For years, the Apple Activation Lock was your digital fortress. If your iPhone was lost or stolen, that lock turned the device into a useless brick, registered only to your Apple ID. Thieves knew they couldn't crack the code, the fingerprint, or the face ID.
But in a classic twist of fate, sophisticated cybercriminals are now skipping the technical battle entirely. They aren't breaking Apple's security—they're tricking owners into handing over the keys themselves.
The Swiss National Cyber Security Centre (NCSC) has issued a severe warning about a widespread, highly effective phishing campaign targeting iPhone owners who have reported their devices as missing.
The Human Vulnerability: How They Phish for Your Credentials
When you report a missing iPhone using Apple's Find My app, you are prompted to set a custom message on the lock screen. Almost everyone includes a contact number or email address hoping a kind stranger will return it.
This is the crucial step the thieves exploit.
-
Reconnaissance: A thief (or someone in the crime network) gets the stolen phone and sees your recovery contact details displayed on the screen.
-
Impersonation: They immediately send you a highly convincing message—via text, iMessage, or email—claiming your device has been found. Crucially, these messages often include specific details, like the phone’s model and color, copied directly from the stolen device to establish immediate trust.
-
The Bait: The message contains a link to a fake website meticulously designed to mimic the official Apple Find My service.
-
The Hook: The fraudulent site asks you for your Apple ID credentials to "verify" the recovery.
If you fall for the scam and enter your login details, you've just done the thief’s job for them. You have completely deactivated the unbreakable Activation Lock.
The Catastrophic Consequences of a "Wiped" Phone
Once they have your Apple ID credentials, the criminals gain full authority. They can remotely wipe the device, removing the Activation Lock, returning it to factory settings, and selling the now-activated phone for maximum profit in the underground global supply chain.
But the danger doesn't stop at the phone. They can also use your Apple ID to:
-
Lock You Out of all your Apple services and devices (even your replacement phone).
-
Access Your Digital Life: This includes your photos, emails, banking apps, and sensitive corporate data, giving them carte blanche to your entire digital existence.
-
Launch Further Attacks using your identity and contacts.
StormWarning! Action Plan: Stop the Phishers
The good news is that Apple's Activation Lock works—the bad news is that the human element is being exploited at scale, often via "phishing-as-a-service" toolkits sold for profit.
Your security is in your hands. Take these steps NOW:
-
NEVER TRUST UNSOLICITED "APPLE" MESSAGES: The NCSC explicitly warns that Apple will never text or email you about a recovered device. Assume any such message is a scam.
-
USE A DEDICATED RECOVERY CONTACT: When you enable Lost Mode, use a different contact number or email address that is not linked to your primary Apple ID or personal phone. This stops criminals from easily targeting you.
-
PROTECT YOUR SIM: Immediately enable PIN protection on your SIM card. If the phone is stolen, contact your carrier right away to block or replace the SIM.
-
BE AWARE: Criminals may wait weeks or months after the theft before sending the phishing text, waiting for your guard to drop. Stay vigilant.
A little forethought now is the only barrier between a petty phone thief and full access to your most intimate digital assets.
This crucial security notice was brought to you by StormWarning!
Is your team secure? Find out more about how StormWarning! can assist to harden your organisation against CyberCrime!