Complete guide to all lock types on iPhone, iPad, Mac, and Apple Watch. What each lock means and how to check for it.|
Select a lock type to jump to its detailed description
Activation Lock, Find My iPhone, Apple ID binding
[02]Corporate management, DEP/ADE, Supervised Mode
[03]Carrier binding, SIM Lock, regional locks
[04]IMEI blocklist, Bad ESN, network-level blocking
[05]Apple internal locks, stolen and demo devices
[06]Passcode lock, Face ID, Touch ID, Security Lockout
[07]EFI/Firmware Password, Recovery Lock, FileVault
[08]Activation Lock, passcode lock, iPhone pairing
Apple's primary device protection - binding to Apple ID via Find My
Activation Lock is Apple's built-in security feature. Available on all Find My-supported devices: iPhone, iPad, iPod touch, Mac, Apple Watch, AirPods (Pro/Max), and Apple Vision Pro. Activates automatically when Find My is enabled and ties the device to the owner's Apple ID.
After reset or reflash, the device requires the Apple ID and password for activation. This is the most common lock type on the secondary market. If the seller didn't unlink the device, the new owner gets a useless brick.
Find My is disabled. No Activation Lock. Ideal status for buying - the device can be activated with any Apple ID without restrictions.
Find My is on, device is tied to the owner's Apple ID. Lost Mode is not activated. Activation Lock is already active: after reset, the device will require Apple ID and password. Before buying, ask the seller to sign out of iCloud and disable Find My in front of you.
Find My is on + Lost Mode activated. Device is remotely locked, displaying the owner's message. Device may be in erase mode. Activation Lock is on. Do not buy such a device.
Device is marked as stolen in Apple's system. More serious flag than Lost. Apple may refuse any service. Most likely a stolen device.
Owner remotely erased data via Find My, but Activation Lock remains. Device shows activation screen and requires the original owner's Apple ID.
Standard binding via Find My. Owner can remove the lock by signing out of Apple ID on the device or via iCloud.com. This is the most common scenario on the secondary market.
Device bound via Apple Business Manager or Apple School Manager. Lock is managed by the organization's administrator. Only the company's IT admin can remove it, not the end user.
Mobile Device Management - corporate remote management system for Apple devices
MDM (Mobile Device Management) is a technology that allows organizations to remotely manage, configure, and restrict Apple devices. Companies use MDM to control corporate equipment: security policies, app restrictions, VPN and Wi-Fi configuration.
A device with an MDM profile may have limited functionality and can be remotely locked by the administrator. On the secondary market, MDM devices are often sold at significant discounts due to restrictions.
Installed remote management profile. On non-supervised devices, the user can manually remove the profile via Settings. However, the administrator will know about the removal and may take action.
Device Enrollment Program (old name) / Automated Device Enrollment (current name). Device is hardware-bound to the organization via Apple Business Manager. MDM profile cannot be removed - even after full reset, the device automatically re-enrolls in MDM during activation. Only the organization's administrator can remove it.
Maximum device management level. Includes additional restrictions: MDM removal blocked, app installation restricted, AirDrop control, settings restrictions. Set up via DEP/ADE or Apple Configurator.
Available only for supervised devices. Locks the device, displays company message, enables GPS tracking. Does not require Find My to be enabled - managed via MDM server.
Administrator sends a lock command via MDM server. On iPhone: forces the lock screen. On Mac: device reboots and locks with a 6-digit PIN and optional message.
Device binding to a mobile carrier - restricting use of other network SIM cards
Carrier Lock (SIM-Lock) is a lock set by the mobile carrier that sold the device. The iPhone only works with that carrier's SIM card or eSIM. Inserting another carrier's SIM shows "SIM Not Supported" error.
Carrier binding is not the same as iCloud Lock. The device is fully functional but restricted to one network. Only the carrier (not Apple) can remove the lock, usually free after contract or installment completion.
Standard carrier binding (AT&T, T-Mobile, Verizon, etc.). Device only works on that carrier's network. Check in Settings → General → About → "Carrier Lock" field. "No SIM restrictions" means the device is unlocked.
Carrier locks the device until all installment payments are made. Even if you request an unlock, the carrier will refuse until the debt is paid. Common on US devices.
Temporary lock on devices sold in certain regions. Usually removed after first activation with a local SIM card. Rare on modern devices.
PIN lock on the SIM card itself. Not related to the device - protects the SIM from unauthorized use. After 3 wrong PIN attempts, a PUK code from the carrier is required. Wrong PUK permanently locks the SIM.
Device blocking at the network level by unique IMEI number
IMEI Blacklist is a blocklist of unique mobile device identifiers maintained by carriers and the international GSMA organization. A device with a blocked IMEI cannot connect to cellular networks - showing "No Service".
Important: IMEI Blacklist and iCloud Lock are independent locks. A device can be clean on iCloud but blocked by IMEI, and vice versa. For a complete check, both statuses need to be verified.
IMEI blocked by carrier as lost or stolen. Device cannot connect to that carrier's network. In some countries, the block automatically extends to all domestic carriers via national database.
IMEI blocked via international GSMA database. Device is blocked across carrier networks in multiple countries. However, some blocks are regional - device may work in countries whose carriers don't participate in data sharing.
ESN (Electronic Serial Number) is used in CDMA networks. "Bad ESN" means the device is blocked on CDMA network (Verizon, Sprint). "Bad IMEI" - same for GSM networks. Causes: carrier debt, insurance claim, theft report.
Device marked as lost or stolen at carrier level (not Apple). Different from iCloud Lost - this is a carrier network block, not an Apple system block. Device can have iCloud Clean status but GSM Lost simultaneously.
Apple internal locks - devices without valid sale records and demo units
Chimaera and Demo are Apple's internal policies applied to devices that haven't gone through the legitimate sales chain. These locks are managed directly by Apple and cannot be removed by third-party services or carriers.
Information about Chimaera and Demo statuses is available in GSX (Global Service Exchange) reports - Apple's internal service system.
"Chimaera Applied" status is assigned to devices without a valid sale record in Apple's systems. Typical causes: theft from Apple Store, carrier stores, distributor warehouses, or manufacturing (Foxconn, Pegatron). The carrier field is replaced with "Chimaera/Blacklist". Device cannot activate with any SIM card. Shown in GSX under "Next Tether Policy Details".
Devices intended for display in Apple Store or authorized retailers. Run in a special demo mode with limited functionality. Sometimes devices erroneously receive demo status during inventory. Removal requires a store manager with demo portal access + purchase receipt.
Engineering samples and prototypes never meant for sale. Have special firmware and restrictions. Apple actively tracks leaks of such devices. Use and sale may have legal consequences.
Device-level locks - passcode, Face ID, Touch ID, and related restrictions
4-digit, 6-digit, or custom alphanumeric password. After 5+ wrong attempts, progressive timeouts activate (1 min, 5 min, 15 min, 1 hour). With "Erase Data" enabled, the device auto-resets after 10 failed attempts.
Face ID - face unlock (iPhone X and newer, iPad Pro). Touch ID - fingerprint unlock (iPhone 5s–8, SE, iPad). Both methods supplement the passcode and fall back to passcode after reboot, 48 hours of inactivity, or 5 failed biometric attempts.
Appears after 10+ wrong passcode attempts. On iOS 15.1 and earlier: "iPhone Disabled". On iOS 15.2+: "iPhone Unavailable" with "Erase iPhone" option. Requires reset via iTunes/Finder, Recovery Mode, or iCloud (if Find My is on).
Separate 4-digit passcode protecting Screen Time settings, content restrictions, and app limits. Often used for parental controls. May prevent device reset. Persists through backup restoration.
Apple computer-specific locks - from firmware to disk encryption
Intel Mac only (2006–2021). Blocks booting from external drives, USB, Recovery without firmware password. Not to be confused with macOS password - EFI password appears immediately at boot, before the OS. Reset only possible at Apple Store or authorized service with receipt.
Replacement for EFI password on modern Macs - Apple Silicon (M-series) and Macs with T2 chip (2018+). Sets a password on the recovery partition. Managed via MDM. According to Apple, cannot be reset if password is lost (unlike EFI).
Full-disk encryption XTS-AES-128 with 256-bit key. Without FileVault password or recovery key, disk data is inaccessible. When managed via MDM, recovery keys can be stored on the organization's server (escrow).
Works the same as Find My on iPhone. Statuses are identical: Find My: OFF - disabled. Find My: ON, Clean - on, no lost mode. Find My: ON, Lost - on + lost mode, Mac locked with PIN.
Works on any Mac with Find My support (macOS Catalina and newer): Intel Mac, Mac with T2 chip, Apple Silicon (M-series). Activates automatically when Find My Mac is enabled. After erasing macOS, requires Apple ID to reinstall the system. Works identically to iPhone and iPad.
Apple smartwatch-specific lock information
Works identically to iPhone. Find My: OFF - disabled, no Activation Lock. Find My: ON, Clean - on, no lost mode, Activation Lock active. Find My: ON, Lost - on + lost mode, watch is locked.
4-digit or 6-digit passcode. After 10 wrong attempts, data is erased (if option is enabled). Passcode can be reset via paired iPhone or full watch reset, but Activation Lock will remain.
Apple Watch is paired to a specific iPhone. Before selling, unpair the watch: on iPhone in Watch app, tap "Unpair Apple Watch". This automatically disables Activation Lock. If the watch isn't unpaired, the new owner cannot set it up.
Always check: iCloud Lock (Find My iPhone ON/OFF), Carrier Lock (carrier binding), IMEI Blacklist (blocklist), and MDM (corporate lock). All these checks are available in the Telegram bot @ispyware_bot - just send the device IMEI.
Yes. Locks are independent. A device can simultaneously have iCloud (Activation Lock), carrier lock (Carrier Lock), blacklisted IMEI, and MDM profile. Each lock is removed separately through the appropriate channel.
iCloud Lock ties the device to an Apple ID - without the password, the device cannot be activated at all. Carrier Lock ties it to a carrier - the device works but only with one carrier's SIM. iCloud Lock is removed via the owner's Apple ID, Carrier Lock via the carrier.
Chimaera Device Policy is Apple's internal lock for devices without a legitimate sale record (stolen from stores, warehouses, factories). Chimaera cannot be removed by any third-party service. Apple may consider a request only with the original purchase receipt.
Send IMEI or serial number to @ispyware_bot on Telegram or use the free check on the website. The bot provides extended reports: iCloud, Find My, MDM, Carrier, Blacklist, GSX data, and 50+ check services.
Make sure the device is clean before buying