Use iOS 17.3’s Stolen Device Protection to Reduce Harm from iPhone Passcode Thefts

ByEmily Dolloff

Last year, a series of articles by Wall Street Journal reporters Joanna Stern and Nicole Nguyen highlighted a troubling form of crime targeting iPhone users. A thief would discover the victim’s iPhone passcode, swipe the iPhone, and run. With just the passcode, the thief could quickly change the victim’s Apple ID password, lock them out of their iCloud account, and use apps and data on the iPhone to steal money, buy things, and wreak digital havoc.

In essence, Apple allowed the passcode, which could be determined by shoulder surfing, surreptitious filming, or social engineering, to be too powerful, and criminals took advantage of the vulnerability. It’s best to use Face ID or Touch ID, especially in public, but some people continue to rely solely on the passcode.

Apple has now addressed the problem for iPhone users with the new Stolen Device Protection feature in iOS 17.3. It protects critical security and financial actions by requiring biometric authentication—Face ID or Touch ID—when you’re not in a familiar location like home or work. The most critical actions also trigger an hour-long security delay before a second biometric authentication. We recommend everyone who uses Face ID and Touch ID turn on Stolen Device Protection. The feature is not available for the iPad or Mac, but neither is as likely to be used in places like the crowded bars where many iPhones have been snatched.

How Stolen Device Protection Works

The location aspect of Stolen Device Protection is key. When you’re in a “significant location,” a place your iPhone has determined you frequent, you can do everything related to security and financial details just as you have been able to in the past, including using the passcode as an alternative or fallback.

However, when you’re in an unfamiliar location, as you would likely be if you were out in public where someone might steal your iPhone, Stolen Device Protection requires biometric authentication to:

  • Use passwords or passkeys saved in Keychain
  • Use payment methods saved in Safari (autofill)
  • Turn off Lost Mode
  • Erase all content and settings
  • Apply for a new Apple Card
  • View an Apple Card virtual card number
  • Take certain Apple Cash and Savings actions in Wallet (for example, Apple Cash or Savings transfers)
  • Use your iPhone to set up a new device (for example, Quick Start)

Some actions have even more serious consequences, so for them, Stolen Device Protection requires biometric authentication, an hour security delay—shown with a countdown timer—and then a second biometric authentication. The delay reduces the chances of an attacker forcing you to authenticate with the threat of violence. You’ll need to go through the double authentication plus delay when you want to:

  • Change your Apple ID password (Apple notes this may prevent the location of your devices from appearing on iCloud.com for a while)
  • Sign out of your Apple ID
  • Update Apple ID account security settings (such as adding or removing a trusted device, Recovery Key, or Recovery Contact)
  • Add or remove Face ID or Touch ID
  • Change your iPhone passcode
  • Reset All Settings
  • Turn off Find My
  • Turn off Stolen Device Protection

There are a few caveats to keep in mind:

  • The iPhone passcode still works for purchases made with Apple Pay, so a thief could steal your passcode and iPhone and buy things.
  • Although Apple says it’s required, you can turn off Significant Locations to require the extra biometric authentication and security delay everywhere. That would eliminate the worry about a thief using Significant Locations to go to your most recent familiar spot in an attempt to sidestep the extra authentication.
  • If you plan to sell, give away, or trade in your iPhone, make sure to turn off Stolen Device Protection first. Once it’s out of your physical control, no one else will be able to reset it.

Turn On Stolen Device Protection

Before you get started, note that Apple says you must be using two-factor authentication for your Apple ID (everyone should be anyway), have a passcode set up for your iPhone (ditto), turn on Face ID or Touch ID, enable Find My, and turn on Significant Locations (Settings > Privacy & Security > Location Services > System Services > Significant Locations), although this last one doesn’t actually seem to be required.

Then, go to Settings > Face ID/Touch ID & Passcode, enter your passcode, and tap Turn On Protection. (If it’s enabled, tap Turn Off Protection to remove its additional safeguards.)

Once Stolen Device Protection is on and you’re in an unfamiliar location, the actions listed above will require either biometric authentication or two biometric authentications separated by the hour-long security delay.

There is one group of people who should not turn on Stolen Device Protection: those for whom Face ID or Touch ID don’t work. Most people have no trouble with Apple’s biometric technologies, but some people have worn off their fingerprints or have other physical features that confuse Touch ID or, less commonly, Face ID.

If that’s you, stick with our general recommendation for discouraging possible iPhone thefts: Never enter your iPhone passcode in public where it could be observed.

(Featured image by iStock.com/AntonioGuillem)

Social Media: In iOS 17.3, Apple has introduced Stolen Device Protection to discourage iPhone thefts enabled by a revealed passcode. It requires additional biometric authentication, and we recommend that everyone who uses Face ID or Touch ID enable it.

Similar Posts

  • Keep Your Passwords!

    You have a password for the online banking, one for your Apple ID, one to log into your retirement amount. Your password for your bank has to have have at least one numeric number, but can’t start with a number and it can’t have any more than two of the same characters found in your username. Your retirement account must include at least 3 numbers and one special character but they can’t be consecutive.

    Does this sound familiar? In the perfect world we would only need one password, but unfortunately for security purposes and as hackers get better at what they do password strength has become critical and part of our everyday lives. The hassle with this is that most sites have their own sets of rules for password strength leaving many of us to peck away at our keyboards or devices in a sometimes endless game of “remember how you manipulated your favorite password 16 different ways and can’t remember if your banking site used the password with the capitalization or the one with the ampersand”.

    p{text-align: center;}. !http://blog.smalldog.com/images/4644.jpg!

    For a very long time I will admit my method of keeping track of my usernames and passwords was the stickies program on my Mac, much to the dismay of our IT manager! While stickies are easily accessed they are not secure and I do not recommend this method. Where you should keep them is in your keychain. You can access your keychain through applications and then utilities. Once you are in your keychain you can manually add preferred sites, accounts and passwords you wish to store. Another huge benefit is secure notes. Secure notes allow you store additional confidential information. Keychain is safe and secure because in order to view any of the passwords stored there you need to enter your administrator password. Within keychain you can make sure to safely and securely keep your passwords, and when you forget if you needed that capitalization or ampersand in your password you can simply open keychain and enter into the search field the website for which you need to confirm the password.

    Now what if you don’t have a mac? The loss of passwords, and most often your Apple ID password is a huge concern with users of iOS devices only. Luckily there is an easy solution for that, iCloud and “iCloud keychain.”:https://support.apple.com/en-us/HT204085 Simply go to settings, iCloud and then select keychain. Your iOS device will begin to store your logins and websites. Additionally you can add specific websites and passwords manually to your phone or iPad under **safari** and then selecting **passwords**. This is also where you would look if you can’t remember login information.

    Recording safely your logins and passwords is an often overlooked step, especially when users of iOS devices accidentally have the device damaged or lost. Saving your passwords safely and using iCloud keychain can avert your being logged out of accounts.

  • Keyboard Shortcuts

    I got my start in using computers with CPM operating system and keyboard shortcuts were present there. I used them all the time so they come as second nature to me. But as I go out and talk with customers and help them with their Macs, I am surprised by the number of people that do not know that most of the things you can do with your mouse by clicking on a menu item can be done faster with keyboard shortcuts.

    The first thing to learn about shortcuts are the symbols that are used to show these keys.

    Command ⌘
    Shift ⇧
    Option ⌥
    Control ⌃
    Caps Lock ⇪
    Fn

    These work for your Mac Keyboard but if you are using a keyboard made for a Windows machine you need to substitute the Windows logo for the Command key and the Alt key for the option key. When you look at a menu in almost any application you will find the common commands for all these symbols next to them to indicate the keyboard shortcut. Here are some common ones:

    Command-X **Cut** Remove the selected item
    Command-C **Copy** the selected item
    Command-V **Paste** the contents
    Command-Z **Undo** the previous command
    Command-A **Select all** items
    Command-F **Find** open a Find window
    Command-G **Find Again** Find the next occurrence of the item previously found
    Command-H **Hide** the windows of the front app.
    Command-M **Minimize** the front window to the dock
    Command-M **New** Open a new document or window
    Command-P **Print** the current document

    Command-Space bar **Spotlight** show or hide the spotlight search field
    Command-Tab **Switch apps** switch to the next most recently used app
    Command-shift-3 **Screenshot** take a screenshot of the entire screen

    As you can see, there are endless keyboard shortcuts to use, and these are only a small fraction of what you can do with “**keyboard shortcuts.**”:https://support.apple.com/en-us/HT201236 So the next time you find yourself wondering what you can do if your mouse suddenly stops working or if your just looking for a more efficient way to do something, keyboard shortcuts might just be what your looking for!