The documented crime works like this: a thief in a bar watches over your shoulder while you type your passcode, then takes the phone. Not to sell it. To use it, because the passcode unlocks everything: Apple or Google account, saved passwords, payment apps, and the email inbox where every other account's reset flows. Phones became wallets, then became the whole vault, and most people still secure them like they were phones.
The passcode is the perimeter
Everything downstream trusts the passcode, so start there. Six digits minimum, or better, an alphanumeric one, and enter it like a PIN at a cash machine: shielded, especially anywhere public. Use Face ID or fingerprint for daily unlocking precisely so the passcode itself is typed rarely and observed never. The shoulder-surf attack needs two things, the code and then the phone; deny the first and the second is just a robbery, covered by insurance, instead of a takeover, covered by nothing.
Both platforms have added a second wall for exactly this scenario: on iPhone, turn on Stolen Device Protection, which requires biometrics, with a time delay, for dangerous actions like changing the Apple ID password from an unfamiliar location. Android's theft protection features do similar work. These settings exist because the bar theft became common enough to engineer against. Turn them on.
The doors people forget
The SIM has its own lock. A thief who moves your SIM to another phone inherits your number and every text code it receives, no carrier social engineering required. Enable the SIM PIN in your phone's settings so the card is useless outside your device.
The lock screen leaks. Notification previews happily display incoming verification codes on a locked phone, letting someone reset your accounts while the phone sits locked in their hand. Hide notification content on the lock screen for messages and email.
Find My works before the theft, not after. Location tracking and remote wipe must already be on to matter. Verify now: it is two minutes, and it is the difference between erasing the vault remotely and imagining its contents for weeks.
- Six-digit or alphanumeric passcode; biometrics for daily use; shield the code in public.
- Stolen Device Protection (iPhone) or theft protection (Android): on.
- SIM PIN: on.
- Lock-screen notification previews: hidden for messages and email.
- Find My and remote wipe: verified working, today.
If the phone is gone
Order matters and speed matters. From any other device: mark it lost and wipe it via Find My, change your Apple or Google password, then your email password, then call the carrier to kill the SIM before text codes leak to whoever holds it. Then banks and payment apps. A phone with the five settings above survives this list as an inconvenience. A phone without them is the reason this guide exists.