What to do if someone knows your iPhone passcode

iPhoneUpdated

If someone knows your iPhone passcode, they can unlock your phone, and Apple built Stolen Device Protection for exactly this situation. Change your passcode, turn on Stolen Device Protection, reset Face ID if needed and check your Apple Account. If the phone has been stolen, use Find My to mark it as lost straight away.

Quick answer

Change your passcode in Settings > Face ID & Passcode, then tap Expire Previous Passcode Now so the old one stops working. Turn on Stolen Device Protection (iOS 17.3 or later), reset Face ID if someone may have added their face, and check the devices signed in to your Apple Account. If the iPhone is stolen, mark it as lost in Find My.

What can someone do if they know your iPhone passcode?

They can unlock the phone and use it as you. Apple built Stolen Device Protection specifically to help prevent someone who has stolen your iPhone and knows your passcode from making critical changes to your account or device. The actions it protects are a good guide to what's at stake.

With Stolen Device Protection on, Apple says these actions need Face ID or Touch ID, with no passcode alternative or fallback, when you're away from familiar places:

  1. Using saved passwords and passkeys in the Keychain.
  2. Using payment methods saved in Safari AutoFill.
  3. Turning off Lost Mode.
  4. Erasing all content and settings.
  5. Using your iPhone to set up a new device, or setting up or transferring an eSIM.

Apple notes that the passcode still works for Apple Pay purchases.

How do you turn on Stolen Device Protection?

It needs iOS 17.3 or later, and Apple says it must be turned on before the phone is lost or stolen. You also need two-factor authentication on your Apple Account, a passcode, Face ID or Touch ID, Find My, and Significant Locations turned on in Location Services.

  1. Go to Settings > Face ID & Passcode (Touch ID & Passcode on models with Touch ID).
  2. Enter your passcode.
  3. Tap Stolen Device Protection and turn it on.
  4. Optional: under Require Security Delay, choose Always so the protection applies at home and work too.

Away from familiar places, changing your Apple Account password, your passcode or Face ID, or turning off Stolen Device Protection itself needs Face ID or Touch ID, a one-hour wait, then Face ID or Touch ID again.

How do you change your iPhone passcode?

On iOS 17 or later, Apple says your previous passcode can still be used once in the 72 hours after a change, to get in and reset the passcode. If someone else knows the old one, close that window straight away.

  1. Go to Settings > Face ID & Passcode and enter your current passcode.
  2. Tap Change Passcode and enter a new six-digit passcode. Tap Passcode Options for a custom numeric or alphanumeric code instead.
  3. Back in Face ID & Passcode, tap Expire Previous Passcode Now.
  4. Optional: turn on Erase Data, which erases the iPhone after 10 failed passcode attempts.

If Stolen Device Protection is on and you're away from a familiar location, the security delay applies to changing the passcode.

Could they have added their face or fingerprint?

It's worth checking. Apple says that if you think someone added an alternative Face ID appearance to your device without your permission, you can reset Face ID and set it up again. Apple's Personal Safety guide also lists managing Touch ID fingerprints as part of limiting who can get into your device.

  1. Go to Settings > Face ID & Passcode.
  2. Tap Reset Face ID.
  3. Set up Face ID again with only your own face.
  4. On Touch ID models, review the fingerprints listed in Settings > Touch ID & Passcode.

How do you secure your Apple Account?

Someone with your phone in their hands may have reached your Apple Account. Change the password, then check where you're signed in. On iPhone with iOS 16 or later, Safety Check walks you through reviewing devices, sharing and your account password in one place.

  1. Change your password: Settings > your name > Sign-In & Security > Change Password.
  2. Check your devices: Settings > your name, then scroll to the device list. Tap any device you don't recognise and choose Remove from Account.
  3. Run Safety Check: Settings > Privacy & Security > Safety Check. Choose Manage Sharing & Access to go through people, apps and devices one by one.

Apple says a waiting period of one hour may apply to changing your Apple Account password if Stolen Device Protection's security delay is in effect.

Someone stole my iPhone and knows the passcode. What now?

Act from another device. Mark the iPhone as lost in Find My, which locks it with your passcode and suspends Apple Pay cards and passes. Then report it and secure your account. Apple says not to remove the iPhone from Find My, because that removes Activation Lock.

  1. On another Apple device, open Find My, go to Devices, select your iPhone, then turn on Lost Mode under Lost [Device]. Or sign in at icloud.com/find.
  2. Add a phone number and message if you like, then tap Activate.
  3. Report the theft to your local police. They may ask for the serial number.
  4. Contact your mobile network to report it and have your account suspended.
  5. Change your Apple Account password from a trusted device.
  6. Erase the iPhone remotely only once you've given up on getting it back. Apple says it can't be undone.

With Stolen Device Protection on, turning off Lost Mode needs Face ID or Touch ID, so the passcode alone won't do it.

Where Failshot fits

Failshot photographs whoever unlocks your iPhone while Failshot is on, and the camera light shows whenever it takes a photo. Apple doesn't let any app see the Lock Screen or use the camera in the background, so you turn Failshot on and lock the phone, and whoever unlocks it lands in Failshot and is photographed. It doesn't photograph a wrong passcode at the iPhone Lock Screen.

That's useful when someone knows your passcode, because switching Failshot off never uses it. It needs Face ID or your own Failshot PIN plus your answer, so someone with your passcode can't switch it off, and a wrong Failshot PIN takes another photo. Photos stay on your phone, with optional email alerts. If the phone is lost or stolen, the optional web vault lets you see encrypted photos at failshot.app/vault. Failshot is for your own device only, and it's coming soon to iPhone.

Questions people also ask

Can someone change my Apple Account password with my passcode?

It depends on Stolen Device Protection. With it on, Apple says changing your Apple Account password away from familiar locations needs Face ID or Touch ID, a one-hour security delay, then Face ID or Touch ID again. Turn it on in Settings > Face ID & Passcode.

Can Apple lock a stolen iPhone?

You lock it yourself with Find My. Turning on Lost Mode, from the Find My app on another device or at icloud.com/find, locks the iPhone with your passcode and suspends Apple Pay cards and passes. If Stolen Device Protection is on, turning Lost Mode off needs Face ID or Touch ID.

Does changing my passcode lock out someone who knew the old one?

Mostly, but on iOS 17 or later Apple keeps your previous passcode usable once for 72 hours, in case you forget the new one. Tap Expire Previous Passcode Now in Settings > Face ID & Passcode to end that straight away.

Should I erase my iPhone if it's stolen?

Only as a last resort. Apple says erasing can't be undone, so try locating and marking it as lost first. Keep the iPhone in Find My even after erasing, because removing it turns off Activation Lock.

What if a partner or family member knows my passcode?

Change it, reset Face ID and run Safety Check in Settings > Privacy & Security. If you feel unsafe, contact the National Domestic Abuse Helpline, run by Refuge, on 0808 2000 247, or your local police.

Sources