One UI 9 Will Permanently Lock Your Galaxy After 13 Wrong PIN Tries

Samsung has documented a stricter lock screen policy in One UI 9, and the number that matters is 13. On Galaxy phones that ship with One UI 9 preloaded, thirteen consecutive wrong PIN, password or pattern entries permanently lock the device. There is no waiting it out after that point and no support call that reverses it — the only way back in is a factory reset, which erases everything on the phone.

The policy is spelled out in Samsung’s own Samsung Members support notice on One UI 9.0 lock screen security, and in its One UI 9.0 lockscreen security policy support page, which frames it as a defence against brute-force attacks — someone with your phone in hand working through PIN combinations one at a time:

In One UI 9.0, the total allowed attempts before a lockdown are reduced, and the temporary input restriction (lockout duration) is strictly enforced. As the number of consecutive failures increases, the time-out duration before you can try again will scale up progressively at each stage.

That is a real threat, and a hard ceiling is an effective answer to it. It is also a ceiling that falls on whoever hits it, thief or owner.

How the One UI 9 lock screen limit works

Failed attempts don’t jump straight to a lockout. As SamMobile reports the policy, an escalating delay kicks in at the fifth wrong entry and stretches out from there:

• Attempts 1 to 4: no delay
• 5 failed attempts: 1 minute lockout
• 6 attempts: 5 minutes
• 7 attempts: 15 minutes
• 8 attempts: 30 minutes
• 9 attempts: 90 minutes
• 10 attempts: 4 hours
• 11 attempts: 12 hours
• 12 attempts: 24 hours
• 13 attempts: permanent lock, factory reset required

Two details take some of the edge off. Entering the same wrong credential over and over does not burn a fresh attempt each time — Samsung calls this smart counting — so a stuck key or a repeated muscle-memory mistake shouldn’t march you up the ladder. And once you are into the warning territory, the phone tells you how many tries you have left rather than letting you walk off the cliff blind.

Which Galaxy phones this applies to

This is the part worth reading carefully: the limit applies to devices launched with One UI 9.0 preloaded, not to phones that get One UI 9 as an update. Right now that means three handsets — the Galaxy Z Fold8, Galaxy Z Fold8 Ultra and Galaxy Z Flip8, all of which went on sale running stable One UI 9. Samsung’s One UI 9 beta on the Galaxy S26 does not carry the change, according to SamMobile’s testing.

So if you are updating a Galaxy S26, S25 or an A-series phone to One UI 9 over the coming months, your existing lock screen behaviour comes with you. Samsung has not said whether it will extend the rule to devices upgrading from older One UI versions, so treat it as a policy that will reach you eventually rather than one you have dodged — every Galaxy phone launched from here on ships with One UI 9 or later out of the box, which means the 13-attempt ceiling travels with all of them by default. It is one of several tighter controls arriving with the release, alongside One UI 9’s new per-app network restrictions.

Thirteen is not a lot of attempts

Samsung’s reasoning holds up on paper. In practice, thirteen is a low number for a device you touch a hundred times a day. Change your PIN the night before a trip and you can plausibly fumble the new one four or five times before the old one stops surfacing from memory. Hand an unlocked-looking phone to a child, or leave it in a bag where the screen wakes against a jacket zip, and attempts get spent without you present to stop it. There is no partial penalty here: the phone either lets you in or wipes itself. Our own read is that a hard reset with no recovery route is a heavy default to apply to the owner as well as the attacker, and Samsung has not published an option to raise or disable the ceiling. Samsung states plainly that it cannot recover a local lock screen credential, so a forgotten PIN and an un-backed-up phone is a total data loss event with no appeal.

What to do before you get anywhere near 13

The mitigations are all things to set up now, not after the counter starts climbing.

1. Confirm your backup is actually running. Open Settings > Accounts and backup and check both Samsung Cloud and Google backup, including when each last completed, and consider a Smart Switch backup to a PC too. A factory reset is survivable if the data is somewhere else; it is not if the last backup is from March.
2. Know about Reset with previous lock. Samsung’s own support page for the feature explains that if you set a new PIN, password or pattern, you can still get in with the previous one for 72 hours afterwards. The option appears after five failed attempts. It needs One UI 6.1 or newer, the old credential has to still exist, and it does not work if your lock relies on biometrics alone. Note also that Android’s Strong Authentication rules force you to type your PIN, pattern or password at least once every 72 hours and after every restart, regardless of whether you normally unlock with biometrics — that prompt is exactly when people who never type their PIN discover they’ve forgotten it.
3. Confirm you can log into your Samsung and Google accounts. Factory Reset Protection means that after a forced reset you must sign back into the accounts already registered on the phone. Lose access to those and the reset does not even give you a usable device. Verify the recovery email and phone number on both accounts today.
4. Enable accidental touch protection. Find it under Settings > Display. Samsung has not explained how the counter behaves against stray pocket inputs, which could in principle register several different wrong entries. This setting reduces that risk and costs nothing.
5. Stop guessing and let the timer run. Once you are past the fifth attempt, every extra guess is expensive. Waiting out a lockout, however long it runs, costs you nothing permanent; three more wrong tries costs you the phone’s contents. A call to Samsung support will not help either — the company states it cannot view or retrieve your local credential.
6. Don’t change your lock code right before you travel. The window where you are most likely to fumble a new PIN is also the window where you least want a wiped phone.

None of this is theoretical for long. One UI 9 is only on the new foldables today, with Samsung’s broader rollout to existing Galaxy phones expected to begin in the coming weeks, and the next wave of Galaxy hardware will arrive with the policy baked in. If you have just bought a Fold8 or a Flip8, treat your PIN as something you cannot afford to forget — because on these phones, forgetting it thirteen times is a factory reset. Data loss triggered by a lock screen is not a hypothetical either, as the US prosecution over a GrapheneOS duress PIN showed this week.

Sources: SamMobile, Android Police