My phone was stolen and the thief knows my passcode. What do I do?

Someone watched you type your passcode at a bar or on a train. Then they took the phone from your hand or your table. This is different from a phone left in a taxi. With the passcode, a thief can open your apps and read your messages. On an unprotected phone, they can also try to take over your account so you cannot lock them out. The first hour matters most. This page shows what to do right now and what Apple and Google build in for this case. It also shows what to turn on before it happens. We checked each step against Apple’s and Google’s own pages on 2026-10-08.

In the first hour

Use a laptop, a friend’s phone or another of your devices.

1. Mark the phone as lost. On iPhone, use Find My on another Apple device or Find Devices on iCloud.com. Tap Devices, select the iPhone, tap Lost Mode, then Activate. On Android, go to android.com/lock and enter your phone number. Or use Find Hub and tap Mark as lost.
2. Call your carrier. Apple advises you to report the phone and “ask them to disable your account.” A thief who keeps your SIM can receive the text codes that many services send to sign in.
3. Report it to the police. Apple notes they may ask for the serial number, “which you can find even if you don’t have the device.”
4. Secure your accounts. Change the passwords for your email, bank and social apps from another device. Then review your Apple Account or Google Account for changes you did not make.

Erase the phone once you know you will not get it back. On iPhone, Apple says: “Don’t remove the device from Find My, even if you remotely erase it.” Removing it takes off Activation Lock, which makes the phone “easier for the thief to unlock and resell.”

What Stolen Device Protection does on iPhone

Apple built Stolen Device Protection for “the rare instance when someone has stolen your iPhone and knows your passcode.” When the iPhone is away from familiar places such as home or work, it changes two things:

• Face ID or Touch ID, with no passcode fallback, for saved passwords and passkeys, saved payment methods, turning off Lost Mode, opening a locked app, and erasing the phone.
• A 1-hour Security Delay for changes such as a new Apple Account password or passcode, signing out of your Apple Account, and adding Face ID. The thief needs Face ID, then an hour, then Face ID again.

Apple says this gives you time “to mark your device as lost and make sure your Apple Account is secure.” It needs iOS 17.3 or later, and it must be on before the theft.

Turn it on now. Go to Settings, tap Face ID & Passcode, and enter your passcode. Tap Stolen Device Protection and turn it on. Choose Always if you want it at home too.

What it does not cover. The Photos app is not on Apple’s Face ID list. A thief with your passcode can open Photos and, by default, the Hidden album. Our Hidden album guide explains why. To change that, lock the Photos app with Require Face ID. Apple says that with Stolen Device Protection, a locked app needs Face ID “with no passcode alternative” away from familiar places. Our guide to locking photos on iPhone shows the steps.

What Android theft protection does

On supported Android phones, open Settings, tap Google, then All services, then Theft protection. Some switches need Android 15 or later. Google lists several switches:

• Theft Detection Lock uses the phone’s motion sensors, Wi-Fi and Bluetooth to spot a grab and run, then locks the screen.
• Offline Device Lock locks the screen after a short time offline. A thief cannot cut the connection to hide from Find Hub.
• Remote Lock lets you lock the phone at android.com/lock with your verified phone number.
• Identity Check requires your fingerprint or face, not a PIN, outside trusted places. That covers changing the screen lock, a factory reset, turning off Find Hub, and adding or removing a Google Account.

Support varies by phone, and Samsung and other makers may name things differently. If a switch is grayed out, Google says your phone does not support it.

The gap: your photos

All of these tools protect your account and the phone’s settings. They give you time to lock or erase the phone. They do not stop someone with your passcode from scrolling your photo library in the minutes after the theft. If you share a passcode with anyone, the same gap applies at home. Read what to do when someone knows your passcode.

Where York Vault fits

York Vault opens only with its own code, on iPhone and Android. The phone passcode does not open it. Face ID falls back to the York Vault code, never the phone passcode. A thief who adds their own face or fingerprint in the phone’s settings gains nothing: York Vault turns Face ID off until you type your code once.

Wrong guesses slow down. After 5 wrong codes, York Vault adds a wait that grows to 1 hour. Changing the date or reinstalling does not reset it. Guesses can only happen on that phone. The lock options page covers each code type. On Plus and Pro, two-step lock can require both your face and your code.

One setting matters here. York Vault has an optional 72-hour recovery through your Apple Account or Google account. It starts with the phone passcode and shows a banner on your other devices, and your code cancels it. If a thief might know your passcode, leave it off and rely on your recovery key.

Your library is backed up, encrypted, to your own iCloud or Google Drive. On a new phone, your code or recovery key brings it back. See getting your photos back after a lost phone. Download York Vault for iPhone or Android.