How to Secure Your Apple Account and Google Account Against Phone Thieves

The most damaging phone thefts aren’t grab-and-run. They start with someone watching you type your passcode in a bar or on a train, then taking the phone. With the passcode, a thief can open the phone’s settings, change your Apple Account or Google Account password, switch off Find My, add their own trusted phone number — and lock you out of your photos, email and bank codes while they reset and resell the device.

Your phone is the key to your accounts, so protecting the account is as important as protecting the hardware. This guide walks through the account-level defenses on both platforms, explains why each one matters, and points out a few popular tricks that can backfire. For the on-device basics, our phone theft protection checklist covers lock screens and Find My; this article goes one level deeper.

Understand the attack: why the passcode is the master key

On both iPhone and Android, the device passcode has historically been enough to authorize sensitive account changes on that device. That made sense for convenience — if you forget your Apple Account password, you can reset it from your own iPhone using the passcode. But it means a thief with your phone and your passcode can do the same.

Every defense below aims to break that chain in one of three ways:

• Require biometrics (your face or fingerprint) instead of a passcode for sensitive changes.
• Add time — a delay that gives you a window to mark the phone as lost.
• Move recovery off the phone, so losing the device and passcode doesn’t mean losing the account.

Apple Account: the settings that matter

1. Turn on Stolen Device Protection

Settings › Face ID & Passcode › Stolen Device Protection (requires two-factor authentication, Find My and a passcode). When the iPhone is away from familiar locations like home or work:

• Viewing saved passwords, turning off Lost Mode, erasing the phone and using saved cards require Face ID or Touch ID — no passcode fallback.
• Changing your Apple Account password, turning off Find My, changing the passcode or editing trusted devices requires biometrics, then a one-hour security delay, then biometrics again.

Set the delay option to Always if you want the strongest protection, at the cost of waiting an hour even at home. Either way, the delay is the window you need to mark the phone as lost from another device.

2. Use an alphanumeric passcode

Settings › Face ID & Passcode › Change Passcode › Passcode Options › Custom Alphanumeric Code. Six digits are easy to read over a shoulder; a short word plus numbers is much harder. Use Face ID in public so you rarely type it.

3. Check two-factor authentication and trusted numbers

Settings › [your name] › Sign-In & Security. Confirm two-factor authentication is on and that every trusted phone number is yours. Add a second number — a partner’s or a second line — so you can still receive codes if your SIM is gone.

4. Set up a Recovery Contact (and think hard about a Recovery Key)

Under Sign-In & Security › Account Recovery you can add a Recovery Contact: a trusted person whose Apple device can generate a code to help you back in. It’s low-risk and very useful.

The Recovery Key is a 28-character code that replaces Apple’s standard account recovery. It makes it far harder for anyone — including a thief who socially engineers Apple Support — to recover your account. But the trade-off is serious: if you lose the key and access to your trusted devices, you can be locked out permanently. Only enable it if you will store the key offline in a safe place, and never photograph it into the same iCloud account it protects.

5. Add passkeys and audit your devices

Wherever sites support passkeys, use them; they can’t be phished or typed into a fake login page. Then scroll to the bottom of Settings › [your name] and remove any device you don’t recognize or no longer own.

Activation Lock — the lock in the diagram above — is what makes a stolen iPhone hard to resell. It only protects you as long as the thief can’t get into your Apple Account, which is why these account settings matter so much. See how Activation Lock works.

Google Account and Android: the matching defenses

1. Turn on Android’s theft protection

On Android 10 and later with up-to-date Google Play services, open Settings › Google › All services › Theft protection (some phones: Settings › Security & privacy › Device unlock › Theft protection):

• Theft Detection Lock uses motion sensing to lock the screen if someone snatches the phone and runs or rides away.
• Offline Device Lock locks the screen when the phone is cut off from the network for a while, a common thief tactic.
• Remote Lock lets you lock the phone from any browser at android.com/lock using just your phone number.

On Pixels and newer Galaxy phones, also turn on Identity Check where offered: outside trusted places it requires biometrics to change the screen lock, disable theft protection or access passkeys.

2. Use 2-Step Verification with prompts or passkeys

At myaccount.google.com/security, confirm 2-Step Verification is on and prefer Google prompts, passkeys or a hardware security key over SMS codes. Download a set of backup codes and store them on paper.

3. Keep recovery options current

Your recovery email should be one that isn’t accessible from the stolen phone without a separate password, and your recovery phone should be a number you control. Run Google’s Security Checkup and remove old devices under Security › Your devices.

4. Lock down Samsung or Xiaomi accounts too

On a Galaxy, the Samsung account controls Find My Mobile and Reactivation Lock; give it its own strong password and two-step verification. Xiaomi’s Mi Account works the same way — see the FRP and account-lock explainer for how these locks stack.

The SIM PIN: small setting, big payoff

Thieves often pull your SIM card to receive your SMS codes in another phone. A SIM PIN stops that: the SIM won’t work in any device without it.

• iPhone: Settings › Cellular (Mobile Data) › SIM PIN.
• Android: usually Settings › Security & privacy › More security settings › SIM lock (Samsung: Settings › Security and privacy › Other security settings › Set up SIM card lock).

Find your carrier’s default PIN before you start — commonly listed on the carrier’s support site. Three wrong attempts lock the SIM and require the PUK code from your carrier, so don’t guess. eSIMs are harder to physically steal, but a SIM PIN still protects them on many phones.

Your number can also be stolen remotely through your carrier; our guide to SIM swap fraud covers carrier account PINs and port-out protection.

If the phone is stolen: the first hour

1. From another device, open Find My (icloud.com/find) or Find My Device (android.com/find) and mark the phone as lost or lock it. Do not remove it from your account.
2. Change your Apple Account or Google Account password and review trusted numbers and devices.
3. Call your carrier to suspend the SIM and report the phone; ask them to block the IMEI.
4. Call your bank and freeze any cards stored in Wallet or Google Wallet.
5. Later, confirm the IMEI is listed with a GSMA blacklist check — and, for US phones, a USA blacklist/barred check.

A five-minute account health check

Before you sell or replace a phone, it’s also worth confirming what the outside world sees for it. A Find My status check or the All-in-one report shows whether the phone is still linked to your account, and a carrier + SIM-lock check confirms network status. Start with a free iCloud status check, or pick several reports below:

Verdict: a thief who only has your phone has a locked device. A thief who has your phone, your passcode and an unprotected account has your whole digital life. Ten minutes in these settings takes the second scenario off the table.