Could a powered-on device be remotely wiped?¶

Yes. A connected device may receive a command that wipes data, removes a managed profile, locks access or deletes account content, although the likelihood depends on the device, management service and connections.

Remote action has several possible sources¶

Consumer accounts, employer-management tools, security software and administrative platforms may support remote wipe or lock. A queued command might execute immediately, later or when the device next reconnects.

Record visible networks, account-management indicators, warnings and remote-administration signs before changing connectivity. A lock or password reset can have an evidential effect similar to deletion if it makes content inaccessible.

Removing one route may not isolate the device. Wi-Fi, mobile data, Ethernet, Bluetooth and tethering can coexist, and settings such as flight mode do not behave identically across systems.

Isolation must remain proportionate¶

Isolation can reduce remote risk but may terminate sessions, interrupt synchronisation, stop security monitoring or lose live connection evidence. Device-specific advice is particularly important for unlocked, encrypted or organisationally managed equipment.

Where the threat is credible and action cannot wait, preserve the visible state, use the least intrusive effective method and record the time, operator and result. Do not describe remote wipe as certain merely because it was technically possible.