New Apple ID scheme targets owners of stolen iPhone devices

The Swiss National Cyber Security Centre (NCSC) has issued a warning about a surge in phishing scams that target individuals who lost their iPhones months earlier.

Victims report receiving deceptive messages claiming their device has been found overseas, an emotional bait that leads to credential theft and full Apple ID compromise.

According to the NCSC's bulletin, these phishing attempts are particularly dangerous because they leverage genuine details extracted from the stolen phone itself, such as model, color, and storage capacity, to add credibility. The messages are typically sent via SMS or iMessage and appear to originate from Apple. They contain a link that purportedly shows the phone's current location, but actually redirects victims to a convincingly spoofed Apple login page. If the user enters their credentials, attackers gain full access to the associated Apple ID.

The underlying objective of these scams is to disable Apple's Activation Lock, a security mechanism that permanently ties the iPhone to its owner's Apple ID. This feature renders stolen devices unusable and nearly impossible to resell. Since the Activation Lock cannot be bypassed through technical means, attackers rely on social engineering to deceive victims into removing the lock themselves.

The exact method by which attackers retrieve the victim's phone number is unclear, but the NCSC outlines several possibilities. If the SIM card remained active in the lost phone, the number may still be accessible. Another likely vector is Apple's “Lost Mode” in the Find My app, which allows owners to display contact details, such as a phone number or email, on the lock screen. While this can be helpful if the phone ends up in honest hands, it also provides a direct line for scammers to launch personalized phishing attacks.

Apple has not commented on these specific incidents, but it is important to understand that the company does not send notifications by text message or email regarding the location of lost devices.

The NCSC recommends the following steps for iPhone users to protect themselves:

• Ignore unsolicited messages claiming a lost device has been found.
• Do not click on links in such messages, and never enter Apple ID credentials on pages opened from these links.
• Immediately enable Lost Mode through the Find My app or via iCloud.com/find when a device goes missing.
• Be cautious with contact details shown on the lost device's lock screen. Use a dedicated email address, and avoid providing personal phone numbers.
• Keep your SIM card protected with a PIN code to prevent attackers from accessing the associated phone number.