Please Note: The following applies equally to iPads as well.
If your iPhone gets stolen and you’ve done a few simple things — the phone is useless to anyone. The phone cannot be used and wiped without your authorization. The iPhone essentially becomes a brick. The most important thing you can do is to make sure that “Find my iPhone” is turned on.
ZDNet has a pretty good article about how a thief can actually use your stolen iPhone but it requires that the iPhone owner do some pretty bad things.
In order for a thief to get your credentials to unlock the stolen phone you would have to give the credentials to them. Most folks wouldn’t knowingly do that but that is exactly how phishing works.
The best thing you can do if someone steals your phone is for you to conduct all business related to it through the official Apple website portal for iCloud. Do not follow any links in an email or elsewhere. Even if the email looks like it comes from Apple, go over to your browser and log in to Apple’s iCloud website that way.
When someone steals an iPhone, the odds are against them. It is exactly the same as if they’d stolen a brick from a construction site. Of course, most bricks do not have a built in GPS tracker.
If your iPhone gets stolen, play it cool and don’t panic. Instead of thinking about it negatively let’s call it a “forced upgrade.”