Samsung Caps One UI 9 Lock-Screen Failures at 13, Forcing Factory Reset

Q: How does Samsung’s new smart counting actually tell the difference between a forgetful owner and a ruthless brute-force attack?

It doesn’t truly identify the owner; it classifies behavior. Samsung’s “smart counting” mainly distinguishes repeated reuse of the same wrong credential from fresh guesses, treating the former as less suspicious and the latter as more attack-like. In practice, if someone enters the exact same incorrect PIN or password again, One UI 9 ignores that duplicate and does not increase the failed-attempt total. That is meant to protect a legitimate user who keeps insisting on the same remembered code, or a child making the same accidental tap pattern, from burning through all 13 tries too quickly. Samsung also says the phone will show clearer warnings and the number of attempts left, giving a forgetful owner more feedback before the penalties escalate. What the system does not appear to do is analyze biometrics, location, typing rhythm, or ownership signals to decide “this is probably the real user.” The main defense is still rate-limiting: after enough distinct wrong entries, the phone imposes longer lockouts—up to 24 hours after the 12th failure—and on the 13th failed attempt it requires a factory reset. That makes brute-force attacks much harder because attackers usually cycle through many different likely codes. A legitimate owner who is simply repeating one mistaken PIN is spared additional counts, but someone trying new combinations keeps advancing toward lockout. So “smart counting” is less about knowing who you are than recognizing the pattern of guessing.

Q: Could a child playing with your new Galaxy phone permanently wipe all your data in just a few minutes?

No. A child could trigger a wipe, but not in just a few minutes. On Samsung phones that ship with One UI 9 on Android 17, the device does not factory-reset immediately after a burst of wrong guesses. After five failed PIN, password, or pattern attempts, Samsung imposes escalating lockouts: 1 minute, then 5 minutes, 15 minutes, 30 minutes, 90 minutes, 4 hours, 12 hours, and 24 hours after the 12th failure. Only the 13th distinct wrong attempt causes a permanent lock that can be cleared only by a factory reset. That means reaching the wipe point would normally take more than 42 hours of elapsed time, because each timeout has to expire before another attempt is possible. Samsung’s “smart counting” also ignores repeated entries of the same wrong PIN or password, reducing the chance that a child repeatedly tapping the same digits quickly burns through the limit. The risk is still real if a child keeps entering different wrong codes over time, or if the owner does not notice the repeated warnings Samsung says it will display as the phone nears the threshold. And if the reset is triggered, all local data is erased. There is a safeguard after the wipe: Factory Reset Protection means the phone still cannot be reused without signing back into the previously linked Samsung and Google accounts. But that does not restore erased local data unless it was backed up. Regular cloud or Smart Switch backups remain essential.

3 articles · Updated · Android Authority · Jul 27

Samsung says One UI 9 will wipe a Galaxy device after 13 incorrect PIN, password or pattern attempts, with a 24-hour lockout after the 12th failure.
Android 17 already tightened the limit to 20 attempts from about 1,800 over five years, but Samsung’s implementation goes further under what it calls stricter lock-screen security.
Repeated guesses using the same wrong PIN or password will not count toward the total, and One UI 9 will show remaining attempts and guidance text after multiple failures.
Factory Reset Protection means users who trigger the wipe must sign back in with both Samsung and Google accounts; PIN entry still remains mandatory at least every 72 hours even for biometric users.
The first devices shipping with the Android 17-based software will be the Galaxy Z Fold 8, Z Fold 8 Ultra and Z Flip 8, due in early August.