Ask Different is a question and answer site for power users of Apple hardware and software. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

A few minutes ago, after unlocking my phone (iPhone 4, iOS 7.0.1) I got a dialog over the home screen:

Passcode Requirement

You must change your passcode within 60 minutes

and it offered to let me do so. I canceled. I've never seen this dialog before and I am worried it may be a sign of malware fishing for my passcode. Even on iOS 9.1, this dialog still happens:

enter image description here

There is very little on Google about this message, but what there is is:

I changed my passcode manually, but am still worried about the source of the dialog and why it appeared. Is there a definitive answer?

share|improve this question
    
If you are unsure this is malware, change your password manually using system configuration instead of that dialog box. – Daniel777 Mar 30 at 21:41
    
@Daniel777 I did at the time (see the last paragraph), but the point is to find out if it was malware at all. If it was, there would have been bigger issues at hand than changing a password. – David M Apr 1 at 16:57
    
I changed the password manually (via system preferences) and the password change request dissapeared. That's how I figured out that it was not malware. – Daniel777 Apr 4 at 5:32
    
I just saw this on iOS 9.3. (I had never seen it before.) I ignored it, and it alerted me three more times, the last of which said "You must change your iPhone unlock passcode within 4 minutes". I ignored that still, have not changed my passcode since, and have not seen another alert since. I am not using MDM or Exchange, nor do I have an obvious passcode (though it is only 4 digits). In my opinion this is still an unsolved mystery. – leekaiinthesky Jun 12 at 22:53
up vote 19 down vote accepted

This message is the case when either:

See image here

Obvious codes start with the following numbers:

  • 196*
  • 197*
  • 198*
  • 199*
  • 200*
  • 201*

But also include:

  • 1234
  • 0000 (or any 4 same number combination)
  • 0001 or 0010 or 0100 or 1000 (or any number with this pattern)
  • 1379
  • 2580
  • 2468
share|improve this answer
2  
I don't have MDM set up. What is "too obvious"? I don't want to write it here, of course, but it was not a code that seemed (to me) to be obvious. It wasn't a pattern like "1234" or "2580" or anything, for example. – David M Mar 18 '14 at 12:56
1  
You list these as definitive cases. Source? I'm seeing this, too, and don't think that any of the cases particularly apply. My personal suspicion is that iOS is just ramping up security practices over time. Which isn't a bad thing, but... Might be good if there was some messaging around it, before getting this! – lindes Nov 14 '15 at 3:47
3  
What's puzzling is what triggers this presumed reevaluation of what a secure pin code might be and also the number of people that reported having a six digit pin but being able to reset a four digit pin when this prompt is presented to them. – bmike Nov 14 '15 at 17:15
2  
I just saw this on ios9.3. I have an alphanumeric passcode, though it does contain a dictionary word. Odd, this is the first I've ever seen the dialog and I've been using that password for a bit. – Rich Homolka Mar 28 at 2:48
5  
I don't think this answers the question. Where does apple state that it enforces a policy like "Your passcode is too obvious and needs to be changed" David M said that he was not using MDM, and many people with the same issue have said the same (as links in this thread show). This question still needs to be resolved. – erikvold Apr 13 at 5:22

Go to Settings app > General > Profiles

  • Delete any configuration profile that you don't want to keep, then delete any that control passcode.
  • If Profiles is not near the end of the list (below VPN and above Reset >) then you may have no profiles and can continue to the next step.

Next, go to Settings app -> Passcode

  • enter your passcode, turn passcode off, then set it up again

Lastly, Exchange servers can institute a passcode requirement, so you might disable any Exchange mail accounts - temporarily removing them from the device to see if the Exchange server was sending the message or setting any requirements. I don't know if this sets a profile or not, but will edit things if I can find a reference to how this works in practice.

You can choose your same pin again, but the OS will likely want to keep reminding you that a change is required until you clear the "warning". Enough people have reported that just "changing" the passcode doesn't work that something must be up.

If you have jailbroken the device, I might consider rolling back to a stock iOS for a bit and choosing an entirely more complicated passphrase for a while just in case it is some phishing attempt. Just because this is considered to be very unlikely doesn't make it impossible.

share|improve this answer
3  
Thanks bmike. I haven't jailbroken, nor have I got Exchange set up, nor is there a Profiles option in my General settings. I have manually changed my passcode already as a precaution, but there was nothing on that page of the Settings that indicated I needed to change it. – David M Mar 18 '14 at 13:17
2  
@DavidM When iOS prompts for a change in the pin, you don't see anything in the settings app. Just that nagging pop-over and no other visible sign. You did your homework well, so I wanted to reinforce that it could be something odd and put the "expected" behavior into concrete words and steps. I don't doubt you are clear of profiles (or at least they aren't showing in the UI). My suspicion is your change will dismiss the warning and you don't need to remove the pin as I described. – bmike Mar 18 '14 at 14:01
1  
The warning hasn't reoccurred, so I think you're right - changing seems to have dismissed it. I can relax :) – David M Mar 18 '14 at 14:26
    
No profiles on iPhone. Changed password following guidelines above. Now "Trust This Computer?" comes up, with the message "Your settings and data will be accessible from this computer when connected." So, what now? – user121090 Apr 7 '15 at 20:06
1  
upvoted because this should be the correct answer, since there's steps here to resolve it. quite disconcerting to have your phone demanding to make you change your passcode... this officially freaked me out – enorl76 Mar 16 at 18:56

I had this problem tonight too. I "bit" before I thought it being malware, but it doesn't seem to have been malware. I changed my PIN and the phone reset, then the new PIN worked. BUT... the phone immediately asked for me to change the PIN again... now I was thinking Malware. I kept changing the PIN and it kept asking me to do it again. I used the tip earlier in this thread about too simple of a PIN and tried a 9 digit PIN and that worked, the message didn't return. Funny thing is that after, I was able to go into settings and set the PIN back to the 4 digit PIN that I had originally, no further messages.... yet.

share|improve this answer

protected by Community Jul 27 '15 at 16:40

Thank you for your interest in this question. Because it has attracted low-quality or spam answers that had to be removed, posting an answer now requires 10 reputation on this site (the association bonus does not count).

Would you like to answer one of these unanswered questions instead?

Not the answer you're looking for? Browse other questions tagged or ask your own question.