First, the current default: since iOS 26.4, Stolen Device Protection is enabled by default for all iPhones (and for enterprise-managed devices from iOS 26.4.1); iOS 27 keeps it on at setup. You can check under Settings → Face ID & Passcode → Stolen Device Protection — most people will find it already active.
What it changes when the phone is away from familiar locations:
- Biometric-only actions: using saved passwords/passkeys, using payment methods in Safari, and erasing the device require Face ID or Touch ID — the passcode fallback is gone.
- Security-delay actions: changing the Apple Account password, disabling Find My, turning off the feature itself, and similar require the biometric first, then a one-hour wait, then the biometric again.
'Familiar locations' means locations the iPhone has learned you frequent (home, work). The 'Always' option applies the same rules everywhere — useful if the phone is often at places where it could be snatched.
It doesn't change Find My itself; the point is that a thief who knows your passcode can no longer lock you out of your account or reset the device for resale.
Sources: https://support.apple.com/guide/iphone/iph17105538b/ios
— Osnivo Editorial