How Lockdown Mode Blocks FaceTime in iOS 16

Apple introduced Lockdown Mode in iOS 16 as an extreme security measure designed to protect high-profile individuals from sophisticated, targeted digital threats and mercenary spyware. One of its primary defenses is strictly limiting incoming communications across system services. For FaceTime, Lockdown Mode automatically blocks incoming invitations and calls from any person the user has not previously called or initiated contact with, thereby neutralizing zero-click exploits delivered via incoming call payloads.

The Mechanism Behind Call Filtering

When Lockdown Mode is active, iOS 16 fundamentally changes how the operating system handles incoming communication requests at the network and service layer. Instead of processing incoming FaceTime invitations indiscriminately, the operating system applies a strict cryptographic and historical verification check:

  • Prior Initiation Requirement: Incoming FaceTime calls are accepted only if the device owner has previously contacted the caller. The system checks the incoming Apple ID or phone number against local records of outbound communications.
  • Silenced Signaling: If an incoming call originates from an unknown sender or a contact that has never received an outbound communication from the user, the operating system drops the signaling packet immediately. The device will not ring, show an incoming call screen, or prompt the user.

Mitigating Zero-Click Exploits

The primary technical objective of blocking unknown FaceTime calls is the prevention of "zero-click" remote code execution attacks. In a standard operating environment, handling an incoming FaceTime call involves several automated background operations:

  1. Protocol Negotiation: The device processes Session Initiation Protocol (SIP) and Interactive Connectivity Establishment (ICE) packets to prepare the connection.
  2. Media Parsing: Codecs and audio/video frameworks initialize to handle potential incoming streams, such as live video previews.
  3. Data Deserialization: The device automatically decodes complex metadata sent with the invitation before the recipient even touches the screen.

Sophisticated spyware (such as Pegasus) often targets memory vulnerabilities within these media parsing and networking daemons (such as avconferenced or identityservicesd). By intercepting and rejecting the communication at the earliest boundary—before complex parsers, codecs, or network handshakes are engaged—Lockdown Mode removes the attack surface entirely for unverified callers.

Behavior for the User

For everyday usage in iOS 16, this behavior means:

  • Calls from established contacts that the user has previously called will function normally.
  • Calls from new contacts or unknown numbers are dropped automatically at the device level, leaving no window for malicious payloads to execute.
  • To receive a FaceTime call from a new contact while Lockdown Mode is enabled, the device owner must first initiate an outgoing call or message to that person to establish trust.