Stolen iPhone - Criminals have full control and Apple cannot help!

[Wando64]

That's a good approach. Of course, if you use the keychain, while the passcode doesn't authenticate you on your banking app, a thief can access your keychain with your lock screen passcode....and then get into your bank.

And alas 2FA doesn't solve it because that SMS goes......right to your phone, and you can access your 2FA with that same Lock Screen passcode.

And if you got a little fancy and used email for your 2FA, that doesn't solve it either, since your Lock Screen passcode also opens your email there on your phone.

I guess the simple solution, until Apple stops forcing users to use the same passcode for the Lock Screen as for keychain as for almost every other OS level change on the phone is to not use keychain?


Yeah, I agree, Apple could mostly close this loop by allowing a different authentication be used for keychain versus the Lock Screen.

My concern about FaceID was a little different.

If FaceID allows access to your banking app, a thief doesn't need your special banking PIN to use your banking app.

They just need to go into Settings on the phone, and add their face to your phone. And all they need for that is the same screen unlock passcode they already have!

Then they back out to the banking app, and it lets them in with their face! They never needed your special banking app PIN.

Or at least that is how my bank's app works.

But this, luckily, is NOT required by Apple. That is, Apple allows the creators of the banking app to lock out all Face ID is the app notices that someone has added a new face to the phone's OS. That way, a thief cannot just add their face to the phone and use it to unlock an app that allowed use of the FaceID.

In such a scenario, the first time you try to use your banking app AFTER someone has added a FaceID to the OS, the banking app says "Nope sorry you need to use your app specific password before you can re-enable FaceID authentication as an option." Now, THAT is a smart way to code the app.

And I am sure glad option makes that an OPTION for app developers!

But it is not a mandatory feature, and, as I say, my banking app doesn't do that!!! So it actually means using my bank on a web browser may be more secure, or not using biometrics at all, or something like that.

Is this a UK Bank?
Would you mind mentioning the name?

EDIT: by the way, even if you could enter my banking apps with Face ID you would still need the Debit card details to make a payment to a NEW payee.

 

[onenorth]

Security questions are a joke.

I still think one code to unlock device and another to change or view selected items (if turned on).

This is perfectly reasonable. The unlock code on my Apple Watch is different from my phone's passcode.

 

[jaworq]

1 code to unlock, 2nd code to change items, 3rd code to access bank app, 4th code for advanced data protection, 5th, password to iCloud, 6 for Screen time, 7 for hidden apps, 8, 9, 10? You have good memory guys Apple, they want more codes xD

 

[Puonti]

1 code to unlock, 2nd code to change items, 3rd code to access bank app, 4th code for advanced data protection, 5th, password to iCloud, 6 for Screen time, 7 for hidden apps, 8, 9, 10?

Kidding aside, using different secrets ("passcodes" / "passwords") for different things is simply good security practice.

For some things you should of course use complex secrets (10, 20, 30 characters), but if for example the 4-digit Screen Time passcode could only be bypassed with the owner's Apple ID password or through a time-delayed recovery method that requires online connectivity it would give the owner time to lock a stolen device down through another Apple device or the iCloud website.

 

[turbochgd]

After reading your terrible experience it got me thinking about my own phone’s security and specifically the numeric passcode. Did a G search and the Apple.support thing indicates alphanumeric codes can be set. I’ve 14promax latest software etc but I can’t see this option.

Didn’t look like anyone answered you on this. You can find the alphanumeric option in “change password” then “passcode options”. I think it gives you three different options one of which is alphanumeric.

 

[max2]

This is really disturbing. Just a moment ago, I had to type the passcode in the grocery store, because Apple Pay decided it couldn't recognize my face. After having read this thread, earlier this morning, I really, really didn't want to type the passcode. I guess I have to also bring my contactless card from now on. But that defeats the purpose of having Apple Pay...

I always retype my passcode before leaving the house to be sure.

 

[AlixSPQR]

I always retype my passcode before leaving the house to be sure.

Does that ensure you don't have to type in the passcode if Apple Pay suddenly decides it doesn't recognize your face? 🤔

 

[max2]

Does that ensure you don't have to type in the passcode if Apple Pay doesn't recognize your face? 🤔

No but that is why I have more than one face scan for backup too.

 

[jaworq]

Security questions are a joke.

I still think one code to unlock device and another to change or view selected items (if turned on).

But you always remember a good joke (answer to security question)

 

[Cunir]

After reading this marathon thread and accepting that it's impossible to be 100% secure if they take your phone and know your passcode, I figure the only things you can really do are 1) have a strong alphanumeric passcode and never type it in public, 2) have your watch unlock your phone for those few times when FaceID doesn't do it, 3) turn on screentime and don't allow account or passcode changes, which might stop some unknowledgeable thieves.

But that's about it. Stronger security measures will have to wait for Apple to come up with something

 

[max2]

After reading this marathon thread and accepting that it's impossible to be 100% secure if they take your phone and know your passcode, I figure the only things you can really do are 1) have a strong alphanumeric passcode and never type it in public, 2) have your watch unlock your phone for those few times when FaceID doesn't do it, 3) turn on screentime and don't allow account or passcode changes, which might stop some unknowledgeable thieves.

But that's about it. Stronger security measures will have to wait for Apple to come up with something

Nothing is 100% secure.

If it is online it can be hacked.

 

[AlixSPQR]

No but that is why I have more than one face scan for backup too.

Very interesting.

 

[TechnoMonk]

No but that is why I have more than one face scan for backup too.

Very interesting.

Yep, i have simple scan with no head gear or something I wear outside. I have another face scan with a baseball hat/cap. Never had issue of faceid in public except those card readers behind the bar counters. I just use Apple Watch for Apple Pay.

 

[Bogstandard]

Sorry for your loss.
I'm not sure why Apple is to blame for this problem.
If the owner is oblivious to his surroundings while using the device, or entering the access codes, why is the company to blame.'

People need to be more mindful of their surroundings, and that includes walking across a busy street with their face in their phone screen.
The target is usually observed for some time before the phone is selected for theft.
Lax behaviour by the user is the "go button".
Awareness of cctv devices is also critical.
In the UK, people are accustomed to smaller personal spaces, than in the USA.
This dulls the situational awareness of most city dwellers.

Imo, the same applies to the new security keey system...those will be misplaced/stolen.

To the OP:
I think This was probably an inside job by one of your co-workers.
You were profiled by a familiar by sight/ security camera.


Cancel your cards and contesting any purchases made after the theft is probably all you can do.

It reminds me to re-read all the fine print pertaining to credit card data used on electronic devices.

 

[960design]

Assuming you're talking about an iPhone, are you using a Shortcut to disable airplane mode whenever it's enabled?

Yes, iPhone 14 Pro. No it is a feature of MDM. Command overview:

WiFiManagedSettings | Apple Developer Documentation

The payload you use to configure managed Wi-Fi settings.

developer.apple.com

There are several other MDM settings as well that work with the above to ensure device security; such as force Bluetooth control. This allows for iPhone tracking even when the device is turned off.

 

[960design]

So...I'm thinking about an old TV show, maybe 15 years ago. When you want to catch a pedophile...you lure them in with fake information and then arrest them (or show them on national TV).

So...why can't Apple make a slightly-alternative IOS for undercover police, and then lure these ******s by publicly typing in passcodes, letting the iPhones get stolen (which would be the first criminal act), then letting them think they are successfully resetting iCloud passwords (which would be the second more serious criminal act), then use the iPhone as a homing device to catch the thieves?

Do this a few thousand times...criminals start rethinking the risk/reward.

It is one thing to steal a $1000 phone - that's a certain level of theft.
It is another thing to steal an identity. That HAS to be worth serious fines and mandatory jail time.

A new YouTube series idea? Netflix or even the Comedy channel may pick it up.
Just be careful, there are some crazy people out there.

 

[960design]

However, in the grand scheme of things, this is likely small time compared to other challenges law enforcement have to deal with when likely already being understaffed and underfunded.

How about we pay cops and teachers more and congress less?

 

[960design]

After reading your terrible experience it got me thinking about my own phone’s security and specifically the numeric passcode. Did a G search and the Apple.support thing indicates alphanumeric codes can be set. I’ve 14promax latest software etc but I can’t see this option.

Is it not just Settings > FaceID & Passcode > Change Passcode > Passcode Option (below where it asks you to enter new passcode )?

 

[960design]

I think 2 security questions required to:
1. log off current iPhone user
2. change iCloud password
3. Factory reset
4. Change Face ID setttings
would do the job. Very simple to handle by anyone and could be quickly implemented by Apple.

Security questions are horrible. When I am required to answer them, bank for example, I put in the incorrect answers.
Q: What is your best friend's name when growing up?
A: Onomatopoeia

 

[960design]

This is really disturbing. Just a moment ago, I had to type the passcode in the grocery store, because Apple Pay decided it couldn't recognize my face. After having read this thread, earlier this morning, I really, really didn't want to type the passcode. I guess I have to also bring my contactless card from now on. But that defeats the purpose of having Apple Pay...

I use my Apple Watch for contactless payments. Very convenient!

 

[dk001]

Kidding aside, using different secrets ("passcodes" / "passwords") for different things is simply good security practice.

For some things you should of course use complex secrets (10, 20, 30 characters), but if for example the 4-digit Screen Time passcode could only be bypassed with the owner's Apple ID password or through a time-delayed recovery method that requires online connectivity it would give the owner time to lock a stolen device down through another Apple device or the iCloud website.

But if like many the only Apple device you have is an iPhone … and how many of these actually use the iCloud website?

We need a simple, effective solution any device owner can easily use. If Apple requires users to jump through hoops it is a fail right out of the gate.

 

[marvin_h]

1 code to unlock, 2nd code to change items, 3rd code to access bank app, 4th code for advanced data protection, 5th, password to iCloud, 6 for Screen time, 7 for hidden apps, 8, 9, 10? You have good memory guys Apple, they want more codes xD

But if like many the only Apple device you have is an iPhone … and how many of these actually use the iCloud website?

We need a simple, effective solution any device owner can easily use. If Apple requires users to jump through hoops it is a fail right out of the gate.

The option to user a different password for accessing different things should be AVAILABLE. (I'll leave it to other folks to decide whether to use that option.). The problem is, right now, it is not even an option.

Apple has basically said "one key to rule them all" even if you know and can handle and want to have more than one key. At least the option to separate the keychain from the same password used to unlock the phone screen.

 

[Newbie67]

After reading this marathon thread and accepting that it's impossible to be 100% secure if they take your phone and know your passcode, I figure the only things you can really do are 1) have a strong alphanumeric passcode and never type it in public, 2) have your watch unlock your phone for those few times when FaceID doesn't do it, 3) turn on screentime and don't allow account or passcode changes, which might stop some unknowledgeable thieves.

But that's about it. Stronger security measures will have to wait for Apple to come up with something

Agreed. Came to same conclusion except remove banking pwrds from keychain and store in encrypted pword manager

 

[marvin_h]

Agreed. Came to same conclusion except remove banking pwrds from keychain and store in encrypted pword manager

Yeah basically the Keychain is a bad idea as long as the screen unlock passcode can also open it. Its like having the key for your front door ALSO unlock the safe in your bedroom closet where you keep your money and guns.

 

[I7guy]

This is really disturbing. Just a moment ago, I had to type the passcode in the grocery store, because Apple Pay decided it couldn't recognize my face. After having read this thread, earlier this morning, I really, really didn't want to type the passcode. I guess I have to also bring my contactless card from now on. But that defeats the purpose of having Apple Pay...

What happens if you drop your phone on the way into grocery store. You can't pay for anything anyway. I carry around 1 credit card for an eventually like that.

After reading this marathon thread and accepting that it's impossible to be 100% secure if they take your phone and know your passcode, I figure the only things you can really do are 1) have a strong alphanumeric passcode and never type it in public, 2) have your watch unlock your phone for those few times when FaceID doesn't do it, 3) turn on screentime and don't allow account or passcode changes, which might stop some unknowledgeable thieves.

But that's about it. Stronger security measures will have to wait for Apple to come up with something

I'm pretty sure Apple will come up with something, what it is, is anyones guess. Whatever Apple comes up with, someone will be caught in it because they will lose a passcode or pin.