Apr 20, 2023 19:00:00

If your iPhone is stolen and your passcode is seen, you may lose access to your Apple ID forever.

In February 2023, the Wall Street Journal published

a report about people who had their iPhones stolen. Many victims have complained that they were seen entering their lock screen passcodes at bars or other public places, and if they knew the multi-digit passcode, they could be charged large sums of money on payment apps, etc. I was looking for ways to improve the situation. Following this, the Wall Street Journal published a new report on April 19th, reporting that victims who learned their passcodes were locked out of their accounts.

The iPhone Setting Thieves Use to Lock You Out of Your Apple Account - WSJ
https://www.wsj.com/articles/the-iphone-setting-thieves-use-to-lock-you-out-of-your-apple-account-716d350d

As The Wall Street Journal revealed in February, thieves are increasingly capturing iPhone users' passcodes in public, then stealing the devices and gaining widespread access to payment apps and other sensitive information. I am.

There have been reports of crimes in which iPhones whose passcodes have been seen are stolen and bank accounts are accessed illegally - GIGAZINE

A thief who knows an iPhone's passcode can easily reset a victim's Apple ID password in the Settings app, even if Face ID or Touch ID is enabled. You can then turn off Find My iPhone to prevent the device owner from tracking your device's location or remotely erasing your device's data via iCloud.

After this report was published, dozens of people began reporting that they had suffered the same damage. The Wall Street Journal investigated the reports and found that the victims had something in common.

Among the victims who claimed their iPhones and passcodes were stolen, many provided information about `` recovery keys ,'' 28-character codes that would restore access to their Apple IDs. This key is required by Apple when you reset your Apple ID password or regain access to your Apple ID, and once you create the key, you can use the key and your device to regain access to your Apple ID. You will need both.

You can create a recovery key as long as you know your device's passcode, and even if one has already been created, you can easily create and confirm a new recovery key. Victims who have had both their devices and recovery keys stolen are unable to even reset their Apple IDs, so they are complaining that they are helpless.

Many of the victims did not even know about the existence of the recovery key in the first place, and there are reports that they later found out that they had been set up by a thief without their knowledge. As Apple's website states, losing access to both your trusted device and your recovery key 'may permanently lock you out of your account.' The report shows that if you obtain both, you will easily lose your recovery key and be locked out of your account.

Andrew Shikiar of the FIDO Alliance, a non-profit organization that manages security measures taken by companies such as Apple, said, ``The main challenges for tech companies are users forgetting passwords, not being able to access two-factor authentication methods, etc. 'This is to help users identify themselves if they lose their device.'

Tech companies are deploying a variety of methods to recover accounts, such as LinkedIn's work and ID verification, and Instagram's requirement to upload a selfie video. Masu.

Some of the victims requested recovery by presenting identification documents such as driver's licenses and passports, and some even insisted on DNA tests and retinal scans. However, Apple said, ``Due to privacy concerns, there is no such record,'' and that it would be difficult to recover the account. Many victims are reportedly confused by the lack of a way to prove ownership of their accounts.

In response to this report, Apple issued a statement saying, ``We are always investigating additional protections against emerging threats like this one.'' 'We sympathize with those who have experienced this and take all attacks against our users seriously. We work tirelessly every day to protect our users' accounts and data.' Ta.

To avoid such damage, the Wall Street Journal advises that you should use Face ID or Touch ID as much as possible in public places and refrain from entering your passcode.