Stolen Device Protection on iPhone, explained
Away from home, your passcode stops being enough to take over your iPhone.
In short
Stolen Device Protection, available since iOS 17.3, protects you when a thief has both your iPhone and your passcode. Away from familiar locations, sensitive actions such as using saved passwords require Face ID or Touch ID with no passcode fallback, and critical changes like your Apple Account password require a one-hour security delay. Turn it on in Settings › Face ID & Passcode.
Key takeaways
- Away from familiar places, some actions need Face ID or Touch ID — no passcode fallback.
- Critical changes need Face ID or Touch ID, a one-hour wait, then Face ID or Touch ID again.
- It only helps if it is on before the iPhone is stolen.
The problem it solves
Someone watches you type your passcode, then takes the phone. Without extra protection, that passcode alone can be enough to change your Apple Account password, use your saved passwords and erase the iPhone. Stolen Device Protection makes the passcode insufficient for those steps when the iPhone is away from places you usually are.
What needs Face ID or Touch ID
Away from familiar locations, these actions require Face ID or Touch ID, with no passcode alternative:
- Using passwords or passkeys saved in Keychain, and payment methods saved in Safari AutoFill.
- Turning off Lost Mode.
- Opening a locked app.
- Erasing all content and settings.
- Using your iPhone to set up a new device, or setting up or transferring an eSIM.
- Some Apple Card, Apple Cash and Savings actions in Wallet.
Apple Pay purchases can still be made with your passcode.
What needs a security delay
For the most critical changes, iPhone asks for Face ID or Touch ID, waits one hour, then asks again. That hour is designed to give you time to mark the device as lost and secure your Apple Account.
- Changing your Apple Account password or signing out of your Apple Account.
- Changing Apple Account security settings, such as trusted devices, a recovery key or a recovery contact.
- Adding or removing Face ID or Touch ID, and changing your passcode.
- Resetting all settings, enrolling in device management, and turning off Stolen Device Protection itself.
The delay may end early if your iPhone detects that you have reached a familiar location.
Familiar locations
Familiar locations are typically your home, your work and other places where you regularly use your iPhone, learned through Significant Locations in Location Services. If you prefer the extra checks everywhere, go to Settings › Face ID & Passcode › Stolen Device Protection, tap Require Security Delay and choose Always.
Turn it on
You need two-factor authentication on your Apple Account, a passcode, Face ID or Touch ID, Significant Locations and Find My turned on.
- Go to Settings › Face ID & Passcode (Touch ID & Passcode on models with Touch ID).
- Enter your passcode.
- Tap Stolen Device Protection and turn it on. It may already be on.
Before selling or giving away your iPhone, turn it off — ideally at home, since doing it elsewhere starts a security delay.
What it doesn’t protect
It doesn’t stop someone who has your passcode from opening apps that aren’t locked and browsing what is there: Photos, Messages, Mail. Apps you have locked to require Face ID do need Face ID away from familiar locations. Photos kept in a vault with its own secret, such as Latent, stay encrypted whatever a thief knows about your passcode.