Someone Stole Your iPhone and Knows Your Passcode

Hidlet is an iPhone app

Point your iPhone camera at the code to install. No account needed.

or text me the link

It happened on a busy train. Someone stood close, watched your thumb on the passcode screen, and a minute later your iPhone was gone. You know they know your passcode, and you are wondering what that opens.

This article covers what Apple’s Stolen Device Protection changes, the steps Apple lists for a stolen iPhone, and what a vault adds. It describes iOS 17.3 and later.

What a known passcode can reach

Apple doesn’t publish a list of everything a passcode opens. But its Stolen Device Protection page lists the things that, with the feature on and the iPhone away from familiar locations, need more than the passcode. Our reading, not an Apple claim, is that these are things a passcode alone can otherwise do, so a thief who knows it could reach them:

• Use passwords or passkeys saved in Keychain, and payment methods saved in Safari AutoFill.
• Turn off Lost Mode, open a locked app, or erase all content and settings.
• Change your Apple Account password, sign out of it, or change its security settings.
• Add or remove Face ID or Touch ID, or change your passcode.
• Set up a new device with Quick Start, or set up an eSIM.

Without Stolen Device Protection, the Hidden album and locked apps open with the passcode too. With it on, Apple lists opening a locked app as needing Face ID or Touch ID away from familiar places, but doesn’t mention the Hidden album. See How to Hide Photos From Someone Who Knows Your iPhone Passcode.

What Stolen Device Protection changes

Apple says Stolen Device Protection needs iOS 17.3 or later, and must be turned on before the iPhone is lost or stolen. It needs two-factor authentication for your Apple Account, a passcode, Face ID or Touch ID, Significant Locations turned on, and Find My on.

It works by place. In familiar locations, usually home, work and other places you regularly use the iPhone, you use your passcode as usual. Away from them:

• Face ID or Touch ID, no passcode fallback. For the first, second and fifth bullets above, plus things like applying for a new Apple Card or viewing its virtual card number.
• A one-hour Security Delay. For the third and fourth bullets: changing your Apple Account password, signing out of it, changing its security settings, adding or removing Face ID or Touch ID, changing your passcode, resetting all settings, enrolling in Mobile Device Management and turning off Stolen Device Protection. You authenticate with Face ID or Touch ID, wait one hour, and authenticate again.

The delay is meant to give you time to mark the iPhone as lost. Apple says it may end early if the iPhone reaches a familiar location.

To turn it on. Open Settings, tap Face ID & Passcode (or Touch ID & Passcode), enter your passcode, tap Stolen Device Protection, and turn it on. Apple says it might already be on. You can also choose Always under Require Security Delay, so the extra checks apply at home too.

What it doesn’t do. It isn’t a lock on the whole phone. Apple notes that Apple Pay purchases can still use the passcode. It only helps if it was on before the theft, and Apple says its safeguards last only for a period of time, so mark the iPhone as lost quickly anyway.

What to do now

These are the steps on Apple’s “If your iPhone or iPad was stolen” page, in an order we find practical.

1. Mark it as Lost. Act quickly. Sign in at icloud.com/find, select the device under All Devices, and choose Mark as Lost. Leave out contact details, and keep the device in Find My. Apple says not to try to recover it yourself: contact the police if you see it on the map.
2. Report it. Tell the local police, who may ask for the serial number, which you can find without the device. Contact your wireless carrier to suspend the account.
3. Secure your Apple Account. If Find My wasn’t on, change your Apple Account password right away. Then in Settings, tap your name, and review your devices and Sign-In & Security. Remove devices you don’t recognise.
4. Erase only if you can’t recover it. Apple says erasing can’t be undone, and not to remove the device from Find My afterwards, since that removes Activation Lock. If the device is offline, the erase starts when it next connects.

A vault as an extra layer

Everything above is about the iPhone. Photos in your Photos app are reachable by whoever gets past the iPhone’s lock. A vault with a key that isn’t your passcode sits behind a second door.

Hidlet is an encrypted vault app, available on the App Store. Its vault key comes from a pattern you draw, and the pattern isn’t stored. Files are encrypted before they are saved. A wrong pattern, meaning one that opens no vault, adds waiting time after the first three tries, and that count is kept in the Keychain, so restarting or reinstalling the app doesn’t reset it. The app locks the moment you leave it, and screenshots come out blank.

If the iPhone is gone for good, your vault isn’t. Hidlet’s encrypted backup goes to your own iCloud. On a new iPhone, draw your pattern with iCloud Keychain on, or use the 9-word recovery phrase if it is off. Write that phrase down somewhere other than the phone.

What it can’t do. It doesn’t protect photos still in your library, or anything else on the iPhone. It doesn’t replace the steps above, and it can’t help someone who lost both pattern and recovery phrase. A thief might also learn your pattern the way they learned your passcode, so draw it where nobody can see.