Practical iPhone security: what your lock screen still gives away

Many people turn on Face ID, set a passcode, and assume their iPhone is locked down. Yet there is a door left open by default that almost nobody knows about: the Control Center is reachable straight from the lock screen. When an iPhone gets stolen, a thief’s first move is often not guessing the passcode, but swiping down to Control Center and turning on Airplane Mode. The device then instantly disappears from the network: Find My can no longer update its location, and a remote lock or wipe command can no longer reach it. This trick is so well known that security researchers literally call it “an iPhone thief’s opening move,” yet few people know that a single setting closes it off. This whitepaper walks through, in practical terms, which settings remove this kind of risk, what Apple’s own Stolen Device Protection adds on top, and how IT administrators can enforce this across a fleet.

A locked screen is not the same thing as a closed screen. Apple deliberately allows a number of features to work without unlocking, purely for convenience: setting an alarm, making a payment, or reading a notification without entering your passcode. The problem is that one of those features, Control Center, also grants access to turning on Airplane Mode and switching off Wi-Fi and Bluetooth. For a thief, that is the fastest way to make a device untraceable within seconds, before the victim even realizes it is gone and can report it missing.

What else a locked screen shows or allows

Control Center is not the only feature reachable by default without unlocking. Under Settings there is a whole list of options that are each worth reviewing.

The setting that removes the biggest risk

Go to Settings > Face ID & Passcode, enter your passcode, and scroll to Allow Access When Locked. Each feature has its own separate toggle there. At the very least, turn off Control Center: that removes the biggest risk while you will not notice any difference in daily use, because the moment you unlock with Face ID or Touch ID you still have immediate full access. The toggle only blocks someone who has your device in hand, but not your face or finger.

Stolen Device Protection: on by default since 2026

On top of the lock screen setting, Apple has built an extra security layer specifically designed for the scenario where a thief has both your device and your passcode: Stolen Device Protection. Since iOS 26.4 (spring 2026), this feature is on by default for all iPhones, including business managed devices, rather than requiring users to turn it on themselves as was the case when it launched in iOS 17.3.

The feature works through two mechanisms. Away from a familiar location such as home or work, certain actions require Face ID or Touch ID with no passcode fallback: using saved passwords and passkeys, using saved payment details in Safari, turning off Lost Mode, opening a locked app, erasing the entire device, applying for a new Apple Card, and setting up a new device through Quick Start.

For even more critical changes, on top of the biometric check there is also a one hour security delay, followed by a second Face ID or Touch ID check: changing your Apple Account password, signing out of your Apple Account, changing trusted devices or a recovery key, adding or removing Face ID or Touch ID, changing your passcode, resetting all settings, enrolling in Mobile Device Management, and turning off Stolen Device Protection itself.

To use the feature you need two-factor authentication on your Apple Account, a passcode, Face ID or Touch ID, Find My turned on, and Significant Locations (part of Location Services) turned on. If you would rather not have an exception for familiar locations, you can choose “Always” for the security delay under Stolen Device Protection, so the extra checks apply at home and at the office too.

Practical checklist

1. Turn off Control Center under Settings > Face ID & Passcode > Allow Access When Locked, and consider doing the same for Notification Center and Reply with Message.
2. Check that Stolen Device Protection is active, especially on older devices not yet updated to iOS 26.4 or later.
3. Use a real passcode, not a simple pattern, together with Face ID or Touch ID.
4. Turn on Find My, including sharing the last location before the battery runs out.
5. Turn on erase data after 10 failed attempts for extra protection against brute-force attempts.
6. Keep Significant Locations on, since Stolen Device Protection needs it to recognize familiar locations.
7. Keep iOS updated: the on-by-default status of Stolen Device Protection only applies to devices that have actually received the update.

For IT administrators: enforcing this across the fleet

For an SMB with multiple business iPhones, this does not have to mean hoping everyone sets the option correctly themselves. Through the Restrictions payload in a configuration profile, deployed via Apple Business or Intune, you can centrally enforce part of these settings, even on non-supervised devices:

Stolen Device Protection itself is not a setting an administrator can enforce remotely, since it is tied to the user’s own biometrics, location history, and two-factor authentication. The practical advice for an SMB is therefore a combination: enforce the lock screen restrictions centrally through your management service, and make activating and verifying Stolen Device Protection a fixed step in your onboarding instructions for new business iPhones.

A practical scenario for SMBs

A concrete approach for an IT contact rolling this out across an existing fleet of business iPhones:

1. Check through your management service which devices still lack a restriction profile for lock screen features.
2. Build a configuration profile that blocks Control Center, Today View, and Notification Center on the lock screen.
3. Deploy this profile via Apple Business or Intune to all business iPhones.
4. Tell employees that they need to check and activate Stolen Device Protection themselves, since it cannot be enforced remotely.
5. Check per device that Find My and Significant Locations are turned on.
6. Add these steps to your standard onboarding checklist for new business iPhones, so this does not remain a one-off action every time.

With this combination of a centrally enforced lock screen restriction and a deliberately activated Stolen Device Protection, you close exactly the gap that makes the scenario from the introduction possible, and as an SMB you end up with a device fleet that is not just passcode protected, but actually locked down.