A stolen smartphone is an expensive inconvenience. A stolen smartphone that is still unlocked — or whose passcode the thief watched you tap in — is a financial emergency. That is the thinking behind two features Google and Apple have been steadily building into their platforms: Anti-Theft Protection on Android and Stolen Device Protection on iOS. Both assume the worst, and both make sure that, away from your usual haunts, a PIN is no longer enough to reach your accounts. The catch is universal: everything has to be switched on before the phone disappears.
- Protect accounts, not the handset: none of these tools stops a snatch-and-run or magically returns your phone. They lock the screen at the moment of theft and block a passcode-holding stranger from resetting your password, killing location tracking or reading saved credentials.
- The passcode is the weak link: both platforms fall back on mandatory fingerprint or face checks for critical actions once the device leaves the locations you have marked as trusted.
- Hardware and software caveats apply: Android’s toolkit needs Android 10 or later for some steps and Android 15 for others, and is missing on Go edition devices, tablets and wearables; Apple’s requires iOS 17.3 or newer.
- Two universal fixes: a SIM PIN and hidden lock-screen notifications cost nothing and work on any phone.
What anti-theft mode really protects
Start with realistic expectations. These settings defend your data and your identity, not the hardware. The priority order is straightforward: first, make sure the screen locks itself; second, make sure your passcode stops being sufficient outside the house; third, make sure you can lock the device remotely even if you cannot recall your account password under stress. The thief who does the most damage is not the one holding the phone — it is the one holding it unlocked or knowing the code, because a single passcode opens the password manager, then the Google or Apple account, then email, then banking.
Android: the switches inside Anti-Theft Protection
Google’s support documentation places the features under Settings > Google > All services > Anti-Theft Protection, in the personal and device safety section. A screen lock must already be configured, compatibility varies by manufacturer, and menu labels may differ on third-party handsets.
Theft Lock
This one locks the screen automatically when the phone senses that someone has grabbed it and run — on foot, by bike or in a car. Detection relies on AI, motion sensors, Wi-Fi and Bluetooth. Two limits matter: it will not fire if the screen is already locked, and it may stay silent when the device holds a stable Wi-Fi or Bluetooth connection. If the option appears greyed out, the handset does not support it.
Offline Device Lock and Remote Lock
Offline Device Lock handles the oldest trick in the book — cutting the data connection so the phone cannot be tracked. Shortly after losing connectivity, the device locks itself. It can trigger twice in 24 hours and only works if the phone was unlocked when the connection dropped. Remote Lock goes further: it lets you lock the screen from android.com/lock using just your phone number and a reCAPTCHA, with no Google password required. It needs an active SIM, a verified number, Find My Device switched on and a connection; if the phone is offline, the lock applies the moment it reconnects. It runs twice per 24 hours and supports an optional security question to stop pranksters locking you out.
Identity Verification
This is the most consequential setting and the least discussed. Outside trusted places you define — home, work — it demands a fingerprint or face scan with no PIN fallback for sensitive actions: viewing passwords in Google Password Manager, changing the screen lock, factory resetting, disabling Find My Device, turning off anti-theft protection itself, or adding and removing a Google account. Biometrics are also required to change the Google account password or its recovery methods from the handset. Availability is limited to selected devices.
Google also enables two safeguards by default once a screen lock exists: locking after repeated failed authentication attempts, and protection for sensitive settings.
iPhone: Stolen Device Protection and the one-hour buffer
Apple’s equivalent has shipped since iOS 17.3, may already be active, and lives under Settings > Face ID & Passcode > Stolen Device Protection. It requires two-factor authentication on your Apple Account, a passcode, Face ID or Touch ID, Find My enabled, and Significant Locations turned on in Location Services. Away from familiar places it works in two layers.
The first layer forces biometrics with no passcode backup for using passwords and passkeys from Keychain, autofilling payment methods in Safari, switching off Lost Mode, erasing content and settings, setting up or transferring an eSIM, and using the iPhone to configure another device. The second adds a one-hour security delay plus a second biometric check before you can change the Apple Account password, sign out of it, alter its security settings, change the passcode or disable the protection itself. That hour is the whole point: it buys time to mark the iPhone as lost before the thief touches your account. Choosing Always under the security delay applies the same rules at home. One nuance worth knowing — Apple Pay keeps working with the passcode.
Two settings for any phone
Set a SIM PIN and hide notification previews on the lock screen. Google spells out why the first matters: a SIM moved to another handset can be used to seize control of your phone number, while messages peeking out on a locked screen hand over clues for breaking into accounts. On Android both live under Settings > Security & privacy > More security settings. Google warns that some carriers ship a default SIM PIN that is publicly known, so change it immediately, and recommends a passcode of six digits or more even when biometrics are in use.
The uncomfortable part is that all of this still depends on the owner finding it. Apple says its protection may arrive enabled; Google says some features ship depending on the manufacturer. Until the critical switches are universal and mandatory, the gap between losing a phone and losing your savings will be decided by five minutes of configuration — and those five minutes are best spent today rather than after the phone is gone.