How thieves are watching iPhone owners publicly tap their passcodes to lock victims out of accounts, access data, and loot financial apps after stealing devices
The passcode that unlocks your phone can give thieves access to your money and data; 'it's like a treasure box'
Wall Street Journal
Context & Ripple Effects
The reported theft pattern extends a longer iPhone-account abuse problem: earlier iCloud-unlocking schemes targeted account controls to make stolen devices resalable, while this method uses a watched passcode to take over the owner’s account and data access.
Later coverage shows Apple moved toward Stolen Device Protection, which limits sensitive account changes outside familiar locations. That response matters because it adds a second check where possession of the device and knowledge of its passcode had been enough.
First-order effects
Victims whose passcodes are observed can lose control of their iPhone accounts and data after a device theft, while thieves can reach financial apps tied to the phone.
Apple faces a security gap in which the device-unlock credential can also authorize high-impact account changes.
Second-order effects
Apple’s later Stolen Device Protection shifts sensitive actions such as Apple ID password resets toward location-aware safeguards rather than relying on the passcode alone.
Stronger protections can also raise recovery friction for legitimate owners, as users later reported difficulty regaining accounts after thieves used Recovery Key settings to lock them out.
Third-order effects
If this pattern persists, mobile-account security will move from a single-device-passcode model toward layered checks for account recovery and financial access, balancing theft resistance against owner recovery.
The iPhone becomes a more consequential identity and financial-control point, making protections around account changes—not only screen unlocking—the central security boundary.
The trend: Smartphone security is shifting from protecting the handset alone to protecting the account, data, and financial authority that a stolen unlocked device can control.
It's absolutely stupid that a passcode is enough to change an Apple ID *password* on a stolen iPhone. I didn't even realize that was a thing. https://twitter.com/...
This (thieves stealing phones to access bank apps) has been a problem for a long time in Brazil. But now that it's affecting people in the US, maybe Apple will care more and do something to change this.
📺 NEW VIDEO Inspired by @JoannaStern's latest video, here are 7 ways to make your iPhone and iPad devices more secure! https://www.youtube.com/... https://twitter.com/...
This is a story about crimes happening across the country, but this is also about how Apple has put so much power in the passcode. That single string of digits allows a thief to: 🔴 Change an Apple ID password 🔴 Access iCloud keychain passwords 🔴Use Apple Pay (🧵2/7)
I've been reporting on Apple for over a decade and I didn't know or long forgot that you can reset an Apple ID password on an iPhone by simply entering the four-digit passcode - no other steps required! Keep your iPhone and passcode very safe.
I think this report does a great job educating people on the danger of entering your iPhone's passcode in public absent-mindedly. - Use Face ID or Touch ID as much as possible - Hide your passcode with your hands if you can - Consider switching to an alphanumeric passcode https:/…
I really didn't expect being able to change my iCloud password after entering just the pin code. Cleaning my iCloud keychain and upgrading the pin today. Thank you for heads up, @JoannaStern! https://www.wsj.com/...
Solid story on the problem of storing basically everything in your life on one device, leaving you vulnerable to an attacker who just needs your phone and password A Basic iPhone Feature Helps Criminals Steal Your Entire Digital Life @WSJ https://apple.news/...
.@nicnguyen and I teamed up on this story. As soon as we started digging in we realized we didn't have enough protection on our own iPhones. Here's our column on how to protect yourself. Seriously, switch to an alphanumeric passcode NOW. https://www.wsj.com/... (🧵5/7)
If this has happened to you or a friend, I'd like to hear about it. For months I have been interviewing people and it's clear not enough are talking about it—whether to law enforcement, banks and more. You know where to find me! https://www.wsj.com/... (🧵 7/7)