64

A few minutes ago, after unlocking my phone (iPhone 4, iOS 7.0.1) I got a dialog over the home screen:

Passcode Requirement

You must change your passcode within 60 minutes

and it offered to let me do so. I canceled. I've never seen this dialog before and I am worried it may be a sign of malware fishing for my passcode. Even on iOS 9.1, this dialog still happens:

enter image description here

There is very little on Google about this message, but what there is is:

I changed my passcode manually, but am still worried about the source of the dialog and why it appeared. Is there a definitive answer?

Improve this question
6
  • 3
    If you are unsure this is malware, change your password manually using system configuration instead of that dialog box.
    – Daniel777
    Commented Mar 30, 2016 at 21:41
  • @Daniel777 I did at the time (see the last paragraph), but the point is to find out if it was malware at all. If it was, there would have been bigger issues at hand than changing a password.
    – David
    Commented Apr 1, 2016 at 16:57
  • I changed the password manually (via system preferences) and the password change request dissapeared. That's how I figured out that it was not malware.
    – Daniel777
    Commented Apr 4, 2016 at 5:32
  • I just saw this on iOS 9.3. (I had never seen it before.) I ignored it, and it alerted me three more times, the last of which said "You must change your iPhone unlock passcode within 4 minutes". I ignored that still, have not changed my passcode since, and have not seen another alert since. I am not using MDM or Exchange, nor do I have an obvious passcode (though it is only 4 digits). In my opinion this is still an unsolved mystery.
    – leekaiinthesky
    Commented Jun 12, 2016 at 22:53
  • @Daniel777 That would not prove it's not malware, although it might lessen the likelihood of it being malware
    – Bradley Thomas
    Commented Nov 24, 2016 at 18:47

3 Answers 3

Reset to default
25

This message is the case when either:

See image here

Obvious codes start with the following numbers:

  • 196*
  • 197*
  • 198*
  • 199*
  • 200*
  • 201*

But also include:

  • 1234
  • 0000 (or any 4 same number combination)
  • 0001 or 0010 or 0100 or 1000 (or any number with this pattern)
  • 1379
  • 2580
  • 2468
Improve this answer
14
  • 2
    I don't have MDM set up. What is "too obvious"? I don't want to write it here, of course, but it was not a code that seemed (to me) to be obvious. It wasn't a pattern like "1234" or "2580" or anything, for example.
    – David
    Commented Mar 18, 2014 at 12:56
  • 1
    You list these as definitive cases. Source? I'm seeing this, too, and don't think that any of the cases particularly apply. My personal suspicion is that iOS is just ramping up security practices over time. Which isn't a bad thing, but... Might be good if there was some messaging around it, before getting this!
    – lindes
    Commented Nov 14, 2015 at 3:47
  • 3
    What's puzzling is what triggers this presumed reevaluation of what a secure pin code might be and also the number of people that reported having a six digit pin but being able to reset a four digit pin when this prompt is presented to them.
    – bmike ♦
    Commented Nov 14, 2015 at 17:15
  • 2
    I just saw this on ios9.3. I have an alphanumeric passcode, though it does contain a dictionary word. Odd, this is the first I've ever seen the dialog and I've been using that password for a bit.
    – Rich Homolka
    Commented Mar 28, 2016 at 2:48
  • 9
    I don't think this answers the question. Where does apple state that it enforces a policy like "Your passcode is too obvious and needs to be changed" David M said that he was not using MDM, and many people with the same issue have said the same (as links in this thread show). This question still needs to be resolved.
    – erikvold
    Commented Apr 13, 2016 at 5:22
15

Go to Settings app > General > Profiles

  • Delete any configuration profile that you don't want to keep, then delete any that control passcode.
  • If Profiles is not near the end of the list (below VPN and above Reset >) then you may have no profiles and can continue to the next step.

Next, go to Settings app -> Passcode

  • enter your passcode, turn passcode off, then set it up again

Lastly, Exchange servers can institute a passcode requirement, so you might disable any Exchange mail accounts - temporarily removing them from the device to see if the Exchange server was sending the message or setting any requirements. I don't know if this sets a profile or not, but will edit things if I can find a reference to how this works in practice.

You can choose your same pin again, but the OS will likely want to keep reminding you that a change is required until you clear the "warning". Enough people have reported that just "changing" the passcode doesn't work that something must be up.

If you have jailbroken the device, I might consider rolling back to a stock iOS for a bit and choosing an entirely more complicated passphrase for a while just in case it is some phishing attempt. Just because this is considered to be very unlikely doesn't make it impossible.

Improve this answer
5
  • 3
    Thanks bmike. I haven't jailbroken, nor have I got Exchange set up, nor is there a Profiles option in my General settings. I have manually changed my passcode already as a precaution, but there was nothing on that page of the Settings that indicated I needed to change it.
    – David
    Commented Mar 18, 2014 at 13:17
  • 2
    @DavidM When iOS prompts for a change in the pin, you don't see anything in the settings app. Just that nagging pop-over and no other visible sign. You did your homework well, so I wanted to reinforce that it could be something odd and put the "expected" behavior into concrete words and steps. I don't doubt you are clear of profiles (or at least they aren't showing in the UI). My suspicion is your change will dismiss the warning and you don't need to remove the pin as I described.
    – bmike ♦
    Commented Mar 18, 2014 at 14:01
  • 1
    The warning hasn't reoccurred, so I think you're right - changing seems to have dismissed it. I can relax :)
    – David
    Commented Mar 18, 2014 at 14:26
  • No profiles on iPhone. Changed password following guidelines above. Now "Trust This Computer?" comes up, with the message "Your settings and data will be accessible from this computer when connected." So, what now?
    – user121090
    Commented Apr 7, 2015 at 20:06
  • 1
    upvoted because this should be the correct answer, since there's steps here to resolve it. quite disconcerting to have your phone demanding to make you change your passcode... this officially freaked me out
    – enorl76
    Commented Mar 16, 2016 at 18:56
4

I had this problem tonight too. I "bit" before I thought it being malware, but it doesn't seem to have been malware. I changed my PIN and the phone reset, then the new PIN worked. BUT... the phone immediately asked for me to change the PIN again... now I was thinking Malware. I kept changing the PIN and it kept asking me to do it again. I used the tip earlier in this thread about too simple of a PIN and tried a 9 digit PIN and that worked, the message didn't return. Funny thing is that after, I was able to go into settings and set the PIN back to the 4 digit PIN that I had originally, no further messages.... yet.

Improve this answer
1
  • 1
    My device has a very secure alpha numeric password and I change it regularly, I have no MDM. Another thing that I noticed with this was that when it dismisses, there is a very odd black rectangle that shrinks with it, it's unlike any other system dialog. I too was very suspicious of it's origin. I was able to open up settings and I deleted my Safari Data & Browsing history, it has yet to return after 3 days. I believe that I may have dodged a bullet and hope that others can try this also before entering theirs. You can't tell if it even ties into the system without entering your real password.
    – David Greco
    Commented Aug 2, 2016 at 17:39

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .