If a thief knows your passcode, treat the phone as unlocked. Mark it as lost, then check your Apple Account. You are probably reading this on another device, and that is where the first steps happen.
Mark the iPhone as lost
Go to iCloud.com/find, select the iPhone under All Devices, and choose Mark as Lost. You do not need a verification code for this, even if the stolen phone was your trusted device.
Apple adds two warnings here:
- Leave your phone number and message empty. A thief could use your contact details in a social engineering scheme (a trick to get information out of you).
- Keep the iPhone in Find My. Removing it can feel like cleaning up, but it also removes Activation Lock. That makes the phone easier to erase and resell.
Check your Apple Account
On a device you trust, open Settings, tap your name, and look at the device list and Sign-In & Security. Remove any device you do not know. If Find My was off on the stolen iPhone, change your Apple Account password now.
Then report the theft to the police and to your wireless carrier. Do not try to get the phone back yourself.
If Stolen Device Protection was on
Stolen Device Protection (iOS 17.3 or later) adds checks when the phone is away from places it knows, like home or work. To change your Apple Account password there, for example, the phone asks for Face ID or Touch ID, waits one hour, and then asks again.
It helps only if it was on before the theft. On your next iPhone, go to Settings, Face ID & Passcode, enter your passcode, and tap Stolen Device Protection. It may already be on. For what it does in the Photos app, see Stolen Device Protection and your photos.
What the thief has, if you use Vault9
The vault opens with your pattern or passphrase and the Secret Key, or Face ID if you turn it on. Your phone passcode is not one of them.
The thief has the phone, and the phone holds the Secret Key. iOS makes it hard, but not impossible, to copy the key out of the Keychain. So your pattern or passphrase is the lock that is left, and a thief can try to guess it. From the 5th wrong try in a row, the app makes them wait: 1 minute, then 2, then 4, and up to 60 minutes. A long passphrase is harder to guess than a pattern.
With the passcode, a thief can also add a face to the phone. If Face ID is on in Vault9 and someone adds a face or fingerprint, Face ID turns off in the app.
One limit: Vault9 does not protect a vault that is open on an unlocked phone. The app locks when it goes to the background, when you lock it, or after the Auto-lock time without a touch (5 minutes by default).
Getting your vault back on a new iPhone
You need 3 things: your Emergency Kit, your pattern or passphrase, and the iCloud backup.
- On the new iPhone, tap Open from iCloud backup in Vault9.
- Scan or type the Secret Key from your kit, then enter your pattern or passphrase.
- In Settings, tap Change pattern or passphrase.
Step 3 protects the iCloud backup from then on. It does not change the copy on the stolen phone, which still opens with the old pattern or passphrase. The Secret Key stays the same, because Vault9 cannot make a new one.
Without the kit, you cannot open the iCloud backup on a new phone. And items that were not in the iCloud backup are gone with the stolen phone.
Sources
- Apple Support: Stolen Device Protection for iPhone (checked 2026-11-06)
- Apple Support: If your iPhone or iPad was stolen (checked 2026-11-06)
