Protecting Yourself from a Stolen Phone

I think we all know how much personal information we have on our phones and how important it is to keep them safe and secure, but we also probably just assume that if we have a PIN code we're good. Sadly, this is no longer enough, so I thought I'd give some help and advice to anyone who may be concerned about this and want to protect themselves better.

If someone has access to your phone, they have access to your entire life. Most people have their email (both private and work) on their phones, the names and numbers of most of the people they know, often all their passwords, their Multi-factor Authentication app, addresses of home and work in maps, banking apps, crypto apps, work HR apps with access to payslips, home security (alarms and sometimes even the ability to open gates and doors), your entire calendar and schedule etc. It's scary how much risk all of this information being open to someone else poses.

Stealing a properly locked phone is of little value to a thief. They can't sell it because it will be disabled as soon as it connects to any network. They obviously know this, and usually watch their intended victim (sometimes for hours) to see if they input their PIN code into their phone which they note down before finally grabbing the device.

Protect your phone PIN like you protect your ATM PIN.

We've all been trained to look behind us before entering our PIN into the ATM. We also need to check that no-one is watching before entering your PIN into your phone. Ideally, don't ever enter your PIN in a public space. Always use FaceID, TouchID or some other biometric method so the thieves have nothing to see. These methods do occasionally fail though, so if you are ever prompted to enter your PIN, do a blind-spot check and then enter it in very close to your body, ideally in a private space.

Also, a 6 digit PIN is a much better PIN than 4 digits. 4 is easier for a bad guy to see, and is not really considered secure anymore.

Why this matters:

If a thief has your PIN code, they could do the following:

If you mark your device as lost (which you should do if it is lost), they can mark it as found, rendering this protection useless
Access most apps
They can CHANGE YOUR APPLIED PASSWORD, locking you out of your account completely without knowing your current password
Access your Passwords stored in iCloud / Google Password Manager
Access your Multi-Factor Authentication App
Change any password they want on any other account because they have access to your email and MFA, effectively locking you out of your life
Remove the device from your Apple / Google account, making it available to factory reset and sell
Go to your house and potentially turn off your security system (or even open your gate / door depending how cool and technologically advanced your house is)
Buy stuff with Apple Pay / Google Pay / Snapscan etc.

This is far from an exhaustive list, and there are plenty of other things they could do, but these are probably the main risks and why keeping your PIN safe is so important.

So how can we better protect ourselves from this?

Apart from a healthy dose of paranoia about your PIN code, there are some measures you can take to help protect yourself should your phone be stolen with the PIN code known.

Enable Lost Device Protection:

iPhone:

Ensure Two-Factor Authentication is enabled for your Apple ID.
Make sure Device Passcode, Face ID or Touch ID, and Significant Locations are enabled. You can find Significant Locations by going to Settings > Privacy & Security > Location Services > System Services > Significant Locations.
Turn on Find My iPhone if it’s not already enabled.

Once these steps are completed:

Open Settings and tap Face ID & Passcode.
Enter your passcode, tap Stolen Device Protection, and switch it on. This option is available on IOS 17.3 and above.

This feature will activate additional security measures when you’re away from familiar locations (eg. home or office) such as preventing account or password changes, marking a device as "Not Lost" etc. without requiring a biometric (FaceID or TouchID verification) with NO PIN CODE fallback.

Some security actions, such as changing your Apple Account password, also require you to wait an hour and then perform a second Face ID or Touch ID authentication.

Read more about this cool feature here: https://support.apple.com/en-za/120340

Android:

Find My Device: This feature allows you to locate, lock, and erase your device remotely. To enable it:

Go to Settings > Security > Find My Device.
Ensure that Find My Device is turned on.

Theft Detection Lock: Available on devices running Android 15 and above, this feature uses AI to detect if your phone has been stolen and automatically locks it. To enable:

Go to Settings > Security > Theft Protection.
Turn on Theft Detection Lock.

These features are designed to protect your data and make it more difficult for thieves to access or reset your device.

Read more about this here: https://blog.google/products/android/android-theft-protection/

Be safe out here!

Nothing is perfect, and there are still ways around these protections, but they add significantly more work for the bad guys to do. This gives you more time to change passwords, contact your mobile provider, report it to your company cyber-security team etc. in order to protect yourself.

If your phone does get stolen, mark it as lost, and change your personal email account password as soon as possible. This will prevent them from accessing your email and changing any other account passwords by using the "Forgot Password" button. If you do manage to get your phone back or it was just misplaced, the worst thing that you have to deal with is a new email password.

If you notice any strange emails from Apple or Google coming to you, ignore them. Thieves also try and phish your iCloud or Google password if they don't have the access they need.

If you see a mail saying your passwords have changed, (especially iCloud or Google), contact Apple to Google immediately as they do have account recovery processes to help with this.

Page updated

Report abuse