What to do if someone watched you type your passcode

iPhoneAndroidUpdated

You were typing your passcode on the bus, in a bar or at the table, and you looked up to find someone watching. Change the code, then turn on the iPhone or Android protections built for exactly this: someone who knows your passcode and might get hold of the phone.

Quick answer

Change your passcode straight away, using a longer one. On iPhone with iOS 17 or later, then tap Expire Previous Passcode Now so the old code stops working. Turn on Stolen Device Protection (iOS 17.3 or later) or Android's theft protection, which make the most sensitive actions need your face or fingerprint, not just the code.

What can someone do if they know your passcode?

The risk comes if they also get hold of the phone. Apple says that if others know your passcode, they'll be able to view and make changes to the information on your device and your Apple Account. The features Apple and Google built against this show what's at stake.

Apple says Stolen Device Protection exists to help prevent someone who has stolen your iPhone and knows your passcode from making critical changes to your account or device. With it on, the passcode stops being enough for things like saved passwords and payment cards. Google's Identity Check protects a similar list: saved passwords and passkeys, changing the screen lock or biometrics, running a factory reset, turning off Find Hub, and adding or removing a Google Account.

How do you change your iPhone passcode so the old one stops working?

Change it, then close the 72-hour window. Apple says that on iOS 17 or later, your previous passcode can still be used once in the 72 hours after a change, in case you forget the new one. If someone else knows the old code, end that straight away.

  1. Go to Settings > Face ID & Passcode (Touch ID & Passcode on iPhones with a Home button) and enter your current passcode.
  2. Tap Change Passcode.
  3. Tap Passcode Options and choose a custom alphanumeric code or a longer custom numeric code.
  4. Back in Face ID & Passcode, tap Expire Previous Passcode Now.

If Stolen Device Protection is on and you're away from a familiar place, Apple says changing the passcode needs Face ID or Touch ID, a one-hour security delay, then Face ID or Touch ID again.

How do you change your Android screen lock?

On a Pixel, the screen lock lives under Security and privacy. Steps may vary on other phones.

  1. Open Settings and tap Security and privacy > Device unlock.
  2. Tap Screen lock and enter your current PIN, pattern or password.
  3. Choose PIN or Password and follow the steps.

Google says a six-digit PIN is recommended for added security, that longer PINs tend to be more secure, and that a strong password is the most secure screen lock option.

Should you use a longer passcode?

Yes, especially if people see you type it. Apple says iPhone passcodes default to six digits, and the options run from least secure (four digits) to most secure (alphanumeric). Get Safe Online says to protect your phone with a PIN that's difficult to guess, and never to reveal it or write it down where it can be found.

Apple's Personal Safety guide says that if you believe someone else knows your passcode, you can reset it in Settings. There's no need to wait until something goes wrong.

How does Stolen Device Protection help on iPhone?

It makes the passcode much less useful to anyone but you. With it on and the iPhone away from familiar places, Apple says using saved passwords and passkeys, using saved payment cards in Safari, turning off Lost Mode and erasing the iPhone all need Face ID or Touch ID, with no passcode fallback. Apple notes the passcode still works for Apple Pay.

It needs iOS 17.3 or later and must be on before anything happens.

  1. Go to Settings > Face ID & Passcode and enter your passcode.
  2. Tap Stolen Device Protection and turn it on.
  3. Optional: under Require Security Delay, choose Always so it applies at home and work too.

It also needs two-factor authentication and Find My. More in what to do if someone knows your iPhone passcode.

What does Android theft protection do?

Google's theft protection settings give Android phones a similar safety net. Identity Check, on supported phones (Google notes some steps need Android 15 or later), makes sensitive actions need your fingerprint or face outside trusted places, and Google says you can't use a PIN, pattern or password instead. Some features may already be on.

  1. Open Settings and tap Google > All services.
  2. Under 'Personal and device safety', tap Theft protection.
  3. Turn on Identity Check if it's listed. If it isn't, Google says your phone doesn't support it.
  4. Turn on Theft Detection Lock, which Google says locks the screen if it detects the phone being taken from you.
  5. Turn on Remote Lock, which lets you lock the screen from android.com/lock with your phone number.

Could they have changed anything already?

If they also had the phone in their hands, check for changes: an extra face or fingerprint would let them back in after you change the code. See can someone unlock your phone while you sleep for more. Apple says that if you think someone added an alternative Face ID appearance, reset Face ID and set it up again.

  1. iPhone: Settings > Face ID & Passcode > Reset Face ID, then set it up with only your face. On Touch ID models, review fingerprints in Settings > Touch ID & Passcode.
  2. Pixel: Settings > Security and privacy > Device unlock > Fingerprint, and delete any you don't recognise.
  3. Check the devices signed in to your accounts: on iPhone, Settings > your name, then scroll to the device list. For Google, go to your Google Account > Security & sign-in > Manage all devices.

Where Failshot fits

A new passcode keeps people out. Failshot shows you who, if anyone, still gets in. It photographs whoever unlocks your phone while Failshot is on, and the camera light shows whenever it takes a photo.

On iPhone, Apple doesn't let any app see the Lock Screen or use the camera in the background, so you turn Failshot on and lock the phone. Whoever unlocks it lands in Failshot and is photographed. It doesn't photograph a wrong passcode at the iPhone Lock Screen. On Android, it also photographs a wrong PIN, pattern or password at the real lock screen.

That matters when someone may know your code, because switching Failshot off never uses it. It needs Face ID, your fingerprint or face on Android, or your own Failshot PIN plus your answer. A wrong Failshot PIN takes another photo. Photos stay on your phone, with optional email alerts. Failshot is for your own device only, and it's coming soon to iPhone and Android.

Questions people also ask

What can someone do with my iPhone passcode?

With the phone in hand, Apple says someone who knows your passcode can view and change the information on your device and your Apple Account. Stolen Device Protection, on iOS 17.3 or later, makes the most sensitive actions need Face ID or Touch ID away from familiar places.

Does changing my passcode stop someone who knew the old one?

Mostly. On iOS 17 or later, Apple keeps the previous passcode usable once for 72 hours in case you forget the new one. Tap Expire Previous Passcode Now in Settings > Face ID & Passcode to end that straight away.

Is a four-digit passcode safe?

Apple describes four digits as the least secure passcode option and alphanumeric as the most secure. Google recommends a six-digit PIN on Android and says longer PINs tend to be more secure. If people have seen you type a short code, a longer one is a sensible change.

Can someone open my banking app with my phone passcode?

It depends on the app's own sign-in. Get Safe Online advises logging out of banking apps when you've finished and keeping your phone PIN private. If you think someone has used your phone and you see payments you don't recognise, contact your bank straight away.

Sources