iOS 17.3 puts two gates between a passcode and account changes

Apple’s iOS 17.3 adds a distinction that matters after an iPhone theft: knowing the device’s passcode doesn’t necessarily authorize changes to the credentials that control it. Stolen Device Protection, introduced with the January 22 update, adds biometric checks to selected actions and a second, delayed check to particularly sensitive account and device changes.

It isn’t a blanket replacement for the passcode. The feature is optional, and its launch design depends on whether the phone recognizes a familiar location, such as home or work. The practical question isn’t simply whether the handset can be unlocked. It’s which action someone is trying to perform, and under what conditions.

File photo: Apple logo on an iMac, © Håkan Dahlström, 2010. CC BY 2.0, via Wikimedia Commons. Resized and cropped; this isn’t an iPhone or iOS 17.3 screenshot.

Accessing credentials and changing them are different gates

Apple’s iOS 17.3 release notes distinguish two protections. Some actions require Face ID or Touch ID without a passcode fallback. Others require a successful biometric check, a one-hour wait and another successful biometric check before the operation can finish.

That second check matters. The delay isn’t just a countdown after which possession of the phone and its passcode becomes sufficient. Apple expressly requires biometric authentication again. Nor is it described as an hour-long lock on every use of the phone; it applies to selected sensitive operations.

The launch-day MacRumors account identifies using passwords or passkeys saved in iCloud Keychain, using payment methods saved in Safari, turning off Lost Mode and erasing all content and settings among the biometric-only actions. These are examples of protected operations, not a claim that every app or financial transaction receives the same treatment.

Changing the Apple ID password or the iPhone passcode goes into the delayed category. The contemporaneous account also identifies adding or removing Face ID or Touch ID and turning off Stolen Device Protection. Together, these controls distinguish using already-stored credentials from changing the authentication arrangements that could make continued account access possible.

Location is part of the original design

In the initial release, familiar locations affect when the additional safeguards apply. Contemporary reporting describes the extra checks away from recognized locations and says the security wait isn’t required at familiar places such as home or work. That’s a boundary of the launch feature, not a guarantee that every sensitive action everywhere has gained a new hour-long delay.

Installing iOS 17.3 and enabling Stolen Device Protection are also separate steps. The launch feature is opt-in in the Face ID & Passcode or Touch ID & Passcode settings. It adds protection to specified operations once enabled; it doesn’t promise that a stolen phone will be recovered or that every account accessible from it is protected by the same checks.