Ah, that's it then. I figured they would likely have a passcode, since the "someone steals my phone on public transport" threat vector is a pretty obvious one even for non-tech users. Unfortunately the thread got nuked before I got to read it more...