Your iPhone was stolen

Right now

1. Mark it as lost at icloud.com/find. Apple says you don’t need a verification code there, so it works even when the stolen phone is your trusted device, and that Lost Mode locks the phone and blocks changes to your Apple Account.
2. Leave out your phone number and message. For a stolen phone, Apple advises against them, because they can help a thief run scams.
3. Mark it lost even if Stolen Device Protection is on. Apple says its extra safeguards only last for a limited time.

Report it

• To the police. Apple says they may ask for the serial number, which you can find without the phone.
• To your carrier, to suspend your line, and ask about a claim if your plan covers the phone (Apple).
• If the map shows it somewhere you don’t know, don’t go there yourself. Apple says to contact local law enforcement instead.

If the thief saw your iPhone passcode

This is the case that matters for your photos. With the passcode, the camera roll is open.

Stolen Device Protection only helps if it was on before the theft. Away from familiar places it asks for Face ID or Touch ID, with no passcode fallback, for saved passwords, payments, erasing the phone and opening a locked app. So if you had locked Photos, the passcode alone didn’t open it there. A Photos app left unlocked isn’t on that list. The Stolen Device Protection guide goes further.

Your vault has its own gate, and how strong it is depends on how you set it up:

• Own passcode only: Sealed has a passcode of its own, a gate inside the app that is separate from your iPhone passcode.
• Face ID unlock on, the standard way: With plain Face ID unlock on, someone who knows your iPhone passcode can open Sealed through the Face ID prompt. In iOS, an app that asks for owner authentication gets Face ID or Touch ID first, and the device passcode when biometry isn’t available or the person taps the fallback button.
• Dual Lock on: Dual Lock asks for your passcode and a Face ID match together, and it is part of Sealed Pro. Dual Lock’s second step takes Face ID or Touch ID only: your iPhone passcode can’t stand in for it, so one watched passcode can’t do both halves.
• Maximum Security on: Maximum Security seals your vault key to a Secure Enclave key that can be used only after a live Face ID or Touch ID match. Maximum Security is part of Sealed Pro.

The guide to choosing how to unlock weighs these, and the Dual Lock and Maximum Security pages show each one.

In the next hours

1. Review your Apple Account from another trusted device. Apple suggests checking the device list and Sign-In & Security, and changing your password if you see changes you didn’t make.
2. Change any password you kept in a plain note or a screenshot. Passwords kept as records in a vault are sealed. Names, notes and the fields of a record are sealed with your vault key too, not just the photos.
3. Leave the phone in Find My. Apple says removing it also removes Activation Lock, which makes it easier to resell.

When you’ve given up on it

1. Erase it remotely. Apple says an erase can’t be undone, and an offline phone erases when it next connects.
2. Restore the vault on your new iPhone. On a fresh install, the first screen has a Restore a backup button, you enter the recovery key you saved, and your files are decrypted only on that iPhone. A restore needs the new iPhone to be signed in to the Apple Account you backed up with, and a connection. The lost iPhone page has the same restore in more detail.
3. Make a new recovery key if the old one was on the stolen phone, in a note or a photo. You can make a new recovery key in Settings; the current one keeps working until the new one is saved and your next backup finishes, and anyone with the old key and an old copy of your backup could still open that copy.

Where Sealed helps, and where it doesn’t

It helps by putting a second, separate lock in front of private photos. Your passcode is a gate in front of the app. It is not part of the key. With the limit left at three, a person who only types guesses on the lock screen can make at most 4 tries in the first minute, 7 in the first hour and 30 in the first day, and from the seventh wrong try on the pace is one try an hour.

It helps most with Dual Lock or Maximum Security, which a watched passcode can’t open alone. With Maximum Security on, every unlock ends with a live Face ID or Touch ID match that releases your vault key.

It doesn’t protect what is still in your camera roll. Until you delete them, the originals stay in Photos, outside the vault.

It doesn’t bring back items that never reached the backup. Once the key is back, Sealed shows your notes and records, brings photos and videos back from iCloud as you open them, and says plainly that items never backed up to iCloud stayed on the old iPhone and cannot be restored on the new one.

It doesn’t lock or locate the phone. That is Find My, from Apple.