In brief. The real danger of an iPhone theft is no longer the hardware: it's the passcode. A thief who has watched you type it on the subway can, with the phone in hand, change your Apple account password, turn off Find My, read your saved passwords and empty a bank account before you've even found a computer. Stolen Device Protection, introduced by Apple with iOS 17.3 in January 2024 and now present in every recent version of iOS, breaks that chain: away from your familiar locations, sensitive operations require Face ID or Touch ID — with no fallback to the passcode — and some impose a one-hour wait. Here's how to turn it on, what it actually covers, and the six settings to get ready tonight.
Settings verified on 12 October 2026 in Apple's support documentation (the "Stolen Device Protection", "If your iPhone is lost or stolen" and "Lost Mode" pages), as well as on the CNIL pages devoted to device theft. This article provides general information and is no substitute for filing a police report or seeking legal advice.
Introduction: the passcode is worth more than the phone
For fifteen years, stealing an iPhone meant stealing an object. Activation Lock, which arrived with iOS 7, reduced a stolen device to a paperweight: impossible to reset and resell without the owner's credentials. So thieves changed targets. They no longer steal a phone, they steal access.
The method is disarmingly mundane. You watch someone enter their six-digit passcode in a queue, a bar, a train carriage. You walk up, take the phone, and leave. With the passcode in your pocket, you don't resell the device: you open Settings → [your name], change the Apple account password, turn off Find My, look through the passwords saved in the keychain, and help yourself. Several press investigations — notably those by the Wall Street Journal in 2023, which forced Apple's response — have documented financial losses running into four and five figures.
The passcode has become the keystone of your digital life: messages, photos, emails, passwords, bank cards, scanned identity documents. Apple eventually conceded that a six-digit secret, visible from three metres away, could not carry that much weight. Hence Stolen Device Protection.
Part 1 — What Stolen Device Protection actually does
The principle: biometrics with no back door
In normal use, Face ID and the passcode are interchangeable: if recognition fails, the iPhone offers the passcode. That's convenient, and it's precisely the weakness.
When Stolen Device Protection is active and the iPhone is away from your familiar locations (home, work — the device draws on your Significant Locations history), that fallback disappears for a list of sensitive actions. Face ID not recognised? No action. The passcode is no longer a master key.
Actions protected by Face ID alone
According to Apple's documentation, this strict biometric requirement applies in particular to:
- using saved passwords and passkeys;
- using payment methods saved in Safari;
- turning off Lost Mode;
- erasing all content and settings;
- requesting a new eSIM;
- setting up the iPhone as a trusted device for a new device;
- accessing documents in certain Apple apps, depending on the iOS version.
Actions subject to the one-hour delay
For the most destructive operations, Face ID isn't enough: you need Face ID, then a one-hour wait, then Face ID again. The idea is simple and devastatingly effective: give the owner time to react from another device.
| Action | Protection applied |
|---|---|
| Changing the Apple account password | Face ID + one-hour delay |
| Changing Apple account security settings | Face ID + one-hour delay |
| Changing the iPhone passcode or adding a face to Face ID | Face ID + one-hour delay |
| Turning off Find My | Face ID + one-hour delay |
| Turning off Stolen Device Protection itself | Face ID + one-hour delay |
| Using saved passwords | Face ID only |
| Erasing the iPhone | Face ID only |
In other words: even with your passcode, a thief can no longer lock you out of your account or stop you from locating the device. During that hour, you have time to sign in to iCloud from another device and trigger Lost Mode.
Worth remembering: the one-hour delay does not apply when the iPhone is in a familiar location. That's a convenience trade-off Apple has knowingly made — and a good reason not to register just any café as your home.
Part 2 — Turning it on in two minutes
The feature isn't always enabled by default, depending on how the device was updated. Check it; it's free and comes with no strings attached.
Prerequisites
- An iPhone compatible with iOS 17.3 or later (iPhone XS, XR and newer models).
- A passcode set.
- Face ID or Touch ID configured.
- Two-factor authentication active on the Apple account.
- Find My enabled.
- Significant Locations enabled (Settings → Privacy & Security → Location Services → System Services → Significant Locations).
The exact path
- Open Settings.
- Tap Face ID & Passcode (or Touch ID & Passcode).
- Enter your passcode.
- Scroll down to Stolen Device Protection.
- Tap it and choose Always rather than Away from Familiar Locations.
The "Always" setting applies the restrictions even at home. It's slightly more demanding day to day — and considerably more protective if the theft happens in your home or your building.
The passcode: four digits are over
Stolen Device Protection doesn't excuse you from having a good passcode. Switch to an alphanumeric one: Settings → Face ID & Passcode → Change Passcode → Passcode Options → Custom Alphanumeric Code. A short eight-character phrase is unreadable from a distance and impossible to reconstruct from fingerprint smudges on the screen. If you often type your passcode in public, an iPhone privacy screen filter dramatically reduces the side viewing angle — an unremarkable accessory that solves half the problem upstream.
Part 3 — The five settings that round out your defences
1. Hide notifications on the Lock Screen
A locked iPhone that displays a bank verification code received by SMS in plain text cancels out part of your security. Settings → Notifications → Show Previews → When Unlocked. Messages still appear; their content doesn't.
2. Cut off Control Center and Siri access from the Lock Screen
In Settings → Face ID & Passcode, under "Allow Access When Locked", turn off Control Center (otherwise a thief enables Airplane Mode in two gestures and kills location tracking), Siri, Reply with Message and Return Missed Calls.
3. Lock sensitive apps one by one
Since iOS 18, each app can be locked with Face ID or hidden in an encrypted folder: long-press the icon → Require Face ID. Apply it to your banking app, your third-party password manager, and the messaging app you use for private conversations.
4. Turn on iCloud Advanced Data Protection
Settings → [your name] → iCloud → Advanced Data Protection. Your backups, photos and notes move to end-to-end encryption: even Apple can no longer access them. Be warned, the trade-off is real — if you lose your recovery keys, nobody will recover your data. Write your recovery key down by hand and store it away from the phone, for instance in a small fireproof home safe alongside your identity papers.
5. Set up a recovery contact and a second way in
A locked Apple account with no second device is hard to recover. Add a recovery contact (Settings → [your name] → Sign-In & Security → Account Recovery). And keep a device at home that can sign you in to iCloud: a tablet, even an old one. For one-time codes, a FIDO2-compatible physical security key is the next level up: since iOS 16.3, Apple has accepted hardware keys as a second factor for the Apple account.
Part 4 — The first thirty minutes after the theft
Everything is decided fast. The order matters.
- From another device, open iCloud and turn on Lost Mode for the iPhone in question (Find My → Devices → your iPhone → Mark As Lost). The device locks, displays a message and a contact number, and Apple Pay is suspended.
- Note the last known location. Don't go there alone: that's information for the police, not an invitation.
- Call your bank to block the cards registered in Apple Pay, even if Lost Mode has suspended them.
- Have your line blocked by your carrier and request a new SIM or eSIM: your number acts as a reset key for dozens of services.
- Change your Apple account password from the other device, then the password for your main email account.
- File a police report and keep the receipt: your insurer and, where applicable, your bank will ask for it. Have the device's IMEI number to hand — ideally one you noted down in advance.
- Don't erase the iPhone straight away. As long as it hasn't been erased, it remains traceable. Schedule the erase as a last resort, once all hope is gone.
Prepare the before rather than endure the after
Two habits change everything. First, record the IMEI, serial number and purchase date and keep them somewhere other than the phone: a paper notebook stored with your documents is enough, and a hardcover notebook survives better than a sticky note. Second, back up for real: a daily iCloud backup verified in Settings → [your name] → iCloud → iCloud Backup, and for large photo libraries, a local copy on a portable external SSD. A theft then becomes a hardware and administrative problem, not an amputation of your memory.
Part 5 — What Stolen Device Protection does not do
Let's be precise, because the confusion is widespread.
- It doesn't prevent theft, nor access to the contents of an iPhone unlocked with the passcode: your photos, messages and emails remain readable by whoever holds the passcode. It protects your account, not all of your content.
- It doesn't protect you in familiar locations if you've chosen "Away from Familiar Locations". A theft at the office or in the stairwell therefore slips right through. Choose "Always".
- It doesn't replace a strong passcode. Six observable digits are still six observable digits.
- It doesn't make you unreachable or anonymous. If your goal is to contact someone without exposing your number, that's a different matter: see our guide on how to send an SMS without giving your number, useful for example to report a device you've found without handing over your personal line. The full list of the service's features sets out what the recipient does — and doesn't — see.
- It doesn't secure your conversations. For that, your message privacy settings and read receipts deserve a separate review: we covered it in our article on what the recipient of an SMS sees about you.
FAQ
Does Stolen Device Protection slow down everyday use? Barely at all. It only kicks in for a short list of administrative actions you rarely perform. Changing your Apple password while on holiday will mean an hour of patience: that's the only tangible drawback.
What happens if Face ID stops working — a cracked screen, for example? You'll have to carry out the operation from a familiar location, or recover your account via another trusted device and your recovery contact. That's precisely why that contact needs to be set up before anything happens.
My iPhone doesn't show the option in Settings. Check the six prerequisites: iOS 17.3 or later, a passcode, Face ID or Touch ID, two-factor authentication, Find My and Significant Locations. Just one missing item is enough for the entry to disappear.
Can a thief resell the device anyway? Not as a working iPhone: Activation Lock stays in place as long as the device is tied to your account. It ends up as spare parts, which explains why the market has shifted towards stealing data rather than hardware.
Should you turn off Find My to protect your privacy? No. The trade-off is overwhelmingly in your favour: Find My location data is end-to-end encrypted and the feature is the only thing that enables a fast response. On the other hand, do clear out your location sharing with contacts (Find My → People), which people forget about for years.
Conclusion: an hour's head start is all it takes
Stolen Device Protection isn't a technical revolution. It's a common-sense concession: an acknowledgement that a short passcode, typed twenty times a day in public, cannot be the single key to an entire life. By requiring biometrics and a one-hour wait, Apple hands you back the advantage of time — the only one that really counts when facing a theft.
Two minutes of settings today, a recovery contact, an alphanumeric passcode, and the prospect of an iPhone snatched from your hand becomes what it should be: an expensive annoyance, not a disaster. To go further on everyday discretion, the service home page and our FAQ answer the most common questions about sending messages without exposing your number.
