The laptop is gone and the thing that actually matters is not the hardware. It is the email account still signed in on it, the browser full of saved passwords, the banking session, the work files. Whoever has the machine has a head start on all of it, and the next hour is the only part of this you fully control.
This guide covers what to do immediately, what the remote location and wipe tools can genuinely do, how to find your serial number when the laptop with the serial number on it is the one that was stolen, and honestly what your odds of getting it back are. It also covers the preparation that would have changed all of this, because most people read a page like this having done none of it.
What’s Inside
- 1 – The First Hour After Your Laptop Is Stolen
- 2 – Reporting the Theft and Why the Report Number Matters
- 3 – Remote Location and Lock Tools, and Their Real Limits
- 4 – Remote Wipe and the Trade-Off It Forces
- 5 – Finding Your Serial Number After the Laptop Is Gone
- 6 – What Actually Helps Recovery, and What Does Not
- 7 – Prevention That Works, Set Up Before Anything Happens
- 8 – Final Thoughts on Responding to a Laptop Theft
The First Hour After Your Laptop Is Stolen
Work through this in order. The sequence matters, because securing your email first is what makes every later step effective — an attacker with your inbox can reset the password on everything else.
- Change your email password from another device. Not your bank, not social media — email. Password resets for every other account arrive there, so it is the master key.
- Sign out of every active session on that account. Changing the password does not always end sessions already running on the stolen machine. Doing this explicitly does.
- Try to locate and lock the device using Find my device or Find My, before deciding anything about wiping it.
- Contact your bank and card issuers if card details were saved in the browser, in a password manager on the machine, or in any app that stays signed in.
- Report the theft to the police and get an incident or report number. Without it, most insurance claims cannot proceed at all.
- Change passwords on the remaining important accounts — password manager, cloud storage, work systems, anything holding payment details.
- Tell your employer immediately if it was a work machine or had work data on it. Most organizations have a disclosure obligation with a deadline attached.
Do not go and get it yourself. If a tracking tool shows a location, that location is approximate, it may be a neighboring property, and the people there may not be the people who took it. Give the address to the police and let them act on it. Confronting someone over a laptop is how a property crime becomes an assault.
Signing out of sessions remotely
Every major account provider keeps a list of devices with active sessions and lets you revoke them. Google’s is under Security and sign-in, where Manage all devices shows everywhere you are currently signed in and lets you sign out of a chosen device. Microsoft and Apple accounts have equivalents.
Do this for every service that keeps you logged in — mail, cloud storage, messaging, social accounts, and anything with a payment method attached. Google specifically advises that if you see unrecognized devices or suspicious activity, you should secure the account fully rather than simply signing the device out.
If the browser on that laptop was signed in and syncing, treat every password saved in it as compromised. A browser password store is protected by the operating system account, and an operating system account is not a serious obstacle — which is precisely why encryption rather than a login password is what protects data, a distinction our guide to getting into a laptop without the password makes concrete.
Reporting the Theft and Why the Report Number Matters
Report it even though you expect nothing to come of it. The report number is what unlocks everything administrative that follows, and you cannot get one retroactively without difficulty.
Have ready: the make and model, the serial number, roughly what it is worth, where and when it was taken, and any tracking information you already have. A report with a serial number is materially more useful than one without, because that is the field a recovered device gets checked against.
The report number is then needed for your home or contents insurance claim, for an employer’s incident process, and if any account fraud follows. If personal data belonging to other people was on the machine — client records, patient data, anything covered by data protection rules — the reporting obligations are separate and usually have a short deadline.
If financial or identity fraud does follow, the US Federal Trade Commission runs a structured recovery process at IdentityTheft.gov, which generates a personalized recovery plan and the affidavit companies ask for.
Remote Location and Lock Tools, and Their Real Limits
Both Windows and macOS include device-finding, both are off by default on most machines unless someone turned them on, and both have the same fundamental constraint.
Windows: Find my device
Microsoft’s Find my device requires several things to have been true before the theft. You must have been signed in with a personal Microsoft account as an administrator, with location services enabled, and the device must be powered on and connected to the internet.
If those conditions hold, sign in at account.microsoft.com/devices and you can see the last known location and remotely lock the machine. Locking makes it inaccessible to whoever is using it, and Microsoft recommends resetting your password afterwards as well.
Check one thing before you try. Microsoft states that any time you attempt to locate the device, anyone using it sees a notification. Locating is not silent, and a thief who sees that notification may switch the machine off.
A local Windows account — one not tied to a Microsoft account — cannot use this feature at all. Neither can a device where an administrator never enabled it.
Apple: Find My and Activation Lock
On a Mac, Find My covers playing a sound, marking the device as lost and erasing it remotely. Apple states the location appears on icloud.com/find if the device is powered on and has a network connection, with a limited fallback where you might still find a Mac if it is near a previously used Wi-Fi network.
The more significant feature is Activation Lock, and it is the strongest anti-theft measure on any consumer laptop. Apple describes it as preventing others from using your Mac if it is lost or stolen, requiring your Apple Account password or device passcode before anyone can turn off Find My, erase the Mac, or reactivate and use it.
It switches on automatically when Find My is enabled, on any Mac with Apple silicon or a T2 chip running macOS Catalina or later with two-factor authentication active. Turning on Find My is therefore the entire setup.
Activation Lock is a genuine deterrent, not a marketing claim. Apple states the lock continues to deter others from reactivating your Mac without your permission even if the device is erased. A locked Apple laptop cannot be set up, cannot be resold as a working machine, and is worth only its parts. Nothing on the Windows side is currently equivalent.
The limitation both platforms share
A laptop that is switched off, has a flat battery, or is not on a network is invisible to both systems. Unlike a phone, a laptop spends most of its life closed and asleep, and unlike modern iPhones and AirTags there is no broad offline mesh network keeping a stolen Windows laptop findable.
In practice this means the useful window is short and may already have closed. Anyone stealing a laptop deliberately will keep it shut. What you usually get is a last known location from before the theft, which is evidence of where it went missing rather than where it is now.
Set the alert anyway. Both systems can notify you when the device next appears online, and a machine that gets opened days later by someone who bought it second-hand has produced exactly the information the police need.
Remote Wipe and the Trade-Off It Forces
Remote erase is available through Find My on a Mac and through mobile device management on managed Windows machines. Consumer Windows Find my device offers locking but not a full remote wipe.
The decision is genuinely a trade, and it is one-way. Apple is explicit that erasing generally ends your ability to find the device — for a Mac you might still be able to find it if it is near a previously used Wi-Fi network, but otherwise you will not be able to find your device after you erase it.
So wiping protects the data and gives up on the hardware. Which way to go depends on one question: is the drive encrypted?
- Encrypted drive, ordinary personal data — you can afford to wait. The data is already unreadable without your key, so leave tracking active and keep the option open.
- Unencrypted drive — wipe it. Recovery odds are low regardless, and an unencrypted drive gives up everything to anyone who removes it and connects it elsewhere.
- Work data, client records, anything regulated — wipe it, and tell your employer. This is not your decision to make alone.
- A Mac with Activation Lock — erasing keeps the lock in place, so the machine stays unusable to a thief either way.
A queued wipe only executes when the device comes online, so issuing the command is not the same as the data being gone. Until then, the drive is exactly as protected as its encryption makes it.
Finding Your Serial Number After the Laptop Is Gone
Every piece of advice about theft says to record the serial number, and almost nobody has. The number is printed on the underside of the machine, which is not helpful now. There are still several places it survives.
- The original box. Serial and model numbers are printed on the packaging label, and a surprising number of people keep the box.
- The receipt or invoice. Many retailers print the serial on the itemized receipt, and business invoices almost always do.
- Retailer order history. Sign in to the account you bought it from and open the order. Serial numbers frequently appear in the order detail or the digital invoice.
- Manufacturer account registration. If you registered the product or claimed a warranty, the record is in your account with the manufacturer.
- Your platform account’s device list. This is the one most people miss.
- Repair records. Any past service visit will have the serial on the job sheet.
For a Mac the device list is the fastest route. Apple’s instructions are to sign in to account.apple.com, click Devices in the sidebar and select your Mac to see its model name and serial number — which works whether or not you still have the machine.
On Windows, a laptop signed in to a Microsoft account appears at account.microsoft.com/devices, and business machines are usually recorded in the organization’s asset register. Failing all of that, the manufacturer’s support team can sometimes trace the serial from a proof of purchase.
Do this now if your laptop has not been stolen. Photograph the label on the underside, save the photo somewhere that is not the laptop, and keep the receipt. It takes two minutes and it is the difference between a police report that can match a recovered machine to you and one that cannot.
What Actually Helps Recovery, and What Does Not
Be realistic about the odds. A report on laptop theft published by the Center for Problem-Oriented Policing cites industry and FBI estimates that between 82 and 97 percent of stolen laptops are never recovered. Those figures are estimates rather than precise measurements, and they point the same way regardless.
Given that, the honest priority order is: protect the accounts, then the data, then the insurance claim, then recovery. Most people get this backwards and spend the critical first hour refreshing a map.
Things that genuinely improve your chances
- Reporting quickly with the serial number, so a recovered machine can be matched to you
- A device-finding service that was already enabled and can report a location if the machine comes online
- Tracking software installed in advance, which the Center for Problem-Oriented Policing report lists among the electronic measures worth combining with physical ones
- Registering the laptop with the manufacturer, so the serial is tied to your name in a database someone might check
- Checking local second-hand listings and giving anything plausible to the police rather than approaching the seller
Pawn shops are a partial ally here. Reputable ones record seller identification and check serials against police lists, which is one reason stolen machines often surface elsewhere — the trade-in and resale market is covered in our look at what pawn shops actually pay for laptops.
Things that do not help
- Waiting to report in the hope the tracker produces something better. It rarely does, and the delay damages the insurance claim.
- Tracing an IP address. Consumer IP geolocation is imprecise, and it is not something an individual can act on lawfully anyway.
- Posting the tracked address publicly. It endangers whoever lives there, who may have nothing to do with it, and it can compromise a prosecution.
- Paying anyone who contacts you offering to return it for a fee. That is a follow-on scam.
- Attempting to access the machine remotely yourself. Use the manufacturer’s tools, and nothing else.
Prevention That Works, Set Up Before Anything Happens
Everything below takes under an hour in total and changes the outcome of a theft completely. The Center for Problem-Oriented Policing report’s central recommendation is layering physical, procedural and electronic measures rather than relying on any single one.
Turn on full-disk encryption
This is the single most valuable thing on the list, because it makes the data question moot. Microsoft describes BitLocker as full-volume encryption protecting against data theft from lost or stolen devices, including when a drive is moved to another machine.
Editions matter. Microsoft lists BitLocker enablement as supported on Windows Pro, Enterprise and Education, and not on Windows Home. Home users get Device Encryption instead, an automatic form of the same technology available on all Windows versions where the hardware meets the requirements — check Settings, Privacy and security, Device encryption to confirm it is actually on.
On a Mac the equivalent is FileVault, which Apple describes as keeping someone from decrypting or accessing your data without your login password. Enable it under System Settings, Privacy and Security, FileVault.
Store the recovery key somewhere other than the laptop. Apple is explicit that if you forget your password, your recovery key and your iCloud credentials, your files are permanently unrecoverable. Encryption that locks you out is not a security win. Save the key to a password manager or print it and keep it with your important documents.
Enable device finding in advance
Neither tool can be switched on after the theft. On Windows, sign in with a Microsoft account, then enable Find my device in Settings — remembering it needs an administrator account and location services. On a Mac, turn on Find My Mac under System Settings, your name, iCloud, which enables Activation Lock at the same time.
For a Mac this is genuinely the highest-value five minutes available, because Activation Lock removes most of the incentive to steal the machine at all.
Record the serial number and keep the receipt
The Center for Problem-Oriented Policing report recommends keeping specific records including receipts, manufacturer, model and serial number for recovery purposes, and registering the laptop with its manufacturer.
Photograph the underside label, save it to cloud storage, and keep the receipt with it. Registering the product also gives the manufacturer a record connecting that serial to you, which occasionally matters when a stolen machine is presented for service.
Physical security and insurance
A cable lock through a Kensington-style slot stops opportunistic grabs in libraries, offices and cafés. The Center for Problem-Oriented Policing report recommends using locking devices routinely while noting they are not fully effective on their own — a cable deters someone walking past, not someone with tools and time. Many thin laptops have no lock slot at all, in which case a locking bracket or docking station is the alternative.
Check your insurance before you need it. Home contents policies often cover laptops only inside the home unless you add personal possessions cover for items taken out; some have single-item limits below the value of a current laptop, and most require a police report number. Read the wording rather than assuming.
Finally, keep backups. A theft with a current backup is an expensive inconvenience; a theft without one loses work that no insurance payout replaces.
Can I track my stolen laptop if it is switched off?
No. Microsoft requires the device to be powered on and connected to the internet, and Apple shows a Mac’s location only when it is powered on and has a network connection. There is a limited Apple fallback if the Mac is near a previously used Wi-Fi network, but there is no broad offline mesh network for laptops as there is for iPhones and AirTags. Set an alert so you are notified when it next appears online.
Should I remotely wipe my laptop or keep trying to track it?
It depends on encryption. Apple states that once you erase a Mac you generally cannot find it afterwards, so wiping ends tracking permanently. If the drive is encrypted with BitLocker or FileVault the data is already unreadable, so you can afford to wait. If it is not encrypted, or it held work or client data, wipe it — recovery odds are low and the data risk is real.
Does a Windows login password protect my files?
Not meaningfully. A login password stops someone using your desktop session; it does not stop someone removing the drive and reading it in another machine. Microsoft’s stated reason for BitLocker is precisely that it protects data including when a drive is transferred to another device. Encryption is what protects files — the password only protects the session.
What can a thief actually do with a stolen MacBook?
Very little, if Find My was enabled. Activation Lock requires your Apple Account password or device passcode before anyone can turn off Find My, erase the Mac or reactivate it, and Apple says it continues to deter reactivation even after an erase. The machine cannot be set up or resold as working, which makes it worth only its parts.
How likely am I to get my laptop back?
Not very. A Center for Problem-Oriented Policing report on laptop theft cites estimates that between 82 and 97 percent of stolen laptops are never recovered. Report it with the serial number anyway, because that is what allows a recovered machine to be matched to you, and because the report number is required for insurance.
Where can I find my serial number now the laptop is gone?
Check the original box, the receipt or invoice, your order history with the retailer, any manufacturer product registration, and any past repair paperwork. For a Mac, sign in at account.apple.com and select Devices in the sidebar to see the model and serial number. Windows laptops signed in to a Microsoft account appear at account.microsoft.com/devices.
Which password should I change first?
Your email password, from a different device, before anything else. Password resets for almost every other account are delivered to your inbox, so an attacker with email access can take everything else regardless of how strong those passwords are. Then sign out of all active sessions on that account, because a password change alone does not always end sessions already running.
Are cable locks worth using?
For opportunistic theft, yes. A cable through a Kensington-style slot stops someone lifting a laptop from a desk in a library, office or café. The Center for Problem-Oriented Policing report recommends using locking devices routinely while noting they are not 100 percent effective, and advocates layering physical, procedural and electronic measures rather than relying on any one. Many thin laptops have no lock slot, in which case a locking bracket is the alternative.
Final Thoughts on Responding to a Laptop Theft
Most of the outcome was decided before the laptop was taken. Whether the drive was encrypted, whether device finding was enabled, whether the serial number exists anywhere other than on the missing machine — those are the variables, and all three are free to set.
If it has already happened, secure the email account first and report it with the serial number, then decide about wiping with your eyes open about the trade. If it has not, spend the hour now.
