Transcription
I was outside a bar in New York City, and my phone was stolen out from my hands. Within three minutes, I was locked out of my own Apple ID, and within 24 hours, I noticed that there were thousands of dollars being taken out of my bank account.
People have been reaching out to me with stories like this lately. Their iPhones are stolen, and all the protections and security they thought they had didn't matter: bank account emptied, credit cards opened, no more access to photos, contacts, and anything in their iCloud. Their digital lives. Gone.
How it all leads back to the theft of the iPhones. Passcode. It turns out that code that can unlock your phone can also help someone else unlock your entire digital life. You lose your phone, you don't think about how you can lose everything else.
I'm a good Apple customer. I back everything up to iCloud, and I thought I would come back home, log in on my Macbook, and everything just would be fine. That's not what happens. Once you take over someone's Apple ID, it's game over for them.
After months of reporting, I've been able to break down how these attacks are happening and how you can better protect yourself, at least until better protections exist. At a bar at night. That's where many of these stories begin. I was distracted, and then the phone was gone. He was next to me, he grabbed the phone, and then disappeared.
Rayon's story is similar to many others in New York and around the country, but it's 1300 miles away from New York that they've pinned down what's happening. Investigators say thieves worked together to steal phones, then use apps to take hundreds of thousands of dollars. In Minneapolis, 12 people have been charged in a phone robbery ring where nearly $300,000 had been taken from at least 40 victims.
This is the arrest warrant for one of the people accused in that scheme. It says the group targeted bar-goers, often by befriending them, and then transferred large sums of money via various financial apps on the stolen phones. So, I tracked down Sergeant Robert Illestschko, the lead investigator on the case, to find out more about how these thieves got into the phones.
"Do you think there's a chance you put in your passcode that night?" "Potentially. Yeah. And that's why the entirety of security cannot hinge on those six digits."
Similar crimes have been reported in Austin, Denver, Boston, and London. And in New York, Reagan is amongst hundreds of victims, according to people familiar with the investigations. Some victims in those cities say they believe they were drugged before their phone was taken.
When I reached out to Apple for comment, here's what they said: "We sympathize with users who have had this experience, and we take all attacks on our users very seriously. No matter how rare, the thefts described are uncommon and require multiple physical steps. Stealing a user's device is not enough. We will continue to advance the protections to help keep user accounts secure."
But can an iPhone passcode really unlock your entire financial and personal life? Let's pretend this is Reagan's iPhone 13 Pro Max, and the thieves observed the passcode. In every story I've heard, the thieves' very first step was to change the Apple ID password to lock the owners out. This way, they could turn off Find My iPhone so the phone couldn't be located.
"You realize your phone has been stolen. What do you, what do you do next?" "At the bar? I log in to Find My iPhone on my friend's phone right away." "I wasn't able to do that because in three minutes that had passed, my Apple ID password, which I'm absolutely sure of, by the way, was changed."
To change the Apple ID password on an iPhone, all someone has to do is go to Settings, tap the iCloud name, then Password & Security, and Change Password. Then you're prompted for, yes, the iPhone's passcode. Input it, and you can create a new passcode for the Apple ID. And the thief can then use that to turn off Find My iPhone. With the passcode, they can log the owner out of their other trusted devices like iPads and Macs, change the trusted phone number, and add something called a recovery key. Adjusting all that can further lock you out of your account, potentially forever.
"I've had my Macbook for way too long. I'm almost embarrassed to say it on camera, honestly, and it's, it's locked out. I tried every avenue through Apple support. Then I realized the bank transactions, and that's when it hit me that this is way beyond just a petty phone theft."
After the Apple account, it's onto the money. All eight of the victims I spoke with said they had thousands of dollars taken in the first 24 hours after the theft. "I saw that they transferred some money from my savings account to my checking account and then took a whole bunch in the form of application." "You say a whole bunch? How much?" "About $10,000."
How do they get the money? Reagan and others I spoke with had the passwords to their bank apps saved in Apple's built-in password manager. So when you go to a bank app, the software tells you the password is saved. All you need is a Face ID scan or, yes, the phone's passcode to get in. And if the app requires a text message code to confirm it's really you, well, the thieves already have your phone. They go after other financial apps: Venmo, Coinbase, Zelle. I've heard them all. And they can use Apple Pay because that just needs the passcode to.
So, I got the email that an Apple Card titanium has been approved in my name. And shortly afterwards, I also got some receipts, some charges of like $5,000. Thieves opened those Apple credit cards using a victim's Social Security number, which may be found in photos of documents stored on the phone.
What about Android? Do you have a sense of why that is? That said, the passcode can do a lot of the same in Google's operating system. Most of the people who had their phone stolen got the money back by filing fraud reports with the banks and other financial companies. But some of them remain locked out of their Apple accounts, unable to access years of photos, notes, contacts, recordings, and more.
"I've been using iCloud for 15 years for them to store my memories and keep them safe, and they're all gone. And being told permanently that I've lost all of those memories has been very hard."
An Apple spokeswoman said that the company's account recovery policies are in place to protect users from unauthorized access to their accounts. While reporting this story, I've been really freaked out by all of this. When you look at this board and see how a short string of numbers can unravel your whole digital life, you realize it's time to do something more, at least until Apple figures out some solutions to this vulnerability.
So, I'm going to ask you to do three things to protect yourself, the same three things I've done on my own iPhone. Make your passcode stronger. Go to Settings, Face ID & Passcode, and make it at least six digits. Even better, make it an alphanumeric code. Treat it like an ATM PIN. On some financial apps, such as Venmo, you can go to the app settings to enable additional passcode protection. Just don't pick the same passcode as your phone, of course. Using Face ID and Touch ID will also help you avoid using your passcode in public.
Next, rethink your password manager. Go to Settings, Passwords, and remove any passwords and login info to the banks and other financial apps on your iCloud Keychain. For now, you're better off with a third-party password manager that requires a separate password for access.
Finally, delete photos with sensitive personal information. Go to Photos and delete images of your driver's license, passport, tax forms, etcetera. Keep them in a password-protected third-party password manager instead. Yes, there's more that you can do, but there's also more that Apple can do to lessen the power of the passcode, which right now can unlock pretty much everything in your life.