Thieves prevent iCloud access using stolen phone in lost mode

Question

Level 1

5 points

Thieves prevent iCloud access using stolen phone in lost mode

I know there are numerous threads about this but thought I would share my experience.

Son had phone snatched whilst on holiday not sure if screen was open or locked, iPhone 15. Within 20 minutes his iCloud password had been changed and during the night bank accounts, PayPal, coinbase etc all accessed, as I write I am unsure what has been stolen.

Spoke with apple support who were very good compared to some of the banking officaldom, Revolut is terrible in my opinion. Anyway after getting an esim we used another iPhone to duplicate his number which made resetting the password for appleid/iCloud easier. So with the password reset and access to iCloud we could see the last location of his phone, funnily enough in an apartment block 100yards from a police station! Phone was put into lost mode and sat pending then shortly after went into lost mode. I was assured that that was everything locked up and as we intended to let the police know and hopefully apprehend the thieves if possible using the phone tracking we held back on erasing the phone. Throughout the day the phone came on for short periods all in that general local then just before we decided we would erase, as police were not willing to try and catch said thieves the appleid/cloud access password would not work. The thieves had somehow blocked or erased access, we went through the same procedure of resetting the password using the duplicate sim and checked the findmy map. The phone was now no longer visible or on the list of available devices. Somehow the thieves had bypassed the lost mode and the new appleid password, still to speak with apple to clarify and if the data on the phone can be accessed or indeed the iCloud is compromised somehow.

A horrendous experience as Im sure others can testify to and has opened my eyes as to what is supposedly secure and what is obviously not.

Ill update this thread if I get anything more of value.

In hindsight I would not of held back on erasing the phone, but there was a slim chance of catching the Ba£*^&*s!

Posted on Feb 7, 2025 12:09 AM

Reply

Answer 1

Feb 7, 2025 01:07 AM in response to noname_99

noname_99 wrote:

Son had phone snatched whilst on holiday not sure if screen was open or locked, i

if your iPhone was unlocked without requiring a passcode, it could indicate a security vulnerability or misconfiguration. Here’s how this could impact your device:

Full Access to the Device – If someone gains access without a passcode, they can freely browse your data, messages, emails, and apps.
Changing Settings & Accounts – Once inside, they can modify system settings, including security settings, Face ID/Touch ID, and passcode requirements.
Payment & Sensitive Data – With full access, an attacker can use saved payment methods, read sensitive notes, and access authentication apps.

Possible Causes of an Unlocked iPhone:

Face ID/Touch ID is registered to someone else.
Jailbroken devices may have security vulnerabilities.

How to Secure Your iPhone:

Check Face ID/Touch ID settings and remove any unknown fingerprints or face scans.
Change your passcode immediately to a strong one.
Enable two-factor authentication (2FA) for your Apple ID.
Restart your device to close any potential exploits.
Check Settings → Face ID & Passcode → Require Passcode and set it to “Immediately.”
Update iOS to the latest version, as Apple regularly patches security flaws.
Enable Stolen Device Protection.

If you suspect your device was accessed improperly, consider resetting it to factory settings and restoring it from a trusted backup.

Reply

Answer 2

Feb 7, 2025 01:02 AM in response to noname_99

noname_99 wrote:

iPhone 15. Within 20 minutes his iCloud password had been changed and during the night bank accounts, PayPal, coinbase etc all accessed, as I write I am unsure what has been stolen.

Report the incident to local law enforcement authorities and actively pursue the case.

Reply

Answer 3

noname_99 Author

Level 1

5 points

Feb 7, 2025 02:13 AM in response to noname_99

Reported to Police but really pointless bar for any insurance possibilities. The crux of the matter is the iCloud password was changed by us after the phone was stolen and the stolen phone was in lost mode. How did they then change the password or at least make it that we had to reset it again and they removed the phone from the connected devices within findmy phone? I was tracking the phone on the map as it happened!

Reply

Thieves prevent iCloud access using stolen phone in lost mode

Similar questions