Apple has a new feature to fight shoulder surfing

The enhancement will require Face ID or Touch ID — with no option to use a passcode — when accessing stored passwords, changing Apple ID settings, looking at payment information and disabling Find My iPhone.