iPhone Stolen Device Protection: what it does and when it helps

For years, an iPhone’s passcode was the master key to everything on it. Anyone who learned it, by watching over your shoulder in a bar or on a train, could unlock the phone and then use the same six digits to change your account password, turn off device tracking and read every saved password. Stolen Device Protection, added in iOS 17.3, breaks that chain. The passcode still unlocks the phone, but it’s no longer enough on its own for the changes that would let a thief take over your accounts.

How it works

The feature treats your iPhone differently depending on where it is. At home, at work and in other places you regularly use your phone, nothing changes. Everywhere else, two extra rules apply.

Face or fingerprint, with no passcode fallback. Some actions require your face or fingerprint, and the passcode won’t work in their place. According to the official support page, these include:

• using passwords or passkeys saved on the phone
• using payment cards saved for autofill in the browser
• turning off lost mode
• opening an app you’ve locked
• erasing all content and settings
• setting up a new device from this one, or setting up or moving an eSIM

A one-hour security delay. The most serious changes need your face or fingerprint, then an hour’s wait, then your face or fingerprint again. These include changing your account password, signing out of your account, changing account security settings such as trusted devices and recovery contacts, adding or removing face or fingerprint unlock, changing your passcode, resetting all settings and turning off Stolen Device Protection itself.

The delay gives you time to mark the phone as lost from another device before a thief can lock you out. If the phone arrives at a familiar location, the delay may end early.

Turning it on

Stolen Device Protection might already be on. To check:

1. Open Settings and go to the section for face or fingerprint unlock and passcode.
2. Enter your passcode.
3. Tap Stolen Device Protection and turn it on.

It needs a few things first: a passcode, face or fingerprint unlock set up, two-step verification on your account, device tracking turned on, and Significant Locations turned on in Location Services. You’ll find that in Settings, then Privacy & Security, then Location Services, then System Services. While Stolen Device Protection is on, you can’t turn off device tracking.

If you want the extra checks everywhere, including at home, choose Always under Require Security Delay on the same screen.

What it doesn’t protect

It’s worth being clear about the limits, because the name suggests more than it does.

• The phone itself. A thief who knows your passcode can still unlock the phone and open your messages, email and photos.
• Apps you haven’t locked. Only locked apps need your face or fingerprint. Everything else opens as usual. See locking and hiding apps on iPhone.
• Familiar places. If the phone is taken at home, the extra rules don’t apply unless you chose Always.
• Accounts you sign in to elsewhere. It protects your phone’s main account settings, not your email or social accounts, which may still accept a code sent to the stolen phone.

Habits that work with it

• Use a longer passcode and shield it in public. The feature limits what a thief can do with a known passcode; a passcode they never see is better still.
• Use face or fingerprint unlock in crowded places, so you type your passcode less often.
• Lock your most private apps. With Stolen Device Protection on, a locked app needs your face or fingerprint away from home, with no passcode fallback.
• Know how to mark your phone as lost from another device, so you can use the hour if it ever happens. See what to do if your phone is stolen after someone saw your PIN.

A separate lock for private photos

The gap that remains is ordinary apps, including your photo gallery, which open for anyone with the passcode. Silo, coming soon to iPhone and Android, keeps imported photos and videos in an encrypted vault with its own PIN, separate from the phone’s passcode. Choose a different one, and a thief who watched you unlock your phone still can’t open the vault.