My Samsung Android phone was stolen 4 days ago while on vacation in Rome. I also have a Samsung Android tablet with me and I am trying to use it to help remote wipe the Samsung phone. Both are fully up todate. When I first used 'find my phone' on the tablet, it said the phone was in California, which was its location two days prior to the theft. However, I had spent the whole day in Rome using the phones GPS with Google maps so obviously there was plenty of GPS traffic and network traffic. I also had an international cellular data plan on the phone so I could make voice calls and use data while traveling. The next day, 'find my phone' told me that the phone was located at the Vatican which is where we were on the morning of the theft. Then later that day, 'find my phone' told me the phone was located at the Rome termini train station, which is where the theft actually occurred. So my first question is, is it normal for Google's 'find my phone' to be so out of date in terms of location?
The next issue is, I used the Google account security page to tell me about recent activity. The recent activity screen indicated that my phone, my tablet, and a Linux device had recently been active on the account. I have no Linux devices at my disposal. However, the timestamps on the activity strongly correlated to the times that I was trying to do various wipe device actions from the tablet. I think also at that time, I was doing certain things in the Samsung browser on the tablet using some Samsung tools to try to locate and wipe the phone. Obviously Linux devices are heavily used when it comes to hacking, so it concerns me to see Linux showing up an active device, yet there's such a strong correlation with my activities on the tablet that I don't think it's a coincidence. This security page also told me that there was a password change action from the Linux device, and that too correlated to the time when I changed my Samsung password. I also changed my Google password around that time. Is it somewhat normal to see references to Linux devices that are mischaracterized in this context?
Also, the first thing I did after discovering the phone stolen was to contact my carrier Verizon to cancel the cellular service. In retrospect, that seemed like it might be a bad idea, because by doing so I was potentially breaking the communication channel to the phone, rendering the attempts to lock and wipe the device useless. Only if the thief were to try to connect the phone to a Wi-Fi network would a remote wipe attempt have any chance of succeeding. So, would best practice be to leave the cellular connectivity in place until the wipe was reported as being successful?
My apologies if this is a less than clear question. I'm stuck traveling around Europe with only a primitive tablet, trying to deal with the fallout of the phone theft.
