Abstract: A server can disable lost or stolen devices using an SMS lost-mode command relayed via a relay mobile device. The SMS command is encrypted to prevent malicious attacks. The SMS command includes a universal device identifier unique to the target device, the phone number of the relaying device, and a time stamp memorializing command creation. The relaying device relays the encrypted lost-mode command to the target device. Successful decryption authenticates the server. Before executing the lost-mode command, however, the target device reviews the unique identifier to verify the target and compares the phone number of the relaying device with the number identified with the incoming SMS message to authenticate the relaying device. The target device also considers an embedded time stamp to determine whether the lost-device command is superseded by a subsequently issued though later received command from the server.