“Stolen Device Protection.” Sounds great. Doesn’t it?

Who wouldn’t want their device protected if it was stolen? Apple’s marketing team knew exactly what they were doing with that name. You see it in your settings menu and the decision feels obvious — yeah, obviously I want that on.

But here’s the thing. We fix iPhones for a living. We’ve sat across the counter from customers who have lost access to years of their own photos. Messages from people no longer with them. Their entire digital life — gone. Not because their phone was stolen. Because a feature called Stolen Device Protection treated them like a thief.

This is the article nobody else is going to write. Because everyone else is too busy applauding Apple.

What Does It Actually Do?

Introduced in iOS 17.3, Stolen Device Protection kicks in whenever your iPhone is away from a “familiar location” (your home, your workplace). In those situations:

Biometrics only, no exceptions: Certain actions require Face ID or Touch ID. Your passcode — the one you’ve known for years — is no longer accepted as proof that you own the device.
One-hour security delay: Want to change your Apple ID password, disable Find My, update your trusted phone number, or turn Stolen Device Protection off? You must authenticate with Face ID, wait a full hour, then authenticate with Face ID again. No shortcuts.

The intended threat: a thief who steals your phone and already knows your passcode. That’s the scenario. One specific, fairly rare situation.

Everything else? Collateral damage.

The Scenario Nobody Warns You About

Everything is fine — until it’s not.

Your Face ID breaks. Maybe the screen cracked. Maybe it got wet. Maybe it just developed a fault one day (it happens more than Apple would like to admit). Suddenly the biometrics your phone depends on aren’t working.

Here’s what happens next:

You can no longer perform basic account operations on your own device using your own passcode. The phone you paid for. The account you created. Apple’s system has decided that without Face ID, it can’t be sure you’re not a criminal — so it locks you out of the very tools you’d need to recover your situation.

Your photos. Your messages. Irreplaceable things. Locked behind a feature you may not have even known was on.

The Repair Shop Reality

Let’s say you’re one of the lucky ones — your phone is broken, but not so badly that you can’t hold it and tap on it. You bring it to a repair shop.

The technician checks your settings. Stolen Device Protection is on.

“No problem,” you say. “I’ll turn it off for you.”

You go to Settings > Face ID & Passcode > Stolen Device Protection. You tap to disable it.

And then you wait. Because you’re not at home. You’re in a repair shop — an unfamiliar location. The one-hour security delay kicks in. You now have two options:

Go away, come back in an hour, authenticate again, and then the feature will disable
Leave your phone at the shop and come back later to complete the process

For a quick job that should take 20 minutes, you’ve now made two trips. Or you’ve left your phone — unlocked and in progress — with someone else for an hour.

This is a real thing that happens. Every week. In shops like ours.

And that’s the best-case scenario. Sometimes the phone is broken enough that the customer can’t navigate to settings to turn it off before handing it over. Sometimes Face ID is the thing that’s broken, so they can’t authenticate at all. The feature that’s supposed to protect them is now the thing standing in the way of getting their phone fixed.

”But I Never Turned That On”

In all our time doing this, we have yet to meet a single customer who knowingly enabled Stolen Device Protection.

Not one.

They don’t know what it is. They didn’t consciously choose it. They certainly didn’t think through the implications. They tapped through a software update, accepted the defaults, and moved on with their life.

Which brings us to the most important thing in this entire article.

iOS 26.4: Apple Made It the Default

Up until recently, Stolen Device Protection was something you had to opt into. A conscious choice.

From iOS 26.4 onwards, Apple changed that. When you update to iOS 26.4 or later, Apple turns Stolen Device Protection on for you, by default, without asking.

Let that sink in.

A feature with the power to permanently lock you out of your own data — silently enabled during a routine software update, on hundreds of millions of phones, for users who have no idea it exists.

And When It Goes Wrong? Apple Has a Solution.

Here’s the part that should make your blood boil.

If you end up locked out of your data because Face ID failed and Stolen Device Protection blocked your recovery options — if your photos are gone, your messages are gone, years of your digital life are inaccessible — Apple’s answer is simple:

You should be using iCloud Backup.

The subscription service. The one that costs money every month. The one that would have kept your photos safe in Apple’s cloud.

The photos you lost access to because Apple’s feature treated you like a thief? They’ll be happy to help you not lose them next time — for a monthly fee.

We’ll let you draw your own conclusions about whose interests this feature ultimately serves.

What You Should Do Right Now

1. Check if it’s on. Go to Settings > Face ID & Passcode and enter your passcode. Scroll down to find Stolen Device Protection. If you’re on iOS 17.3 or later and haven’t checked recently, there’s a good chance it’s on and you don’t know about it.

2. If you’re at home right now — and your Face ID works — consider your options. If you ever need to bring your phone in for repair, it helps enormously to disable this feature before you come in. You can only do it quickly from a familiar location. Home is the time.

3. Back up your photos independently. Don’t rely on a single point of failure. iCloud is one option, but Google Photos (free up to 15GB), a local backup via your computer, or a regular export to an external drive all work. Don’t wait until you need the backup.

4. If your Face ID is already unreliable — act now. Don’t wait for a bigger fault to develop. If biometrics are flaky, disable Stolen Device Protection while you still can, and get the Face ID issue looked at. The window between “works sometimes” and “locked out permanently” can be smaller than you think.

The Bottom Line

Stolen Device Protection was designed to address one very specific threat: a thief who steals your phone and knows your passcode. It offers real-world protection in that narrow scenario.

But it does so at the cost of making your phone significantly harder to service, repair, or recover — and it now gets turned on automatically, without your knowledge, for millions of people who will only discover it’s there when something goes wrong.

Great name. Genuinely terrible feature for most real-world users.

We’re not saying don’t use it. We’re saying: know it’s there. Know what it does. Make an informed choice.

Because right now, most people aren’t getting that choice at all.

We fix iPhones every week. This is the feature we spend more time explaining than any other. If you’ve got questions, get in touch or pop in and ask.