The account comes first

The single biggest security mistake with a kid's iPhone: signing them into a parent's Apple ID. Suddenly the child holds your email, your contacts, your photos, your message history, and your payment method — and you hold their app library on your work phone. Nothing about that is secure.

Give the child their own Apple Account. If they're under 13, that means a Child Account created through Family Sharing: a real account, owned by the child, managed by you. If they're older, they create their own account and you invite it into the family group.

The full account walkthrough — email, password, recovery, the works — is covered in our parental controls guide and in how to set up a child's first iPhone. If you haven't done this part yet, start there; everything below assumes the child is signed in with their own account.

Lock the device itself

Three settings, five minutes:

  • A six-digit passcode. Not their birthday, not 123456, not the same code as your phone. Settings → Face ID & Passcode → Turn Passcode On. Kids share codes with best friends; assume this one will be shared too, and pick accordingly.
  • Face ID or Touch ID. It's faster than a code, which means the child actually locks the phone instead of leaving it open. Same screen as the passcode.
  • Auto-Lock. Settings → Display & Brightness → Auto-Lock, one minute. A phone that locks itself is the only phone that's reliably locked.

Turn on Find My

Settings → [Child's Name] → Find My → Find My iPhone. Leave the Find My network on as well — it lets the phone be located even when offline.

What you get: play a sound on a phone lost in a couch, see it on a map, mark it as lost, or — the last resort — erase it remotely. What you owe in return: if you're going to use location within the family, say so. "We can all see where the phones are" is a family feature. "I track you and you didn't know" is surveillance, and teenagers can tell the difference.

Keep the software current

Settings → General → Software Update, and turn on automatic updates in the same place. Most iOS updates close holes that researchers actually found in the wild — an unpatched iPhone is a door with a published key. This is the least glamorous and most underrated security setting on the device.

Set up account recovery

Kids forget passwords at impressive speed. Settings → [Child's Name] → Sign-In & Security → Account Recovery → Add Recovery Contact — pick yourself. A forgotten password becomes a five-minute fix instead of a lost account.

Secure the settings themselves

All the limits and filters you'll configure in Screen Time hold up exactly as well as the passcode protecting them:

  • The Screen Time passcode is set on your device, not the child's — open Settings → Family → [Child's Name] → Screen Time on your iPhone and follow the prompts. Apple requires the parent's device for the new parental controls in iOS 27.
  • Make the Screen Time passcode different from the device passcode. If they share digits, the child knows both.

The five-minute monthly check

Put a recurring calendar reminder on the first of the month: iOS version current, Find My still on, passcodes still secret, recovery contact still set. Five minutes, done. Security isn't a project; it's a habit.

This covers the doors and locks. The limits, filters, and schedules that sit on top of them are their own subject — the full reference lives in our parental controls guide, and the broader device-level audit is in how to make an iPhone safe for kids.

When the phone goes missing

The security settings above are the prevention; Find My is the response. The flow, in order of escalation:

  1. Play a sound — for the phone between couch cushions and under piles of homework. Embarrassing, effective, free.
  2. Mark as Lost — locks the screen with a message and a contact number, suspends Apple Pay, and keeps location flowing. For the phone that left the house.
  3. Erase remotely — the last resort: the data is gone, the lock stays, and a message can still show the finder how to reach you.

What makes all three work: Find My was on before the phone was lost. There is no setting you can enable on a phone you no longer have — which is why it's on this checklist and not in the "when it happens" section.