Do Son 
Samsung is sharply raising lockscreen security in One UI 9, its skin based on Android 17. The new rule is strict. Enter the wrong passcode 13 times in a row, and the device refuses every further unlock attempt.
At that point, only a full reset can revive the phone. As a result, any data the user never backed up is lost for good.
This change ties to Google’s recent Android 17 lockscreen security policy. Samsung’s approach differs somewhat, though. Some users worry that a child mashing the screen could trigger a forced lockout. By Samsung’s design, however, that outcome is extremely unlikely, unless the owner ignores the phone for more than 42 hours straight.
How One UI 9 Handles Failed Unlocks
Older versions of One UI behaved gently. A wrong PIN, pattern, or password merely lengthened the wait before the next try. Once the lockout timer ended, the user could attempt an unlock again.
By default, Samsung did not cap the number of attempts. It did offer an optional safeguard, though. Users could choose to wipe all data after 15 consecutive wrong entries, but they had to enable that setting themselves.
One UI 9 abandons unlimited attempts entirely. After five wrong entries in a row, the system locks for one minute. The user may then try again, yet each subsequent failure lengthens the wait.
For example, a sixth wrong entry brings a 5-minute lockout. A seventh triggers 15 minutes, and the penalties keep climbing from there.
Eventually, 13 consecutive failures lock the system completely. After that, no unlock attempt works, even with the correct passcode in hand. Consequently, any data not backed up to the cloud stays trapped, and a factory reset erases all of it. Without a backup, then, repeated wrong entries carry serious stakes.
The One UI 9 Lockout Timeline
The escalating wait times run as follows:
- First 5 attempts: no wait; after the fifth consecutive failure, a 1-minute wait begins.
- After the 6th failure: 5 minutes.
- After the 7th failure: 15 minutes.
- After the 8th failure: 30 minutes.
- After the 9th failure: 90 minutes.
- After the 10th failure: 240 minutes (4 hours).
- After the 11th failure: 12 hours.
- After the 12th failure: 24 hours.
- After the 13th failure: no wait; the system locks permanently and requires a factory reset.
Why Accidental Lockouts Stay Rare
Samsung also built in a smart counter. When the same wrong passcode is entered twice in a row, the system counts it only once. Therefore, a user who has truly forgotten the code can write down each guess on paper and rule out anything already tried.
That counter has a limit, though. It only merges identical consecutive entries. Different wrong passcodes each count separately.
Even so, an accidental permanent lock remains highly improbable. By Samsung’s own timing, reaching 13 attempts takes about 42 hours and 21 minutes. Unless the owner never touches or unlocks the phone for more than 42 hours, a child simply cannot rack up 13 consecutive errors.
One more safeguard helps. Before the permanent lock, a single correct passcode resets the counter to zero and starts the count over. Because of that, locking the phone for good is genuinely hard to do by accident, which is precisely why Samsung still chose to ship the limit for security reasons.
Support Our Threat Intelligence
If you find our CVE report and cybersecurity news helpful, consider supporting our work.
Buy Me a Coffee
PayPal
