Stolen iPhones fuel scary passcode scam

Your iPhone can feel nearly useless to a thief once you mark it as lost. Apple's Activation Lock can help turn a stolen device into a locked brick. That should make phone theft less profitable. Yet thieves have found a nasty workaround.

According to new research from Infoblox Threat Intel, the cybersecurity research team at Infoblox, criminals are using fake Apple pages, smishing texts and Telegram-based unlocking tools to trick stolen iPhone owners into handing over their passcodes.

Infoblox Threat Intel tracks cybercriminal activity partly by studying DNS, the system that helps devices find websites online. Think of DNS as the internet's phone book. By watching patterns in suspicious website names and traffic, researchers can spot fake domains, phishing pages and larger scam networks.

The scary part is how personal the scam can feel. The thief may already have your phone. The message may arrive right after the theft. The fake page may even show what looks like your iPhone moving on a map.

WHY IPHONE USERS ARE THE NEW PRIME SCAM TARGETS

Researchers found that many thieves care less about the data on the phone and more about turning the device into resale cash. Once they get your passcode, they can remove protections, wipe the device and sell it.

Here is the part that feels especially cruel. When you lose an iPhone, you may put a message on the lock screen with a phone number to call. That feature can help a good person return your device. A scammer can use that same number to contact you.

In one case described by the researchers, a stolen iPhone owner received a text shortly after the theft. The message linked to a fake Apple-style website. The page showed what looked like a moving phone location on a map. Then it asked for the phone's PIN code. Had the victim entered it, the thief would have gained control of the device. That is what makes this scam so believable. The thief may really have your phone. The message may arrive at the perfect moment. The fake page may look close enough to Apple's real Find My experience to catch someone who is stressed and trying to recover an expensive device.

A locked iPhone has limited resale value. An unlocked iPhone can be wiped, removed from an Apple account and sold for much more. The researchers found Telegram groups selling phone unlocking services. Some tools target older phones. Others help criminals collect information about newer devices so they can build a more convincing phishing attack. These services can include "Find My iPhone Off" kits, fake Apple login pages, AI voice call tools and prerecorded messages that impersonate Apple.

The pricing also makes this underground business easy to enter. Some unlocking attempts cost only a few dollars. According to the research, unlocking a recent iPhone can cost anywhere from $5 to $50, depending on the seller, with an average price below $10.

That low cost helps explain why this scam can spread. A thief no longer needs deep technical skills. They can buy a kit, follow instructions and send a polished scam message.

The scam does not stop with one generic text. Criminals can customize phishing pages with details pulled from the phone or from linked accounts. That can include the victim's name, email address, device details and even whether the passcode has four or six digits. The fake page may also show a chosen location on a "lost iPhone" map. Then the scammer sends the link by text, WhatsApp or email.

Once the victim enters credentials or a passcode, the information can go straight back to the attacker through Telegram. From there, criminals can remove linked devices from the Apple Account and prepare the phone for resale. That is why the message can feel oddly personal. The scammer may know enough to make the alert feel urgent and official.

Researchers identified more than 10,000 domains tied to these phone unlocking tools and smishing campaigns. Many used Apple lookalike names or generic customer-support wording, such as fake location and phone-finding themes. They also found that traffic to verified smishing domains rose 350% in 2025 compared with the previous year.

Some tools even try to fight security blocks. The research found scripts that check whether smishing domains are blocked. Then those scripts submit fake explanations to try to get them removed from Google Safe Browsing warnings. That means criminals are not only building fake pages. They are also working to keep those pages online long enough to fool victims.

DON’T GET CAUGHT IN THE 'APPLE ID SUSPENDED' PHISHING SCAM

If your phone gets stolen, the most dangerous message may arrive after the theft. You may be worried, angry and desperate to track your device. That is exactly the moment scammers want. A message claiming to be from Apple, Find My or customer support can feel helpful.

However, Apple will not ask you to enter your iPhone passcode through a random link sent by text or WhatsApp. The passcode is the prize. Once you give it up, you may help the thief turn your locked phone into a sellable device.

If your iPhone goes missing, a few calm steps can help you avoid handing thieves the one thing they need most: your passcode.

Your iPhone passcode should stay on your iPhone. Do not type it into a website that arrives by text, email or WhatsApp, even if the page looks like Apple.

If your iPhone is missing, use the Find My app on another Apple device or go directly to iCloud through your browser. Do not use a link from a message.

Scammers love pressure. A message may say your phone has been found, moved or scheduled for removal. Pause before you click. Open Apple's tools yourself instead.

Avoid simple codes such as birthdays, repeating numbers or easy patterns. A longer alphanumeric passcode gives thieves a much harder target.

Make sure Find My is enabled before anything happens. On iPhone, go to Settings > your name > Find My > Find My iPhone and confirm that Find My iPhone is turned on.

If your iPhone is stolen, keep it listed in Find My and your Apple Account. Removing it can also remove Activation Lock, which helps stop someone else from erasing, activating and reselling your phone. If you use Find My, select the stolen iPhone and choose Mark As Lost or Erase This Device if needed. Avoid Remove This Device unless Apple Support, your carrier or law enforcement tells you to do it.

FIND A LOST PHONE THAT IS OFF OR DEAD

Strong antivirus software can help block malicious links, phishing pages and scam sites before they do damage. It can also warn you when a site looks unsafe. Get my picks for the best 2026 antivirus protection winners for your Windows, Mac, Android and iOS devices at CyberGuy.com.

Report the stolen phone to local police and your wireless carrier. Your carrier may be able to suspend service or block the device from the network.

Yes. Android phones have their own anti-theft protections, but thieves may still try a similar trick. Instead of asking for an iPhone passcode, a scammer may send a fake Google, Find My Device, Find Hub, Samsung Find or carrier message after your Android phone is stolen.

The message may claim your phone was found, moved or ready to be recovered. Then it may send you to a fake page that asks for your Google account password, Samsung account password or screen lock PIN, password or pattern.

That information can help a thief get around protections that make a stolen Android phone harder to reset and resell. Google’s Factory Reset Protection can require the previous Google account or screen lock after an unauthorized reset. Samsung says Google Device Protection works on Galaxy phones when a Google account and lock screen are set up.

The advice is the same: do not use a link from a text, email or WhatsApp message to recover a stolen Android phone. Go directly to Google’s Find Hub, Samsung Find or your carrier’s official website yourself. Never type your phone’s screen lock or account password into a recovery page that arrived by message.

A stolen iPhone used to be a headache for thieves because Activation Lock made resale harder. Now, criminals are trying to make you part of the unlocking process. They do it with fake Apple pages, carefully timed texts and slick-looking maps that play on panic. The safest move is to slow down. If your phone disappears, use Apple's official Find My tools and ignore any message that asks for your passcode. That very code may be the one thing standing between a locked brick and a payday for a thief.

Should phone makers and wireless carriers do more to stop stolen phones from being resold, or is the responsibility mostly on users to lock down their devices? Let us know by writing to us at CyberGuy.com.

Sign up for my FREE CyberGuy Report

Copyright 2026 CyberGuy.com. All rights reserved.