Forget your PIN? Samsung will wipe your phone, and support won't help either

Security is always a tug-of-war between protection and convenience. Samsung in One UI 9 has pulled very strongly towards protection – and for the first time, set a boundary beyond which there is no way back. Not for you, nor for customer support.

How the countdown works

The first five attempts are free, just like before. But then it gets tougher, and after each waiting period expires, you get only one more attempt:

• 5 errors – 1 minute
• 6th error – 5 minutes, 7th error – 15 minutes, 8th error – 30 minutes
• 9th error – 90 minutes, 10th error – 4 hours, 11th error – 12 hours
• 12th error – 24 hours, meaning the last chance with data untouched
• 13th error – permanent lock, the system will no longer accept the correct PIN

Samsung added two things that make it tolerably softer. A countdown and the number of remaining attempts run on the screen, so no one will end up locked out by surprise. And so-called smart counting works – if you accidentally type the exact same wrong code twice in a row, the system counts it as one error. This protects against typos and children playing with the phone, but not against an attacker trying various combinations.

It doesn’t end after wiping

When a permanent lock occurs, the only solution is a factory reset – meaning wiping photos, messages, and all files on the phone. And beware, even then you haven’t won: thanks to Factory Reset Protection, after a reset, you must log in with the original Samsung or Google account. For thieves, it’s an insurmountable wall; for an owner who forgot the code, it’s little comfort.

Crucially, Samsung cannot remotely recover a PIN, gesture, or password. There is no support call that can resolve the issue. If you can’t remember the code, you will lose your data.

Who this affects and what to do about it

For now, the new policy only applies to phones that come with One UI 9 directly from the factory – namely Galaxy Z Fold 8, Z Fold 8 Ultra, and Z Flip 8. Samsung has not specified whether the same rule will be transferred to older models with updates.

The practical risk is low for most people, for one specific reason: Android requires entering a backup PIN at least once every 72 hours, even if you otherwise unlock with a fingerprint or face. This way, you regularly remind yourself of the code, whether you want to or not. More at risk are people who set up their phone years ago and have only used it for biometrics since then – and then those who don’t back up their data.

That the measure is correct against brute force is not debatable. That it should be set hard without any alternative is debatable. But Samsung is at least fair in describing the rules publicly and in advance.

Would you remember your backup PIN right now if your fingerprint wasn’t working?

Sources: Android Authority, SamMobile, Notebookcheck, Android Police