Apple iOS 17.3 Introduces Stolen Device Protection

Apple iOS 17.3 has arrived to consumers everywhere, and with it, the company is introducing Stolen Device Protection to beef up Apple ID and device cybersecurity. The update helps address a worrying concern that anyone with knowledge of your device PIN could hijack your Apple ID. Face ID or TouchID can now be enforced to access or change sensitive personal or financial information. Specific changes may also require waiting an hour to dissuade would-be hijackers who may know or possess your Apple device with Security Delay.

The addition of Stolen Device Protection comes after an extensive report (nearly a year ago) by the Wall Street Journal of prior iOS versions’ vulnerabilities with Apple ID account hijacking. An attacker who had knowledge of a target’s device PIN could remarkably hijack an Apple ID account with minimal effort. It also made it especially easy to access other phone apps with nothing more than a PIN verification. A simple PIN entry was usually all it took for attackers to access mobile financial and banking apps, where the victim’s money could be stolen in seconds.

How to Enable iOS Stolen Device Protection

Before you can enable Stolen Device Protection, you’ll need to use two-factor authentication for your Apple ID and set and enable at least one of the following:

• A device passcode (device PIN)
• Face ID or Touch ID
• Find My (for finding your Apple devices registered to your Apple ID)
• Signification Locations (Location Services)

We recommend enabling all of the above for maximum security on your devices and account. Significant locations are used to identify your home and work location. These represent frequent, geo-located areas of significance to you (more on this below).

Now that baseline security controls are in place, we can enable the new advanced account and device protection mechanism. Enrolling your device with Apple’s new iOS 17.3 Stolen Device Protection from here is straightforward.

Once your phone has been successfully updated to iOS 17.3, you’ll want to navigate on your phone to Settings > Face ID and Passcode. You’ll need to enter your device PIN to continue. Scroll down, and you’ll see the new “Stolen Device Protection” option, which is disabled by default. Simply tap “Turn On Protection,” and you’re done.

What Stolen Device Protection Protects Against

According to Apple, Stolen Device Protection provides the following safeguards for your device and Apple ID account:

• Using passwords or passkeys saved in Keychain
• Using payment methods saved in Safari (autofill)
• Turning off Lost Mode
• Erasing all content and settings 
• Applying for a new Apple Card 
• Viewing Apple Card virtual card number
• Take specific Apple Cash and Savings actions in Wallet (for example, Apple Cash or Savings transfers)
• Using your iPhone to set up a new device (for example, Quick Start)

What Apple Security Delay Protects Against

If you ever try to make significant changes to your Apple ID or device, you may be forced into a “Security Delay,” forcing users to wait an hour before the changes can be made. The following would trigger a Security Delay:

• Change your Apple ID password
• Sign out of your Apple ID
• Update Apple ID account security settings (such as adding or removing a trusted device, Recovery Key, or Recovery Contact)
• Add or remove Face ID or Touch ID
• Change your iPhone passcode
• Reset All Settings
• Turn off Find My 
• Turn off Stolen Device Protection

Suppose your device is ever stolen and is not at your home, work, or other significant locations (that you define), and someone is trying to access sensitive parts of your device or account. This checks the “red flag” box of Apple’s new Device Protection: Security Delay. Also note that if you try to disable Stolen Device Protection when you’re not in a familiar location, a security delay starts before you can turn it off.

This functions as a security mechanism and “cooling down period” where many rapid Apple ID account or device settings can’t be made. Sudden, rapid change requests indicate a strong likelihood that the device is stolen, so Apple is trying to safeguard you from harm.

Be sure to take aggressive steps to protect your Apple ID and devices today, as they can literally provide the key to your digital life and are data goldmines for hackers to exploit. You should also consider other protective measures against your internet and device usage by using a strong password manager and enabling two-factor authentication or a passkey whenever possible.