Samsung is strengthening lock screen security in One UI 9.0 by introducing new measures to prevent password guessing. After 13 consecutive failed unlock attempts, the device becomes permanently locked and requires a full factory reset, which erases all local data. Therefore, it is recommended to regularly back up your data and ensure you have access to your linked Samsung and Google accounts.

New Unlock Attempt Restrictions

In the updated system, after five incorrect unlock attempts, the device is locked for one minute. With each subsequent error, the lockout time increases:

• 6 attempts — 5 minutes,
• 7 attempts — 15 minutes,
• 8 attempts — 30 minutes,
• 9 attempts — 90 minutes,
• 10 attempts — 4 hours,
• 11 attempts — 12 hours,
• 12 attempts — 24 hours.

The thirteenth consecutive failed attempt results in a permanent lock, after which access can only be restored by performing a full device reset.

“Smart Counting” Mechanism

The system includes a mechanism where entering the same incorrect PIN, pattern, or password twice in a row counts as a single error. Only different incorrect entries increase the attempt counter. Users are also shown a warning about the number of remaining attempts as they approach the limit.

Policy for Biometric Unlock

The new rules also apply to users who use biometric authentication. According to Android Strong Authentication requirements, you must enter your backup PIN, pattern, or password at least once every 72 hours, regardless of fingerprint or face recognition usage.

Account Recovery and Data Protection

If you forget your password, Samsung does not offer remote recovery or reset options for the lock screen password. If the password is lost, a factory reset is required, followed by re-authentication using your registered Samsung and Google accounts. To prevent data loss, it is recommended to regularly back up your data to the cloud or with Smart Switch.

Purpose of the Changes

The introduction of these new restrictions is aimed at enhancing protection against unauthorized access through password guessing and is part of a broader strategy to safeguard user data.