Stolen Device Protection: What It Doesn't Protect
Stolen Device Protection stops a thief who knows your passcode from taking over your Apple Account. It does not stop them opening Photos, Messages or Mail. Apple's list of protected actions does not include those apps.
Try Cryptile free: join the beta on TestFlight
What do I need to know?
- It protects the account, not the contents. Your passcode still unlocks the phone and its everyday apps.
- It only works away from familiar places, unless you choose Always.
- It must be on before the theft. Apple says so plainly.
What does Stolen Device Protection cover?
All of this is from Apple's About Stolen Device Protection page. It needs iOS 17.3 or later.
Away from familiar places, these need Face ID or Touch ID, with no passcode fallback:
- Using passwords or passkeys saved in Keychain
- Using payment methods saved in Safari
- Turning off Lost Mode
- Opening a locked app
- Erasing all content and settings
- Setting up a new device or an eSIM
These also need a one-hour wait and a second Face ID check:
- Changing your Apple Account password or signing out
- Changing your passcode, or adding or removing Face ID
- Turning off Stolen Device Protection
What doesn't it protect?
- Photos, Messages, Mail and Notes. They are not on Apple's list. Your passcode opens them as usual.
- The Hidden album. It is not on the list either. Our page on whether someone with your passcode can see your photos explains why.
- Apple Pay. Apple says "You can still use your iPhone passcode for purchases with Apple Pay."
- Anything at home or work. In familiar locations "you can use your iPhone passcode like usual".
- A phone snatched while unlocked. Whatever is open on screen is open to the thief.
How do I close some of the gaps?
Apple gives these steps for iOS 17.3 and later:
- Go to Settings → Face ID & Passcode and enter your passcode.
- Tap Stolen Device Protection and turn it on.
- Under Require Security Delay, choose Always if you want the checks at home too.
Then lock the apps that matter. Apple lists "Open a locked app" among the actions that need Face ID away from home. Touch and hold an app and tap Require Face ID. See Apple's guide to locking an app.
Apple notes this needs two-factor authentication, a passcode, Face ID or Touch ID, Significant Locations and Find My.
What should I do if my iPhone is stolen?
Mark it as lost at iCloud.com/find straight away. Apple says Stolen Device Protection's delay is there "so that you can mark your device as lost". Our page on what happens to your photos when your iPhone is stolen has the full list.
What this doesn't protect against
Even with every setting on, a thief who has your passcode can browse your camera roll. A locked app still opens with your passcode at familiar locations, unless you chose Always. A vault cannot help if the thief also saw your vault pattern.
Do it with Cryptile
Cryptile adds what Stolen Device Protection leaves out: a separate key for your private photos. Each vault opens with a pattern, not your passcode, and files are encrypted with AES-256-GCM. With Plus, a panic pattern destroys this device's vault keys; you restore later with your 9-word recovery phrase.
Cryptile is free for up to 2 vaults, 100 photos and 10 videos, with files, notes and folders unlimited and encrypted iCloud backup included. Plus adds search inside the vault and the panic pattern for $19.99 a year (7-day free trial) or $39.99 once.