iOS Internals · Locks & Encryption · Lesson 4 of 5

Stolen Device Protection

Stop a thief who knows your passcode from taking over your phone and account.

When the thief knows your passcode

Everything so far assumes the thief doesn't know your passcode. But some thieves watch people type it in a busy bar or on a train, then grab the phone. With the passcode, they could once change your Apple Account password, turn off Find My and lock you out of your own photos and accounts within minutes.

Stolen Device Protection, added in iOS 17.3, is Apple's answer. It adds extra checks when your iPhone is away from familiar locations, places like home and work where you usually use your phone. The iPhone learns these from Significant Locations, an option inside Location Services.

Away from familiar places, there are two levels of protection:

• Face ID or Touch ID, no passcode fallback. For things like using passwords or passkeys saved in your Keychain, using payment cards saved in Safari, turning off Lost Mode and erasing the iPhone.
• A Security Delay. For bigger changes, such as your Apple Account password, signing out of your Apple Account, changing your passcode, adding or removing Face ID or Touch ID, and turning off Stolen Device Protection. You confirm with Face ID or Touch ID, wait one hour, then confirm again.

That hour is the point. It gives you time to borrow a phone and mark yours as lost in Find My. A thief with only your passcode can't speed it up. Find My can't be turned off at all while the feature is on, so a thief would first have to turn off Stolen Device Protection itself, which means waiting through the delay.

At familiar locations your passcode works as usual, and Apple Pay still accepts it everywhere.

On the simulated phone, turn Stolen Device Protection on and set the location to Away. Try all three actions with only the passcode. Then switch to Home and try again.

More locks for a locked phone

Turning on Stolen Device Protection takes a minute. Go to Settings, Face ID & Passcode (or Touch ID & Passcode), enter your passcode and tap Stolen Device Protection. It needs two-factor authentication on your Apple Account, a passcode, Face ID or Touch ID, Find My and Significant Locations. You can also set Require Security Delay to Always, so the delay applies even at home. Apple suggests turning it off before you sell or give away the iPhone.

Two quieter protections help when a stolen phone stays locked.

The first is the inactivity reboot. Security researchers found that iOS 18.1 added a timer, run by the Secure Enclave, that restarts an iPhone if it hasn't been unlocked for about three days (they measured 72 hours). You learned what a restart does in module 2. Every class key except class D leaves memory, and the phone drops back to BFU. A thief or a data extraction tool that was waiting for a weakness in the AFU state loses it.

The second is about the charging port. Cables carry data, so an iPhone is careful about accessories. By default it has to be unlocked before it will talk to a new USB accessory or a computer. Charging from a wall adapter still works while locked. On recent iOS versions you'll find the choice in Settings, Privacy & Security, Wired Accessories. iPhones with USB-C can be set stricter, such as Always Ask. Older versions kept a similar switch under Face ID & Passcode, called Accessories, in the Allow Access When Locked list. Apple's guides for IT teams call this protection USB Restricted Mode.

Together these make a locked iPhone a hard target. A stolen phone that stays locked can't easily be plugged into a tool, and after a few days it restarts into its most protected state.