. Is it typical to see devices mischaracterized like this?

Finally, I called Verizon shortly after the theft and had them disable service on the phone. In retrospect, was this a good idea? If you disable the data service on the phone, won't that make it harder to reach the phone in terms of issuing the remote wipe command?

If this is not the best area to discuss this issue would anyone have any suggestions as to the best forum or thread for such discussions? I've searched quite a bit and there seem to be very few people who have actually experienced a theft, and tried to actually use Google's tools to locate and wipe the phone. Thanks!

 

[AdrianBaw]

Sorry about your phone! The location delay happens if the phone is off or lacks data, which can explain the slow updates. Google’s Find My Device and Samsung’s tools overlap, but don’t always work well together. Google is simpler, but both should work independently. The “Linux” device log is likely a miscategorization by Google. Disabling Verizon service stopped charges, but it also blocked data, making it harder to wipe the phone. Ideally, wipe it first. For more advice, check out XDA Developers or Reddit’s r/Android for help from people with similar experiences. Good luck!

 

[Steerpike58]

I did confirm that the "Linux" entry in the log was due to Samsung browser on the tablet identifying itself as Linux when in desktop mode. I'm still testing this but there's a strong correlation.

The phone was on and in continuous contact with the network up until the time of the theft, and I suspect it was never in contact after that - I suspect the thieves either turn off the device immediately, or, stick it in a faraday bag so it can't be seen. Since I don't have the phone with me right now, I can't say for sure, but I don't remember if you can in fact turn off the device without the PIN.