⚠ Being locked out of your phone can be a safety risk in an emergency. Consider having a backup way to contact emergency services.

Locking You Out of Your Devices

Someone locks you out of your own phone, tablet, or computer — by changing the passcode, using remote lock features, or triggering factory resets.

What You Might Notice

Your device passcode suddenly stops working
The password, PIN, or biometric you set has been changed.
Your device has been remotely wiped or reset
All your data, photos, and apps are gone.
You receive a message saying your device is locked
Features like 'Find My iPhone' or 'Find My Device' can be used to remotely lock a device.

What You Can Do

This is not an exhaustive list. Every situation is different — use what applies to yours.

Contact your device manufacturer's support
Apple, Samsung, and Google all have processes for recovering locked devices.
Use a different device to secure your cloud accounts
If your phone is locked, secure your iCloud, Google, or Microsoft accounts from another device immediately.
Keep your cloud account credentials separate and private
The person who controls your iCloud or Google account can remotely control your device.

ID: SAFE-T-0086

Sub-techniques: No sub-techniques

Tactic: Account & Access Compromise

Created: 04 February 2026

Last Modified: 07 March 2026

Important: Always consider your physical safety first.

This resource provides general information, not personal advice. Every situation is different. The actions suggested here may not be safe in your specific circumstances particularly if the person causing harm could notice changes to your devices or accounts.

If you need personalised support, contact 1800RESPECT (1800 737 732) or your local specialist domestic violence service. If you are in immediate danger, call 000.

This framework is under active development. View full limitations & methodology.

Device Lockout

Remotely locking victim's phone, tablet, or computer through device management features such as Find My iPhone, Google Find My Device, or enterprise MDM tools. Can render devices completely unusable, cutting victim off from communication, navigation, banking, and emergency services.

ID: SAFE-T-0086

Sub-techniques: No sub-techniques

Tactic: Account & Access Compromise

Created: 04 February 2026

Last Modified: 07 March 2026

Mitigations

ID	Mitigation
SAFE-M-0048	Remote Management Removal Remove device from adversary's Find My/Find My Device account.
SAFE-M-0049	Account Migration Migrate device to sole-controlled Apple ID or Google account. Factory reset if required.

Detection Indicators

ID	Detection Indicator
SAFE-D-0045	Remote Lock Activation Device displays lock screen or lost mode message without user action.
SAFE-D-0046	Remote Wipe Execution Device factory resets without user initiation.

The TFA Matrix is a research framework under active development. Technique classifications, detection methods, and mitigations reflect current understanding and are subject to revision. This framework does not constitute forensic methodology, legal evidence standards, or clinical diagnostic criteria. Practitioners should apply professional judgement appropriate to their discipline and jurisdiction.

Full limitations, methodology & responsible use statement.