What Is Stolen Device Protection? How It Works on iPhone and Android

Stolen Device Protection is Apple's name for a feature that adds extra biometric checks and a waiting period to sensitive actions on an iPhone when the phone is away from the places you normally use it. Android's equivalent is a bundle of three Google features — Theft Detection Lock, Offline Device Lock and Remote Lock — that lock the screen automatically if the phone is snatched, taken offline, or reported missing. Both are designed around the same problem: a thief who has your unlocked phone, or who has watched you type your passcode, shouldn't be able to drain your accounts before you can act.

Why phone makers built a separate "stolen device" mode

A passcode or PIN is supposed to be the thing standing between a thief and your accounts. But passcodes can be watched over someone's shoulder, and once a thief has both the device and the code, a standard lock screen stops helping. Apple and Google each responded with a second layer that doesn't rely on something you type. Apple's approach leans on biometrics and location context; Google's leans on on-device motion sensing, connectivity signals and a remote-lock escape hatch that works even without your Google Account credentials. Neither replaces your lock screen or Find My/Find Hub — they sit on top of them.

How Apple's Stolen Device Protection works

Stolen Device Protection shipped with iOS 17.3 and, according to Apple's support documentation on Stolen Device Protection, adds a layer of security that applies specifically when your iPhone is away from familiar locations such as home or work. Apple determines familiar locations using the Significant Locations feature under Location Services, so the protection effectively knows the difference between "you, at home, locked out" and "someone else, somewhere you've never been, holding your phone."

Two things change once Stolen Device Protection is on and you're away from a familiar place:

• Some actions require Face ID or Touch ID with no passcode fallback at all. A thief who knows your passcode is simply blocked from completing them.
• Other, more sensitive account changes require Face ID or Touch ID, then a one-hour wait, then a second successful Face ID or Touch ID check — Apple calls this the Security Delay.

What you need before you can turn it on

Per Apple's support page, turning on Stolen Device Protection requires:

• iOS 17.3 or later
• Two-factor authentication turned on for your Apple Account
• A device passcode
• Face ID or Touch ID enabled
• Significant Locations turned on (part of Location Services)
• Find My turned on — and Apple notes you can't turn Find My off while Stolen Device Protection is enabled

Apple is explicit that the feature "must be turned on before the device is lost or stolen" — it isn't something you can switch on remotely after the fact, which is exactly why it's worth checking your settings now rather than after an incident.

Biometric-only actions vs. the one-hour Security Delay

Apple's support documentation splits the protected actions into two tiers. The table below lists them as described by Apple.

Apple notes that Apple Pay purchases can still use your passcode as normal — the biometric-only rule targets account and data-exposure actions, not everyday payments. The Security Delay can also end early if the iPhone detects that you've reached a familiar location in the meantime, so it isn't necessarily a flat hour if you're heading home.

How to turn Stolen Device Protection on or off, and why it might look greyed out

To check or change the setting, Apple's instructions are:

1. Open Settings and go to Face ID & Passcode (or Touch ID & Passcode on older models).
2. Enter your device passcode.
3. Tap Stolen Device Protection and turn it on or off.

Apple says the feature may already be on by default on an eligible iPhone, which is why many people searching "is Stolen Device Protection turned on" find it already enabled. If the toggle looks greyed out or unavailable, it almost always traces back to one of the prerequisites above — most commonly two-factor authentication not being active on the Apple Account, Significant Locations being switched off, or Find My not being turned on. Turning it off is itself a protected action: do it away from a familiar location and you'll hit the one-hour Security Delay first, which is intentional — it stops a thief from simply disabling your protection.

There's also an "Always" option. From the same Stolen Device Protection screen, choosing Always under "Require Security Delay" makes the one-hour delay and the biometric-only rules apply everywhere, including at home — useful if you want maximum protection and don't mind the extra friction. Apple also recommends turning the feature off before you sell, give away or trade in an iPhone, since it's tied to your Apple Account and device passcode. If you're weighing other account-level protections before a resale or handoff, a hardware security key as a second factor is a related option worth understanding alongside this feature.

Android's equivalent: three features, not one

Google doesn't ship a single "Stolen Device Protection" toggle. Instead, Google's support documentation on protecting your data against theft describes a set of theft-protection features — chiefly Theft Detection Lock, Offline Device Lock and Remote Lock — that you turn on individually under Settings > Google > All services > Theft protection. According to Google, they are not supported on Android Go devices, tablets or wearables, and exact support varies by phone model and Android version; if a toggle is greyed out, Google says that means the device doesn't support that particular feature.

Theft Detection Lock: how the "someone grabbed my phone" detection works

Google's help documentation describes Theft Detection Lock as using AI together with the device's motion sensors, Wi-Fi and Bluetooth to recognize the physical motion of a theft — the example Google gives is someone grabbing the phone out of your hand and then running, biking or driving away. When it detects that pattern, it automatically locks the device's screen to protect its contents. Google also notes some practical limits: the feature isn't active while the screen is already locked, and it may not trigger if the phone has a stable Wi-Fi or Bluetooth connection, or after it has already locked the device multiple times in a short period. A screen lock has to be set up for Theft Detection Lock to work at all.

Google's Android security blog, announcing the feature's global rollout, describes the same mechanic in plainer terms: the AI is built to sense "when someone snatches your phone from your hand and tries to run, bike or drive away," at which point the screen locks quickly so the content is protected.

Offline Device Lock and Remote Lock

The other two pieces work differently from Theft Detection Lock, and they're worth separating out because they get confused in search results:

• Offline Device Lock automatically locks your screen after the phone goes offline — Google's example is a thief turning off the internet connection specifically so you can't locate the device through Find Hub (Find My Device). Per Google's documentation, your phone must be unlocked when it loses internet connectivity for this to apply, and the screen can lock this way up to twice in a 24-hour period.
• Remote Lock lets you lock a lost or stolen phone's screen using just a verified phone number, from any other device, without needing to sign into your Google Account first. Per Google's own announcement of these theft-protection features, the requirements are a screen lock set on the phone, an active SIM card, a verified phone number, Find Hub turned on, and an internet connection on the device (if it's offline, the lock applies as soon as it reconnects). Once a phone is locked this way, Google says it can only be unlocked locally using the device's own screen lock — and like Offline Device Lock, it can be triggered at most twice in 24 hours.

To use Remote Lock, Google's instructions are to go to android.com/lock, enter your phone number, complete the security challenge (a CAPTCHA, and a security question if you've set one up), and request the lock — Google says the phone's screen locks shortly after. That combination of "no app, no sign-in, just a phone number and a challenge" is deliberately designed to work from a borrowed computer or a friend's phone right after a theft.

How to turn on Android's theft protection features

Google's support documentation gives a consistent settings path for all three features:

1. Open Settings on the Android device.
2. Tap Google, then All services.
3. Under "Personal & device safety," tap Theft protection.
4. Turn on Theft Detection Lock and Offline Device Lock from this screen.
5. Tap Remote Lock to turn it on separately; if your phone number isn't verified yet, tap Verify number (you can also enable automatic verification). You can optionally add a security question here too, confirming with your PIN or biometrics first.

Because these are opt-in, a phone can be fully updated and still have none of them switched on — it's worth checking this menu directly rather than assuming a recent Android version turned them on automatically. If you also use a Pixel's Private Space to keep sensitive apps separately locked, theft protection and Private Space are complementary rather than overlapping — one protects the whole device from a snatch-and-run, the other keeps specific apps behind their own PIN even on an unlocked phone.

iPhone vs. Android theft protection, side by side

What these features don't replace

Neither system is a substitute for Find My (Apple) or Find Hub/Find My Device (Google) — both companies describe their theft-protection features as working alongside device-finding and remote-wipe tools, not instead of them. Stolen Device Protection, for instance, specifically governs how hard it is to turn Lost Mode off or erase the device without your biometrics — it assumes Find My is already on. Android's Remote Lock exists precisely to buy you time to get to Find Hub's full factory-reset option. And software security update cadence still matters on both platforms; Android's monthly patch cycle, for example, regularly closes unrelated vulnerabilities that a thief could otherwise exploit, which is a separate reason to stay current — see our rundown of what a recent Android security update actually fixed, and when it reaches Pixel phones for how that patch timing works in practice.

What to do next

If you haven't already, the highest-value five minutes you can spend on this are: on iPhone, confirm two-factor authentication, Significant Locations and Find My are all on, then enable Stolen Device Protection under Face ID & Passcode; on Android, open Settings > Google > All services > Theft protection and switch on Theft Detection Lock, Offline Device Lock and Remote Lock (verifying your phone number while you're there). Both are free, both ship as part of the OS rather than a separate app, and both are explicitly designed to be set up before anything happens — not after.

Written byNadia Osei

Nadia Osei covers mobile and consumer gadgets for Pandromeda: smartphones, tablets, smartwatches, earbuds and smart-home devices. She tracks launches, software updates and pricing across Apple, Google, Samsung and the rest, and builds comparisons from the manufacturers' published specifications.

More from Nadia OseiAll Mobile & Gadgets coverage