Apple has updated its official support documentation to include explicit warnings regarding phishing attempts targeting users who have reported their devices as lost or stolen. The company now warns that thieves are increasingly using fraudulent messages—often disguised as official Apple support notifications—to trick victims into revealing their Apple ID credentials or passcodes to bypass Activation Lock.
How Phishing Attacks Target Stolen iPhone Owners
According to official Apple support documentation, attackers who gain possession of an iPhone often attempt to deceive the original owner after the device has been placed in “Lost Mode.” The goal of these bad actors is to disable the Activation Lock, a security feature designed to prevent unauthorized users from resetting or using a device without the owner’s permission.
Criminals typically send SMS messages, emails, or even automated phone calls claiming that the device has been located or that an Apple support agent requires verification to “unlock” the handset. These communications frequently contain links to fraudulent websites that mimic the legitimate Apple ID login portal. If a user enters their credentials on these sites, the attacker gains the necessary information to remove the device from the owner’s “Find My” account, effectively rendering the security lock useless.
Why Attackers Prioritize Activation Lock
Activation Lock remains the primary barrier preventing the resale of stolen iPhones on the black market. By linking a device to a specific Apple ID, the feature ensures that even if a device is factory reset, it cannot be reactivated without the original owner’s password.
Security researchers note that this shift toward social engineering represents a change in tactics. Rather than attempting to crack hardware encryption, which is technically difficult, thieves now exploit the human element. By masquerading as authoritative technical support, attackers pressure victims into voluntarily relinquishing the keys to their security ecosystem.
How to Protect Your Apple Account
Apple advises users to remain vigilant against unsolicited contact regarding their devices. To maintain the integrity of your security, follow these established protocols:
- Verify the Source: Apple will never contact you via SMS or phone call to ask for your Apple ID password or your device passcode. Official communications regarding “Lost Mode” will only appear within the Find My app or on the iCloud website.
- Check URLs Carefully: Always inspect the web address before entering login credentials. Legitimate Apple services will always originate from an “apple.com” domain.
- Enable Two-Factor Authentication: Ensure two-factor authentication is active on your Apple ID. This adds a critical layer of defense, as a password alone will not be enough for an attacker to gain access to your account.
- Never Share Codes: Do not provide verification codes sent to your trusted devices to anyone, regardless of whether they claim to be from Apple Support or law enforcement.
What to Do If You Lose Your Device
If your iPhone is stolen, the most effective step is to mark it as lost using the Find My network. Do not remove the device from your account even if you believe it is permanently gone. Removing the device from your account effectively disables Activation Lock, allowing the thief to wipe the phone and sell it as a functional unit. Keeping the device in your account ensures it remains a “brick” to anyone else, which significantly reduces its value to thieves and discourages further attempts to steal Apple hardware.