Stolen Device Protection is the most useful iPhone security feature that most people have never switched on. It exists to close a specific gap: what happens when someone knows your passcode and has your phone in their hands.
That combination used to be the end of the story. With this on, it is not. Here is what it actually does and what it does not.
The problem it was built for
Face ID and a passcode sound like two layers, but the passcode is a fallback for the face, which means the passcode is the real key. Anyone who has it can unlock the phone.
Worse, the passcode is also what iOS accepted for the sensitive changes: turning off Find My, changing the Apple Account password, adding a recovery key. So someone who watched you type it in a bar and then took the phone could lock you out of your own account before you got home.
Stolen Device Protection stops the passcode being enough for those actions.
What it changes
When the feature is on and the phone is somewhere unfamiliar, two rules apply.
Biometric only for sensitive actions. Viewing saved passwords, using a saved payment method in Safari, applying for a new card, turning off Lost Mode and erasing the device all require Face ID or Touch ID. There is no passcode fallback, so knowing the passcode gains nothing.
A security delay on the most damaging changes. Changing the Apple Account password, signing out, updating account security settings, adding or removing a face, turning off Find My or Stolen Device Protection itself all require biometric authentication, then an hour's wait, then a second biometric authentication.
That hour is the point. It is enough time for you to notice the phone is gone and put it in Lost Mode from another device.
The passcode is still the weak point
Stolen Device Protection reduces what a known passcode is worth. It does not make the passcode irrelevant, and the passcode itself is worth revisiting while you are in that settings screen.
Six digits is the current default and it is reasonable. Four digits is not, and a surprising number of phones are still on it from an older setup that carried forward through every upgrade since.
The better option is a custom alphanumeric code, under Passcode Options when you change it. It is slower to type, and you type it far less often than you think, because Face ID handles the routine unlocks and the passcode appears mainly after a restart or a failed scan.
The other half is where you type it. Almost every case of a stolen phone with a known passcode starts with someone watching it being entered in a public place. Shield the screen, or use Face ID in public and save the passcode for private moments.
Where familiar locations come in
The rules relax at places iOS recognises as familiar, typically home and work. That is a deliberate trade: security where risk is high, convenience where it is not.
You can switch this off. In the same settings screen, choose Always rather than Away from Familiar Locations, and the protections apply everywhere. If you are the sort of person who would rather wait an hour at your own kitchen table than have the exception exist, that is the setting to change.
This is the feature that actually protects the phone
It is worth being clear about the division of labour. A warning wallpaper is a message to a person: it tells an honest finder how to reach you and it makes casual curiosity less appealing. It does nothing to a determined thief, and no wallpaper on any phone ever has. The protection comes from the settings underneath: a strong passcode, Face ID, Find My, and this. Set them up once and the wallpaper can go back to being what you actually want it to be, which is a picture you like.
Turning it on
You need a passcode, Face ID or Touch ID, Find My, and two-factor authentication on your Apple Account. Most people already have all four.
Go to Settings, then Face ID and Passcode, enter your passcode, and scroll to Stolen Device Protection. Turn it on and choose whether it applies always or away from familiar locations.
It takes under a minute, and the cost in daily use is close to nothing, because in normal life you are authenticating with your face anyway.
What it does not do
It is worth being precise, because security features get oversold.
It does not stop someone using your phone if they have your passcode and you are standing there. It does not protect data in apps that have no separate lock. It does not prevent someone from taking the phone. And it does not help if you have no passcode set, or if Find My is off.
It also does not replace the basics: a passcode longer than four digits, notifications hidden on the lock screen, and Find My switched on with Send Last Location enabled.
Quick answers
Which iPhones support it?
Any iPhone running a recent version of iOS with Face ID or Touch ID. If you cannot see the option, check Settings, General, Software Update first.
Does the hour delay apply if I am at home?
Not by default, since home is usually a familiar location. Set it to Always if you want the delay everywhere.
What if my face is not recognised and I need to change something urgently?
You wait for the delay, or you make the change from another device signed into your Apple Account. That is the trade the feature makes.
Should I still hide notification previews?
Yes. This feature protects account changes and stored credentials. It does nothing about what is visible on a locked screen, which is a separate setting in Notifications.
Where to get it
Once the settings are handled, the lock screen is free to be something you want to look at. DON'T Touch Phone Wallpapers has warning and contact-line designs in HD, previewed in a phone-shaped frame so you can see how one sits under the clock.
Turn on Stolen Device Protection first. It is the minute that actually changes what someone can do with your phone.