Stolen Device Protection: What It Blocks

Published August 12, 2026 · Last reviewed September 2, 2026

The attack it was built for

The scenario is not hypothetical and does not require any technical skill. Someone watches you unlock your phone in a bar, a train, or a queue — a six-digit passcode is easy to read over a shoulder or capture on video. They then take the phone. Historically, the passcode alone was enough to change the Apple Account password from the device, which let the thief sign you out of Find My, disable your ability to remotely lock or erase, and take over the account holding your photos, messages, and saved payment methods.

Everything else you might have done — a strong password, two-factor authentication, a backup — failed to help, because the passcode on a trusted device was treated as sufficient proof of identity. Stolen Device Protection removes that assumption.

What it actually blocks

With the feature on, these actions require biometric authentication with no passcode fallback:

• Changing your Apple Account password or signing out of the account.
• Turning off Find My or Stolen Device Protection itself.
• Viewing saved passwords in the Passwords app.
• Adding or removing Face ID enrolments, or changing the device passcode.
• Erasing all content and settings.
• Applying for an Apple Card, or using saved payment methods to autofill in Safari.

Away from your familiar locations — typically home and work — the most sensitive of those also trigger a one-hour security delay, after which a second Face ID or Touch ID check is required. The delay is the point: an hour is long enough for you to notice the phone is gone and mark it as lost from another device.

Turning it on

1. Open Settings and tap Face ID & Passcode, then enter your passcode.
2. Scroll down to Stolen Device Protection and tap it.
3. Turn on Stolen Device Protection.
4. Choose when the security delay applies: Away from Familiar Locations, or Always if you want the stricter behaviour everywhere.
5. Confirm the screen shows the feature as on before you leave Settings.

Note the requirements: the account needs two-factor authentication, the device needs a passcode and Face ID or Touch ID set up, and Find My and Significant Locations need to be on for the familiar-locations logic to work.

What it does not do

Being precise about limits matters more than enthusiasm.

• It does not stop a thief unlocking the phone with a stolen passcode and using the apps on it, including reading your messages and email. It protects the account, not the session.
• It does not protect banking apps, which have their own authentication and should have it enabled.
• The security delay does not apply at your familiar locations if you chose the default setting — which means a phone stolen at home, or from a workplace, has less protection.
• It does not replace marking a device as lost. It buys you the time to do that.

Trim what your lock screen gives away

The same evening is a good moment to reduce what is reachable without unlocking. In Settings › Face ID & Passcode, scroll to Allow Access When Locked and consider turning off Control Center (which lets someone enable Airplane Mode to cut the phone off from Find My), Notification Center, and Reply with Message.

Also decide how much notification content appears on a locked screen: Settings › Notifications › Show Previews set to When Unlocked means a two-factor code or a private message is not readable from a locked phone lying on a table.

How it works

The design works by separating two kinds of proof. A passcode is something you know, and it can be observed. Face ID and Touch ID are something you are, and they cannot be shoulder-surfed. iOS normally lets the passcode substitute for biometrics, because that is what makes the phone usable when a face is masked or a finger is wet. Stolen Device Protection removes that substitution for a specific list of high-consequence actions — the ones that would let someone take permanent control.

The one-hour delay adds a time factor on top of the biometric one. Even in a scenario where the thief somehow satisfies the first biometric check, the sensitive change cannot complete until an hour has passed and a second check succeeds. Since the owner usually discovers the loss within that window, the delay converts an irreversible takeover into a race the owner can win by marking the device as lost.

Familiar locations come from the same on-device location history iOS already maintains for things like predicting your commute. The logic is a risk trade: at places you habitually are, the probability that the person holding the phone is the owner is high, so the friction is relaxed. That is a deliberate usability compromise, and it is exactly why the Always option exists for people who would rather accept the friction everywhere.

Worked example

A phone is taken from a table in a pub at 21:40. The thief watched the owner type the passcode ten minutes earlier, so the device unlocks immediately.

Without Stolen Device Protection, the sequence takes about ninety seconds: open Settings, change the Apple Account password using the passcode, sign the owner out of Find My, and the phone becomes unfindable and unerasable while the account — photos, messages, backups — changes hands.

With the feature on and set to Away from Familiar Locations, the pub is not a familiar location, so the attempt to change the password requires Face ID. The thief's face does not match, and there is no passcode fallback. Even a successful first check would start a one-hour delay before a second check. At 21:55 the owner borrows a friend's phone, signs in to iCloud, and marks the device as lost. The phone locks, displays a contact message, and suspends its payment cards. The owner has lost a phone; they have not lost the account, the photo library, or control of their password resets.