The iPhone setting for when a thief already knows your passcode
Stolen Device Protection stops somebody who watched you type your passcode from taking over your Apple Account. It is off unless you turned it on. What it blocks, what it does not, and the one setting worth changing.
Here is the theft that Apple built this feature for, and it is worth describing properly because it is not the theft most people picture.
Somebody stands behind you in a bar, or on the MAX, or in a queue, and watches you unlock your phone. They are not watching the phone. They are watching your thumb. Then the phone leaves your pocket, and by the time you have finished patting yourself down they have already changed your Apple Account password from a table three blocks away. Your other devices sign out. Find My stops being yours. The photos, the saved passwords, the card in Safari — all of it moves across with the phone, and the phone is now the least valuable thing you lost.
That is the whole attack. Passcode first, phone second. And a passcode is six digits typed in public several dozen times a day.
Stolen Device Protection is Apple's answer to it. It has been in every iPhone since iOS 17.3, which is to say for well over two years, and in this house I have found that roughly nobody has it switched on.
What it actually does
The idea is simple: when your iPhone is somewhere it does not recognise, the passcode stops being enough on its own.
Two things happen. Some actions start demanding Face ID or Touch ID with no passcode fallback — the thief has your thumb's movements, not your face. And a smaller set of very sensitive actions get put behind a one-hour Security Delay: Face ID now, wait an hour, Face ID again. That hour is not a punishment. It is the window in which you notice the phone is gone and lock it down from another device.
The face-or-fingerprint list, away from familiar places:
- Passwords and passkeys saved in Keychain
- Payment methods saved in Safari for AutoFill
- Opening a locked app
- Turning off Lost Mode
- Erase All Content and Settings
- Viewing your Apple Card or Apple Cash card number, and certain Wallet and Savings actions
- Applying for a new Apple Card
- Using the iPhone to set up a new device
- Setting up or transferring an eSIM
The hour-long delay list:
- Changing your Apple Account password
- Signing out of your Apple Account
- Updating Apple Account security settings
- Adding or removing a Face ID or Touch ID
- Changing the device passcode
- Reset All Settings
- Enrolling the device in Mobile Device Management
- Turning off Stolen Device Protection itself
That last one matters more than it looks. Without it, the feature would be a door with the key taped to it.
The part people find maddening
Your iPhone decides on its own where is familiar. You cannot type in your address, you cannot add a location, and there is no list to look at.
It works off Significant Locations — the same quiet feature that lets Maps guess where you are driving. It learns from how often you are somewhere, how long you stay, and at what times. Home and work usually settle in within a few days. Everywhere else stays foreign forever, which is exactly what you want.
Where this goes wrong is a phone that has never had the chance to learn. A new device, a house you moved into last month, or Significant Locations switched off at some point by somebody being conscientious about privacy. Then you are sat in your own living room being told to wait an hour, with nothing to point at.
If that is happening: Settings → Privacy & Security → Location Services → System Services → Significant Locations, and confirm it is on. Then give it some days. There is no way to hurry it and no setting that fixes it faster, which is frustrating but is also, honestly, the feature working correctly — a location you can add by hand is a location a thief can add by hand.
Turning it on
You need two-factor authentication on your Apple Account, a passcode, Face ID or Touch ID set up, Find My on, and Significant Locations on. Most people already have all five.
Then: Settings → Face ID & Passcode → enter your passcode → Stolen Device Protection.
While you are in there you will see Require Security Delay, with a choice between Away from Familiar Locations and Always. Away from familiar locations is the default and is the right answer for most people.
Always is a real option and I use it, but go in knowing the trade: it removes the passcode as a fallback everywhere, including at home. If Face ID stops working — a cracked front glass, a bandaged finger, a repair — you are an hour away from your own account settings in your own kitchen, and there is no override. That is a fine price if you know you are paying it and a nasty surprise if you do not.
What it does not do
It does not stop the phone being stolen, and it does not get it back. It does nothing about the passcode being watched in the first place — which is still worth solving separately, by turning your shoulder, or letting Face ID unlock the thing instead of typing at all.
What it buys you is the hour. The difference between a stolen phone and a stolen life is almost entirely whether the thief could reach your Apple Account before you could, and this is the setting that decides that race.
If it happens anyway
From any other device, or any browser, go to iCloud.com, find the phone in Find My, and put it in Lost Mode. Do that first — before ringing the carrier, before anything. Then change your Apple Account password from that same other device. Then tell your carrier, and then the police, because you will want a report number for the insurance.
If your phone is gone right now and you are reading this instead of doing that, stop reading.
If you want a hand
This is a five-minute job and you do not need me for it. But if you would rather somebody sat with you while you went through the settings on your own phone — yours and your parents' and your partner's in one visit — that is exactly the kind of appointment I like, and it is the sort of thing that is much easier done together than read about.
Call (503) 567-5975 or email support@ironwood.help. If a phone has already gone missing and accounts are in play, say URGENT and it moves up the list.