What Is Stolen Device Protection, and Does It Affect Your Hidden Photos?

What Stolen Device Protection Actually Is

Stolen Device Protection is a setting Apple introduced in iOS 17.3, designed to stop a thief who has watched you type your passcode from locking you out of your own Apple Account. To turn it on, your iPhone needs to be an iPhone XS or later, use two-factor authentication for your Apple Account, and have a device passcode, Face ID or Touch ID, and Significant Locations (part of Location Services) already set up, according to Apple's support documentation.

Once enabled, certain sensitive actions require Face ID or Touch ID verification with no passcode fallback, and a smaller set of especially risky actions require an additional one-hour Security Delay before they take effect.

The Two Tiers of Protection

Apple splits protected actions into two groups, according to its own iPhone user guide:

Biometric-only, no Security Delay. These require Face ID or Touch ID and cannot fall back to your passcode:

Biometric plus a one-hour Security Delay. These require Face ID or Touch ID, then a one-hour wait, then a second successful Face ID or Touch ID check before the change goes through:

By default, this second tier only applies when your iPhone is away from locations you visit often, such as home or work, referred to as "familiar locations." Starting in iOS 17.4, you can change that setting so the delay always applies, even at familiar locations.

• Viewing passwords or passkeys saved in iCloud Keychain
• Using payment methods saved in Safari
• Turning off Lost Mode
• Erasing all content and settings
• Applying for a new Apple Card or viewing its virtual card number
• Certain Apple Cash and Savings actions in Wallet
• Setting up a new device using your iPhone's settings
• Changing your Apple Account password
• Updating Apple Account security settings, such as adding or removing a trusted device, phone number, Recovery Key, or Recovery Contact
• Changing your iPhone passcode
• Adding or removing Face ID or Touch ID
• Turning off Find My
• Turning off Stolen Device Protection itself

What Stolen Device Protection Does Not Cover

Nowhere in Apple's own documentation for this feature is Photos, the Hidden album, or any photo-related setting listed among the protected actions. Stolen Device Protection is scoped narrowly to Apple Account credentials, device passcode and biometric enrollment, Find My, and a handful of financial actions in Wallet and Safari. It does not add any new lock, delay, or authentication step to viewing, editing, or exporting photos in the Photos app, whether or not those photos are in the Hidden album.

That gap matters because Stolen Device Protection's whole premise is defending against someone who already knows your passcode. If a thief has your passcode and your phone gets unlocked, Stolen Device Protection does nothing to stop them from opening Photos and browsing everything in it, including anything you've hidden through Apple's own tools.

Apple's Hidden Album vs. a Dedicated Vault

It helps to be clear about which feature does what.

Apple's Hidden album, found under Utilities in the Photos app, is a documented Apple feature. Since iOS 16, it locks by default and can require Face ID or Touch ID to view, according to Apple's support page on hiding photos. But it uses the same Face ID or Touch ID enrollment as the rest of your phone, so if someone can unlock your iPhone with your face, thumbprint, or passcode, they can also open your Hidden album. If you use iCloud Photos, anything you hide also gets hidden across your other signed-in devices.

A dedicated vault app takes a different approach by design. Secure Folder: Incogni Vault moves photos, videos, files, and notes out of the Photos app entirely and into on-device protected storage that unlocks with its own separate PIN or Face ID, independent from your phone's passcode. Knowing someone's phone passcode does not by itself give access to the vault. Secure Folder also includes a decoy vault, a second PIN that opens a completely different, harmless set of content with no visible sign the real vault exists, and Incogni Pro adds intruder alerts that quietly photograph and log wrong PIN attempts. None of this is a substitute for Stolen Device Protection: the two solve different problems. Stolen Device Protection guards your Apple Account and phone-level settings after a theft; a vault app guards specific private content from anyone who can already get past your lock screen, including people you know, not just thieves.

Setting Up Stolen Device Protection

If you haven't turned it on:

It's worth doing regardless of whether you also use a vault app. The two protect different things, and using both closes more of the picture than either one alone.

• Open Settings and tap Face ID & Passcode (or Touch ID & Passcode).
• Enter your passcode.
• Scroll to Stolen Device Protection and tap Turn On Protection.
• On iOS 17.4 or later, choose whether the Security Delay applies only away from familiar locations or always.