What if someone has my device that is logged into into my iCloud account ? I don’t have access to the phone

As long as your phone is locked, your passcode is known only to you, and not easily guessed … your data remains inaccessible by even sophisticated criminals.

See next steps here:

If your iPhone, iPad, or iPod touch is lost or stolen - Apple Support

Well … then that person has nearly unlimited ability to act as YOU for any matters conducted via your iPhone.

Nearly anything that you could do using the iPhone, they can too.

Any financial charges or transfers made using the phone might also be non-refutable (i.e. you can’t dispute them) as most T&Cs also require that you maintain and use the designed-in security controls of the device.

I “stopped just short” of making that very suggestion.

The rub - as I see it - is that “marking as lost” (locking the phone) is “unlock-able” with the same device passcode.

Changing the AppleID password to inhibit access is good but it will “tip off” the possessor of the device AND require the OP to have alternate, accessible, “Trusted Numbers” configured. 🤔

It is kind of a last resort. Hopefully, since this person knows the OP's passcode, then they also likely know who it is and will get it back from them. But the fact they already took it suggests they have no intention of returning the phone.

To Zoeipup,

After you change the password, choose to put the phone into Lost Mode. That will lock out anyone who has possession of the phone. Once you get the phone back (if you do), you will be the only one who can release it.

Do not choose to remotely erase the device. If you do, the person will have essentially a new phone to set up as their own. They won't be able to get back into your account after changing the password, but they'll have a free phone.

Edit: The rub - as I see it - is that “marking as lost” (locking the phone) is “unlock-able” with the same device passcode.

Yeah, there isn't a great way to handle this.

If they haven't already, login to your Apple account from any other device (Mac, Windows, etc. Anything with Internet access) and change the password. Then lock the phone.

https://appleid.apple.com/

Concur … at best it’s a real mess.

Simply ask the person to return your phone.