What is Stolen Device Protection on iPhone, and should you turn it on?

It adds extra checks when your iPhone is somewhere it does not recognise as a familiar location, such as home or work. There are two layers:

• Face ID or Touch ID with no passcode fallback. For actions like viewing saved passwords or passkeys, or using saved payment methods, a thief who knows your passcode still cannot continue without your face or fingerprint.
• A Security Delay of one hour plus a second biometric check. This applies to the most critical changes, such as changing your Apple Account password, changing the iPhone passcode, or turning off Find My or Stolen Device Protection itself. You authenticate, wait an hour, then authenticate again.

The hour is the point: it gives you time to mark the phone lost and secure your Apple Account from another device. Your iPhone can end the delay early if it detects you have reached a familiar location.

Apple lists these requirements: iOS 17.3 or later, two-factor authentication for your Apple Account, a passcode, Face ID or Touch ID set up, Find My turned on, and Location Services with Significant Locations enabled (that is how the iPhone learns what counts as familiar).

On newer iOS versions, Apple may switch it on for you during setup. Check the setting rather than assuming, because it only helps if it was already on before the phone was stolen.

1. 1Open Settings and tap Face ID & Passcode (Touch ID & Passcode on phones with Touch ID). Enter your passcode.
2. 2Tap Stolen Device Protection and turn it on.
3. 3Under Require Security Delay, the default is Away from Familiar Locations. Choose Always if you want the delay everywhere, including at home. It is stricter and slightly less convenient.

If you cannot see the option, update iOS first. If Find My or Significant Locations is off, turn them on and look again.

If you try one of the protected changes away from a familiar location, you will see a Security Delay message. You cannot skip it with the passcode, which is the whole design. At a familiar location the delay does not apply, so it is usually just a Face ID or Touch ID check.

If you are locked out of a protected action because Face ID is not working, fix that first (for example by resetting Face ID at home), or go to a familiar place and try again.

Turn Stolen Device Protection off before you sell or trade in an iPhone, because it also guards Erase All Content and Settings. If you try to turn it off away from home, the Security Delay applies to that too. See How to erase your iPhone before selling it.

• It does not stop someone using what is already visible on an unlocked phone, or on a Lock Screen with generous settings. See What can someone do with your locked iPhone?.
• It does not find or lock the phone for you. After a theft you still need to use Find My and Lost Mode. See What to do when your iPhone is lost or stolen.
• It does not cover a thief who has your Apple Account password and a trusted device, or who watches you unlock with your face.
• It does not encrypt anything extra inside your apps. Photos and documents in apps are protected only by what that app does.

Lockboxy is an iPhone app that keeps photos, files, notes and passwords in an encrypted vault behind its own passcode, with Face ID as an option. That passcode is separate from your iPhone passcode. If someone learns your iPhone passcode, the vault still asks for a passcode they have not seen, and each wrong attempt makes them wait longer.

The vault also locks again after 1 minute without a touch. This works alongside Stolen Device Protection, not instead of it: Apple's feature protects your accounts and settings, and Lockboxy protects what you keep in the vault.

Lockboxy has no account and no server, so it cannot locate or lock a stolen phone, and it cannot restore a vault you lose. Keep a backup somewhere you control if the contents matter.