Apple introduced a hidden flaw when they made it possible to use your iPhone or iPad to reset the password for your Apple Account. There was a perfectly good reason to make this linkage: if you could access the password-changing part of the interface, that meant you possessed your device, could unlock it via your face, fingerprint, or passcode, and had the passcode for further changes.
If Apple hadn’t let people reset their Apple Account password with their device, they would have potentially hundreds of thousands of support calls a year dealing with this issue. Instead, resetting is a relatively trivial matter—easy to find instructions online and easy to help someone with if it requires an Apple Support call or text.
However, through subterfuge or violence, it’s possible to obtain both an iPhone and its passcode, at which point someone could hijack your Apple Account and leverage access to your phone and that account to take over your life.
Stolen Device Protection takes the fangs out of this viper. It has a number of tradeoffs, but it may be worthwhile for additional peace of mind for some people. Here’s what to consider:
- It is not enabled by default. You have to choose whether or not it’s useful to your circumstances, and then opt in.
- It’s available only on iPhone, with Apple ostensibly reasoning it’s the most at-risk device for theft coupled with passcode acquisition.
- While enabled, your iPhone passcode cannot be used for a host of actions related to passwords, payments, tracking, and erasure. You must use Face ID or Touch ID.
- Apple imposes a new one-hour delay between when you want to make certain kinds of Apple Account, biometric, passcode, or tracking changes and when you are allowed to make them.
Starting in iOS 18, if you turn off or restart your iPhone, the timer restarts, counting down again from a full hour. That new hour is counted from when your device finishes its restart cycle or from the next time you power it up.
That sounds a bit annoying, no? Well, here’s the kicker: when enabled, the biometric requirement for some features and one-hour delay for others apply by default only when you are in an “unfamiliar” location. That’s right: Apple uses secure device-based stored information—to which they don’t have access—to determine whether you’re at a place you regularly linger at, like home, work, or a neighborhood pub. If you aren’t, the extra protections are enabled automatically.
Many news outlets reported that Apple enabled Stolen Device Protection by default in iOS 26.4 in early 2026. However, I never saw any confirmation from Apple, or follow-up from the news outlets. Further, I installed iOS 27 on an erased phone and Stolen Device Protection was off when the iPhone first started up.
That means when you’re at a familiar location, you won’t notice at all that Stolen Device Protection is on. If you return while using your device from an unknown to known location, the restrictions drop, too. You can opt to disable this “familiar location” feature, too, if you want the same level of deterrence everywhere.
Should you enable it?
Even though not everyone needs the feature enabled, I’d argue that if you go out into the world, it’s possible you’d be shoulder surfed and robbed, so if you have any interest in staying safe, you should probably turn it on and deal with the inconvenience.
To enable Stolen Device Protection on your iPhone, you first have to ensure all the following conditions are met:
- Two-factor authentication for your Apple Account: Nearly all Apple Accounts have this enabled already. If yours isn’t, Apple’s support site explains how to switch it on.
- A device passcode enabled plus Face ID or Touch ID: It’s highly unlikely you have no passcode. See how to set up Touch ID and Face ID.
- Find My enabled: I recommend this for everyone, and it’s specifically required for this feature. Go to Settings > Account Name > Find My.
- Significant Locations & Routes enabled: Enable via Settings > Privacy & Security > Location Services > System Services > Significant Locations & Routes. (Significant Locations & Routes are derived from your iPhone, stored locally and securely, and never sent to Apple or anyone else.)
To enable Stolen Device Protection, go to Settings > Face ID & Passcode > Stolen Device Protection. Enable the feature. You can optionally switch from Away from Familiar Locations to Always to ignore Significant Locations & Routes and always have restrictions.
Once it’s enabled, there’s a laundry list of things you cannot do when away from a familiar location (or always, if chosen).
You must use Face ID or Touch ID for the following: to retrieve passwords or passkeys, use Safari’s AutoFill stored payment methods (like credit cards), disable Find My’s Lost Mode (see below), erase the device (Settings > General > Transfer or Reset iPhone > Erase All Content and Settings), remove hardware security keys, add trusted phone numbers for two-factor authentication codes (see how to prepare for losing access to your Apple Account), apply for an Apple Card or view its virtual card number, transfer money via the Wallet (like transferring money out of your Apple Savings account), or use Quick Start or other migration tools to set up a new device.
The one-hour security delay
Across the entire history of Touch ID and then Face ID, Stolen Device Protection is the first time Apple has deferred to a biometric authentication method and disabled your passcode. In all similar cases, biometrics are either unavailable and you must use a passcode, or your iPhone, iPad, or Mac allows you to decline biometrics and enter a passcode.
The security delay of an hour works like this when you’re somewhere your iPhone thinks is unfamiliar, or you’ve disabled it:
- Attempt to make any of the following changes: with Apple Account, change your password, sign out on the device, or update security settings; or try to remove or change Face ID or Touch ID, change your iPhone’s passcode, reset settings (Settings > General > Transfer or Reset iPhone > Reset), disable Find My or, of course, disable Stolen Device Protection.
- Your device prompts you to authenticate with Face ID or Touch ID.
- You’re prompted to wait for an hour. Tap Start Security Delay, and a counter starts. You can also return to a familiar location within that period.
- When the hour is up, you receive a notification. Tap it or return to the feature in question and use Face ID or Touch ID to complete the authentication.
If Touch ID or Face ID works erratically for you, as it does for some people, you could wind up being unable to perform a number of tasks until you’re back at a familiar location.
You can disable Stolen Device Protection at any time by returning to its settings for your version of iOS. As noted above, if you’re not at a frequently visited location, it will require an hour delay to disable it. (But why would you disable it when at an unfamiliar spot?)
If you’re away from a frequently visited location and your Touch ID or Face ID stops working, you can be completely stuck until you have a way to access an iCloud backup from another device or return to a familiar spot. Apple doesn’t describe any way to override the biometric lockout except by being somewhere “familiar.”
