Your iPhone was stolen and the thief knows the passcode
Mark the phone as lost from another device right away, keep it in Find My and lock down your Apple Account.
Go to iCloud.com/find on any device and mark the iPhone as lost. You can sign in without a verification code. Do not remove the phone from Find My. Then report the theft to police and your carrier, and review your Apple Account from a trusted device.
Some thieves watch a person type a passcode at a bar, then take the phone. With the code they can open everything your passcode protects, including the Hidden album and saved logins. Act quickly, in this order.
Do this first
- Borrow any phone or computer and go to iCloud.com/find. Apple designed this sign-in so you do not need a verification code, which helps when your trusted device is the one that was stolen.
- Under All Devices, select your iPhone.
- Choose Mark as Lost and follow the prompts.
Lost Mode locks the phone. With Stolen Device Protection on, turning Lost Mode off requires Face ID or Touch ID, so the passcode alone will not get the thief back in.
Apple gives two warnings. Skip the optional contact number and message when the phone was stolen, because a thief can use them to trick you. Also keep the phone in Find My, since removing it removes Activation Lock and makes it easier to erase and resell.
If Find My was off, the phone will not appear and you cannot lock it. Change your Apple Account password right away instead.
Report it
- Police. Apple advises against trying to recover the phone yourself, even if the map shows where it is. Police may ask for the serial number, which you can look up without the device.
- Your carrier. Ask them to suspend your line. Texts to your number may be used for account verification.
- AppleCare+ with Theft and Loss, if you have it. File the claim, and leave the phone on your account until Apple approves it.
Secure your accounts
From a trusted iPad or Mac, open Settings or System Settings and tap your name. Check the device list, then go to Sign-In & Security and look at your email addresses, phone numbers and recovery methods. Change anything you did not set, and change your Apple Account password. You can also review this at account.apple.com.
Then work through whatever the thief could open with your passcode. Change passwords for email, banking and any shopping apps with saved cards. Call your bank if a banking app was logged in. If you stored a crypto seed phrase in Photos or Notes, treat it as exposed and move your funds, as our seed phrase guide explains.
If the phone stays gone
When you have run out of options for getting it back, erase it remotely from Find My or iCloud.com/find. If the phone is offline, the erase starts the next time it connects. Keep the phone in Find My, even after you erase. You can remove it from your account’s device list without removing it from Find My.
Watch for scams over the following weeks. Phony support calls and messages claiming your phone was found often follow a theft, and they exist to get your password.
Prepare your next phone
Stolen Device Protection must be on before a theft. Find it in Settings under Face ID & Passcode, and consider setting Require Security Delay to Always. It needs two-factor authentication, a passcode, Face ID or Touch ID, Significant Locations and Find My. Apple says this protection lasts only for a period of time, so Mark as Lost still comes first.
Use a longer passcode, and cover it when you type in public.
Frequently asked questions
Can a thief with my passcode take over my Apple Account?
Without Stolen Device Protection, a passcode can be enough to change your Apple Account password. With the feature on and the phone in an unfamiliar place, the change requires Face ID or Touch ID and a one-hour delay.
Should I remotely erase the stolen phone?
Apple suggests trying everything else first, because erasing cannot be undone. On iOS 15 or later you can still locate the phone in Find My after you erase it. Keep it in Find My after erasing.
Someone messaged saying my phone was found. Is that Apple?
Apple says it will never contact you to say your device has been found. Treat those messages as phishing attempts to get your passcode or password.