How to Know If Someone Tried to Open Your Phone

Most people who wonder whether someone has been through their phone never find out. There is nothing to check. The phone looks exactly the same afterwards.

Break-in alerts change that: every failed attempt on your vault is recorded, with a photo of whoever made it.

What your iPhone already knows, and won't tell you

iOS counts failed passcode attempts. That is how escalating lockouts work — a minute, then five, then an hour. The count exists.

You just never see it. There is no log, no notification, no screen listing attempts. The information is used to slow an attacker down, not to inform you. Unless you happen to pick up your phone during a lockout, someone can try your passcode a dozen times and you will never know.

For a lost phone that is fine. For the far more common situation — a phone that never left the house, and someone in it who had a few minutes alone — it is the wrong design.

What a break-in alert records

Apps can't monitor the iOS device passcode. But an app with its own passcode can watch its own lock screen, and that's where the useful signal is: someone who picks up an unlocked phone and hits a vault they didn't expect.

When a wrong code is entered, the app records:

• A photo from the front camera, taken at the moment of the failure
• The time of the attempt
• How many attempts were made

The photo matters more than it sounds. A timestamp tells you something happened at 3:47am. A photo tells you who was holding it — which is usually the actual question.

The point is knowing, not catching

It's tempting to frame this as catching someone. In practice it more often does the opposite, and that is the more valuable outcome.

If you have wondered whether a phone has been gone through, the wondering itself is the problem. It doesn't resolve. An empty attempt log after a few weeks is a real answer, and usually a reassuring one.

When there is something in the log, you get specifics instead of suspicion: a time, a face, a count. What you do with that is a separate decision, but you are making it with information rather than a feeling.

Turning it on

In Safey, break-in alerts are on by default and free. Any failed attempt on your vault passcode is captured, and attempts appear under Settings → Break-in Attempts with the photo and timestamp.

Two things worth checking:

• Camera permission. Without it the attempt is still logged, but with no photo — which loses most of the value.
• Your own habits. Mistyping your own code creates an entry too. A photo of yourself looking puzzled is a normal first log entry.

What it doesn't cover

Break-in alerts watch one door. They record failures against your vault's passcode — not your iOS device passcode, which no third-party app can monitor, and not someone who already knows your code and simply opens it.

That last one is the real limit, and it's why the feature pairs with a decoy passcode. Alerts tell you when someone tried and failed. A decoy code covers the case where they don't have to try at all, because they've asked you to open it.