Stolen iPhone - Criminals have full control and Apple cannot help!

[TechnoMonk]

You know what would help a lot? If Apple requires login to the iCloud website to change that password.

No real reason to allow it from the phone. Inconvenience would be minimal since most people never change it anyway (most likely).

For that matter...they could require that for a device password that is logged into an iCloud account too. That way, even if someone knows the device password, they wouldn't be able to change it without ALSO knowing the corresponding iCloud password.

They could easily allow second trusted device to reset with a pin. If there aren’t multiple devices, just force use of password to reset.

 

[Wando64]

To all intents and purposes Apple only knows that an account belongs to a particular person because that person has the access and the account settings might contain some of their personal details.

But with access to the account, a thief can change all of those details, effectively making the account look like it belongs to them.

How does Apple then decide who the legitimate owner of the account is? It’s all just a balance of probability (based on the evidence, you probably own this account, so we’ll give you access).

Apple has a trail of all changes made to the account.
Simple enough to look back to before the alleged theft happened.

 

[cdsapplefan]

Will be interesting to see how Apple responds to this exploit since they say they care about our privacy & security 🤔

 

[onenorth]

I am doubting a lot of this. Both my Barclays and NatWest bank accounts use FaceID. If FaceID fails or is disabled then a dedicated app passcode is required. This passcode is user set on both banks. My Barclays, NatWest and iPhone pin are all different.

Surely someone so adept at online security you won't have the same pin surely?

I think the OP said they reset the passwords via email, which they had access to.

 

[cdsapplefan]

Apple has a trail of all changes made to the account.
Simple enough to look back to before the alleged theft happened.

So again, why can’t Apple just give access back to the original poster since they know what changes were made and can pin point who the original owner is?

 

[monstermash]

I think the OP said they reset the passwords via email, which they had access to.

Simple security posture is to use an email address that isn't configured on your phone. It's what I do.

My iCloud email address (login) isn't used for anything else and isn't configured on my phone. If I want to access it, I have to use my Mac or webmail.

Having your own domain name makes this easy.

 

[TechnoMonk]

So again, why can’t Apple just give access back to the original poster since they know what changes were made and can pin point who the original owner is?

Can they? Are Apple Store employees trained to authenticate documents? What if some one shows up with a fake ID. It opens up a Pandora’s box with conmen impersonating some one. Identity theft/Fake IDs is big in todays world.

 

[onenorth]

Simple security posture is to use an email address that isn't configured on your phone. It's what I do.

My iCloud email address (login) isn't used for anything else and isn't configured on my phone. If I want to access it, I have to use my Mac or webmail.

Having your own domain name makes this easy.

That's decreasing the convenience, which many people seem opposed to.

But it still doesn't fix the problem of being able to reset the Apple ID password with the phone's passcode.

The OP said they went through his contacts and asked them for money, and got some.

 

[monstermash]

That's decreasing the convenience, which many people seem opposed to.

But it still doesn't fix the problem of being able to reset the Apple ID password with the phone's passcode.

The OP said they went through his contacts and asked them for money, and got some.

Security or convenience, take your pick.

As for the phone passcode...I wasn't addressing that. The comment I replied to as about someone with the phone having access to iCloud emails.

 

[TechnoMonk]

Security or convenience, take your pick.

As for the phone passcode...I wasn't addressing that. The comment I replied to as about someone with the phone having access to iCloud emails.

Yep having additional step for resetting iCloud account won’t stop the thieves from using text messages or emails to reset other accounts.
Stop worrying about work around a, don’t give the keys(passcode) to your kingdom.

 

[onenorth]

Security or convenience, take your pick.

As for the phone passcode...I wasn't addressing that. The comment I replied to as about someone with the phone having access to iCloud emails.

It doesn't have to be all or nothing. The primary issue is that once someone changes the Apple ID password then they can turn off Find My, reset FaceID, and have free reign to start hacking. All of these other solutions are incrementally helpful but still don't get to the root problem of losing control of the device if someone steals your device and passcode. There have been many proposals of how to address this, but I keep seeing people saying "well that's just the way it is." Talk about not thinking outside of the box.

 

[TechnoMonk]

It doesn't have to be all or nothing. The primary issue is that once someone changes the Apple ID password then they can turn of Find My, reset FaceID, and have free rein to start hacking. All of these other solutions are incrementally helpful but still don't get to the root problem of losing control of the device if someone steals your device and passcode. There have been many proposals of how to address this, but I keep seeing people saying "well that's just the way it is." Talk about not thinking outside of the box.

Right, but with passcode and device wide open. The crooks just need few minutes to reset bank accounts, and passwords. By the time folks realize and try to mark device stolen, or report, the thieves have their financial accounts wiped out.
Bottom line don’t be lazy about passcode in public.

 

[cdsapplefan]

Right, but with passcode and device wide open. The crooks just need few minutes to reset bank accounts, and passwords. By the time folks realize and try to mark device stolen, or report, the thieves have their financial accounts wiped out.
Bottom line don’t be lazy about passcode in public.

Verify with Apple Watch or use a alphanumeric password instead of a passcode which could be easily viewed and remembered by thieves

 

[TechnoMonk]

Verify with Apple Watch or use a alphanumeric password instead of a passcode which could be easily viewed and remembered by thieves

Yep. For those who think a patch will fix this are in for false sense of security. Only thing Apple can do is prevent loss of iCloud account. Some one with pin can easily reset financial accounts credentials with email and text. Turn on the airplane mode after getting access. The photos, emails and contents are still in their possession, doesn’t matter if the device is marked stolen or marked to wipe off clean.
I hope Apple gives more options but use other methods if PIn isn’t safe.

 

[Ethosik]

You think it's correct that ONE CODE, even if it's a 12 digit alphanumeric code, can give total access to your entire digital life?

You must be in the minority with that one.

If this flaw continues don't be surprised if these criminals find new ways to obtain passcodes. They are WAY too powerful as things stand.

Mine doesn’t? My apps and banking etc have their own separate pin and passwords. I have not seen a bank app that links your account password to your 6 digit iPhone pin. How do you sign in to the bank online? Same with any other site or app like Facebook or outlook which mine has a separate PIN to open.

 

[monstermash]

Mine doesn’t? My apps and banking etc have their own separate pin and passwords. I have not seen a bank app that links your account password to your 6 digit iPhone pin. How do you sign in to the bank online? Same with any other site or app like Facebook or outlook which mine has a separate PIN to open.

My bank app has its own pin and password too.

But I believe what the poster is saying is that, with access to the phone, you can use a "forgot password" link to send a text or email to the phone you're in possession of and reset the banking password that way.

 

[monstermash]

To that end, a cool feature I wish Apple would implement:

A "secure folder" you can drop apps into. To access anything in that folder, you need to enter a password that's different from your phone password.

You could drop into that folder the settings app, your finance apps and anything else you deemed sensitive.

Seems like it would be easily to implement and very useful. It would also completely solve the ID theft issue that OP describes.

 

[danclara]

OP, if you have actually reported the theft to the police and they have given you a crime/incident number, you can use that number in communications to various companies in getting them to cancel accounts and put blocks on accounts. With regards to whatsapp, just contact customer support and tell them about the iphone theft and that your account has now been compromised by the thieves and that you request that your account be blocked. Then tell them the theft has been reported to the police and here is the crime/incident number. Because whatsapp operate in the UK they are legally obligated to act on your information. Customer support should ring up the police giving them the number you've given them so they can confirm that a) it is actually you the account holder and b) that a report to the police has been made. If whatsapp fail to act on the information you've given them you can take them to court if their failure to act causes harm (mental or financial) to you or to anyone in your whatsapp contact list.

So I suggest to write off an email to whatsapp ASAP, provided you've got a police crime/incident number because without that no company is going to help you.

This is interesting as I have started 3 separate requests to WhatsApp and not once have they helped me block my account.

Activity from the criminals on WhatsApp seems to have stopped. I sent a message to ‘myself’ 2 days ago and it has not been delivered.

I think when I got a replacement SIM, my attempts to login may have locked the account. The only reply from WhatsApp is that I can login after a 7 day reset period.

Similar BS to Apple. It’s all automated and no one can affect it.

At least Apple have telephone support. WhatsApp is email only in the uk.

 

[TechnoMonk]

To that end, a cool feature I wish Apple would implement:

A "secure folder" you can drop apps into. To access anything in that folder, you need to enter a password that's different from your phone password.

You could drop into that folder the settings app, your finance apps and anything else you deemed sensitive.

Seems like it would be easily to implement and very useful. It would also completely solve the ID theft issue that OP describes.

I just ran a security check on all my bank accounts. When I do forgot password, they ask my card numbers/SSN, not account name. I don’t even get an option for password reset email or text unless I get through the validation screen. I wonder how the thieves changed OP’s financial account credentials?

 

[960design]

Although I do agree there should be a lockdown mode that apple could employ on report of stolen device. But if a device is only associated with apple I’d, how would that be enforced?

All my Apple products are associated to an mobile device manager (MDM). Thief steals phone, I can still track it and see everything they do. I can even remotely hide all the apps except the settings app. Restore if I wish ( but then I lose access to tracking until someone signs back in ). There is no way to remove the MDM, once installed. They are typically free for a small number of devices (~10 to 20).

Happy thoughts to the OP, hope you get your account sorted.

 

[Ethosik]

Gaining control of the iCloud account by knowing the device PIN is by design. The key is to not let your device PIN fall into the wrong hands. The OP appears to not have known the tricks that thieves use to learn your device PIN so didn't take measures to mitigate against the PIN falling into the wrong hands. The lesson is to be vigilant and be aware of your surroundings when entering your device PIN in a public location.

Make your friends and family aware that they must be vigilant when typing in a device passcode/word.

Agreed. If my debit card is stolen and they have my PIN, I’d lose a lot of money. I don’t keep it all on that account, but enough where I’d be very upset.

 

[onenorth]

I just ran a security check on all my bank accounts. When I do forgot password, they ask my card numbers/SSN, not account name. I don’t even get an option for password reset email or text unless I get through the validation screen. I wonder how the thieves changed OP’s financial account credentials?

My banks are not consistent on how they handle this, including banks where I have loans but no other accounts. And it also seems things are different in UK from US.

 

[monstermash]

All my Apple products are associated to an mobile device manager (MDM). Thief steals phone, I can still track it and see everything they do. I can even remotely hide all the apps except the settings app. Restore if I wish ( but then I lose access to tracking until someone signs back in ). There is no way to remove the MDM, once installed. They are typically free for a small number of devices (~10 to 20).

Happy thoughts to the OP, hope you get your account sorted.

Which one do you use?

 

[onenorth]

Agreed. If my debit card is stolen and they have my PIN, I’d lose a lot of money. I don’t keep it all on that account, but enough where I’d be very upset.

Losing money is bad but identity theft is worse.

 

[monstermash]

Agreed. If my debit card is stolen and they have my PIN, I’d lose a lot of money. I don’t keep it all on that account, but enough where I’d be very upset.

I don't carry a debit card, but if I did, I would not keep more than $200 or so in that account.