Identity Check: Stop Thieves from Bypassing Your Biometrics
Here is a nightmare scenario: a thief watches you enter your PIN, snatches your phone, and uses the PIN to reset your fingerprint, change your Google password, and lock you out of everything. Your biometrics meant nothing because the PIN overrode them. Identity Check on Android exists to close exactly this hole. This guide explains Identity Check Android setup, trusted places, and how Identity Check Android fits into your theft-protection stack.
This guide explains how Identity Check works, what it protects, how to set it up with trusted places, and how it fits with Android’s other theft protections.
Identity Check and Shared Devices
Identity Check assumes one person per phone — shared devices need thought. On a family tablet or shared work phone, trusted locations do most of the work: at home or the office, the PIN suffices and everyone operates normally. Outside trusted places, whoever holds the phone needs enrolled biometrics to change security settings — so enroll the biometrics of each legitimate user, or accept that security changes wait until the device returns to a trusted location. For most shared devices this is fine, since security-setting changes are rare events.
The edge case to plan for: a shared device used by someone whose biometrics are not enrolled, traveling outside trusted locations, needing an urgent security change (like disabling a compromised account). The fallback is the Google account password — make sure at least one responsible person knows it and can enter it. Write it down and store it physically; “the password is in the password manager on the phone we cannot unlock” is a circular failure. Shared devices concentrate this risk, so the written backup matters more, not less.
Also note: Identity Check’s protection follows the device, not the account. If a family member signs their account into your phone, your phone’s Identity Check still guards the system settings — their account’s app-level security is their own responsibility. Device-level and account-level protections are separate layers; this toggle is the device layer.
Identity Check: Quick Answers
Does it work with a VPN? Yes — trusted locations use GPS/Wi-Fi positioning, not IP geolocation, so VPNs do not confuse it.
What if I move house? Update trusted locations the day you move. Until you do, your old home’s geofence still counts as trusted — a genuine security gap worth closing promptly.
Can I add more than two trusted locations? Yes — add as many as you need (gym, partner’s place), but each one is a place where the PIN alone suffices, so keep the list short and current.
Setting Up Identity Check in Two Minutes
Open Settings > Security > Identity Check and flip the toggle. Add trusted locations first: your home and workplace, with a geofence the phone suggests (roughly 100-200 meters — tight enough to matter, loose enough to survive GPS drift). Confirm your biometrics are enrolled and working — Identity Check leans on them entirely outside trusted places. Then test it: leave your trusted location (a walk around the block works), try changing a protected setting like disabling Find My Device, and confirm the phone demands your fingerprint instead of accepting the PIN. If it accepts the PIN, the trusted-location geofence is wider than you think — tighten it. Two minutes of setup, one walk around the block to verify, and the most common phone-theft attack chain is broken.
When you travel, update trusted locations before you leave — or accept the mild friction of biometric checks for security changes on the road. The friction is the feature: every time the phone asks for your fingerprint instead of your PIN outside trusted places, that is the attack it was built to stop, failing against you instead of succeeding against a thief.
Identity Check FAQ
Which devices have Identity Check? Pixel 6 and newer, plus recent Samsung flagships (S23+ generation onward) running current software. Mid-range and older phones do not have it — check under Settings > Security for the toggle.
What counts as a trusted location? Places you add manually, typically home and work. The phone uses a geofence of roughly 100-200 meters. Update trusted locations when you move — stale ones create exactly the bypass the feature is meant to prevent.
What if biometrics fail while traveling? The fallback is your Google account password, not your PIN — deliberately, since the whole point is that the observed PIN is compromised. Make sure you actually know your Google password before traveling.
Does it protect banking apps? Indirectly — it protects the system settings a thief needs (disabling Find My Device, changing account passwords). Banking apps have their own biometric requirements; enable those separately in each app.
Can a thief just turn Identity Check off? Turning it off is itself a protected action requiring biometrics outside trusted locations. The protection is self-defending by design.
How Identity Check Changes Theft Scenarios
Identity Check (Settings > Security > Identity Check on supported Android 15+ devices) targets a specific attack: a thief who watched you enter your PIN, then steals the phone and changes your Google password to lock you out. With Identity Check enabled and a trusted location set (like home), changing critical security settings outside trusted locations requires biometric authentication — the PIN alone is no longer enough. That single rule breaks the entire attack chain, because the thief’s observed PIN becomes useless for the steps that matter.
The protected actions include changing your Google account password, removing the screen lock, disabling Find My Device, and factory-resetting the phone. Each requires your fingerprint or face outside trusted places. Setup takes two minutes: enable the toggle, add your home and work as trusted locations, and enroll biometrics if you have not. The failure mode to know: if you travel without updating trusted locations, you will need biometrics for security changes on the road — mildly annoying, exactly as designed.
What Identity Check Does Not Cover
Important limits: it does not encrypt anything new, it does not help if the thief forces your finger onto the sensor, and it only works on devices that received the feature (Pixel 6+ and recent Samsung flagships as of 2026). It also does nothing about SIM-swap attacks on your accounts — pair it with a SIM PIN and app-based 2FA for full coverage. And if your biometrics fail repeatedly (wet fingers, face masks), the fallback is your Google account password, so make that password strong and unique — the whole system leans on it.
The Attack Identity Check Stops
identity check android illustration
Modern phone theft is not about the hardware; it is about the accounts. The attack chain:
Thief shoulder-surfs your PIN (at a bar, on transit, in a café).
Thief steals the phone.
With the PIN, the thief changes your biometrics, resets account passwords, disables Find My Device, and drains financial apps.
You are locked out of your own digital life while the thief operates freely.
Before Identity Check, a stolen PIN was nearly a master key. Apple introduced a similar feature (Stolen Device Protection) for the same reason. Identity Check is Android’s answer.
How Identity Check Android Works
When your phone is outside your trusted places, Identity Check requires biometric authentication (not just the PIN) for sensitive actions:
Changing your PIN, pattern, or password.
Enrolling new biometrics or deleting existing ones.
Turning off Find My Device or Theft Protection.
Accessing saved passwords and passkeys.
Changing critical Google account security settings.
Factory resetting the device.
Inside trusted places (your home, office), the PIN still works normally for convenience. Outside them, biometrics become mandatory for security-critical changes. A thief with your PIN but not your face or finger hits a wall.
Setting Up Identity Check
Open Settings, Security & privacy (or Google, Theft protection on some builds).
Tap Identity Check and turn it on.
Add trusted places: your home and workplace addresses. Be precise; the geofence matters.
Enroll biometrics if you have not: fingerprint and/or face.
Test it: leave home and try changing a security setting. You should be prompted for biometrics, not just the PIN.
Requirements: a recent Android version (Pixel and Samsung flagships first, expanding with Android 15/16), a screen lock, and enrolled biometrics.
Identity Check Android Setup Tips
Getting Identity Check Android configured correctly the first time avoids headaches later. First, enroll at least two fingerprints (different fingers) so a cut or bandage does not lock you out of your own security settings. Second, add trusted places while physically at those locations so the geofence centers accurately. Third, after enabling Identity Check Android, deliberately test it away from home: try accessing your saved passwords and confirm biometrics are required. A feature you have never seen trigger is a feature you cannot rely on.
Trusted Places: Getting Them Rightidentity check android illustration
Trusted places are the convenience valve. Set them thoughtfully:
Add home and work with accurate addresses. Verify the pin on the map.
Do not add bars, friends’ houses, or anywhere you regularly enter your PIN in public.
Review periodically: moved house or changed jobs? Update immediately. A stale trusted place is a hole.
Travel: when traveling, you have no trusted places, which is exactly when Identity Check protects you most.
What Identity Check Does Not Do
It does not stop the thief from using the unlocked phone. If they snatch it while unlocked, they have access until it locks. That is what Theft Detection Lock addresses.
It does not protect against coercion. Someone forcing your finger onto the sensor bypasses it. Use Lockdown mode in confrontational situations.
Together, they make a stolen phone a brick that cannot be repurposed against you.
Why Identity Check Android Matters More Than Ever
Phone theft has professionalized. Thieves now work in teams: one watches for PIN entry, another snatches the device, and the proceeds come from drained bank accounts and hijacked identities, not resold hardware. Identity Check Android was designed for exactly this reality. Before it, every other protection could be undone with four observed digits. With Identity Check Android enabled, the stolen PIN loses its power the moment the thief leaves your trusted places, which is precisely when they need it most.
A security feature requiring biometric authentication (instead of just PIN) for sensitive actions like changing your lock, biometrics, or account settings when you are outside trusted places.
How is Identity Check different from a screen lock?
The screen lock keeps strangers out. Identity Check assumes the thief already knows your PIN and blocks them from using it to take over your accounts and security settings.
Do I need Identity Check if I have a strong PIN?
Yes. The attack it stops begins with the thief learning your PIN by watching you. No PIN survives shoulder surfing; Identity Check makes the stolen PIN far less useful.
What counts as a trusted place?
Addresses you designate (home, work) where PIN-only authentication remains for convenience. Everywhere else requires biometrics for sensitive changes.
Will Identity Check annoy me daily?
Barely. At home and work nothing changes. Only when changing security settings away from trusted places will you notice the biometric requirement, which is infrequent.
Which phones support Identity Check?
Pixel devices and recent Samsung flagships first, expanding with Android 15 and 16. Check Settings, Security & privacy for the option.
Conclusion
Identity Check closes the most dangerous gap in phone theft: the stolen PIN becoming a master key. Turn it on, set trusted places carefully, enroll biometrics, and layer it with Theft Detection Lock and remote lock.
Thieves evolved past the lock screen. Your defenses should too. Enabling Identity Check Android takes five minutes and permanently removes the highest-leverage attack in modern phone theft.
Qamar Abbas is the founder and CEO of Qamar Digital Ventures LLC, a New Mexico-based web design and SEO agency. He writes hands-on, research-backed guides about Android apps, APK guides and mobile how-tos for a US audience, tested on real devices and updated regularly.
What do you think?
Share your experience or ask a question. A useful conversation starts with you.
Join the discussion