A growing method of iPhone theft is leaving victims locked out of their devices, unable to access personal data such as photos and messages. According to a recent report from The Wall Street Journal, thieves are exploiting a security feature known as the recovery key to take over iPhones and, in some cases, drain victims’ bank accounts after accessing their financial apps.
While this type of attack is difficult to carry out, it highlights a troubling trend. Thieves must first observe or manipulate users to obtain their passcode—often by watching them in public settings like bars or events. Once the thief has both the passcode and the device, they can change the Apple ID, disable “Find My iPhone” to avoid being tracked, and reset the recovery key. This 28-digit recovery key is intended to protect users from hackers, but if a thief resets it, the original owner is locked out of their Apple ID permanently.
Apple acknowledges the issue, stating, “We sympathize with people who have had this experience and we take all attacks on our users very seriously, no matter how rare,” according to a statement to CNN. The company urges users to secure their devices by keeping track of trusted devices and their recovery key, warning that losing access to both could result in permanent account lockout.
Jeff Pollard, a VP at Forrester Research, suggests Apple could improve customer support and offer more ways for users to verify their identities in such cases. In the meantime, users can take several steps to protect themselves.
Protect Your Passcode
The most important defense is keeping your passcode secure. Apple recommends using Face ID or Touch ID to unlock your phone in public, minimizing the chance of someone observing your passcode. Users can also create a longer, alphanumeric passcode that’s harder for thieves to guess, and should change their passcode immediately if they believe it’s been compromised.
Use Screen Time Settings
A less conventional but potentially useful tactic is leveraging the Screen Time feature, which is designed to set restrictions for children’s device use. By enabling a secondary password in Screen Time, users can create an extra layer of protection. This would require a thief to input the secondary password before they could change the Apple ID or its password.
Regularly Back Up Your Phone
To minimize damage in the event of theft, regularly back up your phone to iCloud or iTunes. This will allow you to recover important data even if your iPhone is stolen. It may also be wise to store critical files in alternative cloud services, such as Google Photos, Microsoft OneDrive, Amazon Photos, or Dropbox, to ensure you don’t lose access to them.
While these measures won’t prevent an iPhone from being stolen, they can help limit the damage and make it harder for thieves to lock you out of your own device.
