Stolen iPhones fuel scary passcode scam

Infoblox Threat Intel tracks cybercriminal activity partly by studying DNS, the system that helps devices find websites online. Think of DNS as the internet's phone book. By watching patterns in suspicious website names and traffic, researchers can spot fake domains, phishing pages and larger scam networks.

The scary part is how personal the scam can feel. The thief may already have your phone. The message may arrive right after the theft. The fake page may even show what looks like your iPhone moving on a map.

Researchers found that many thieves care less about the data on the phone and more about turning the device into resale cash. Once they get your passcode, they can remove protections, wipe the device and sell it.

Here is the part that feels especially cruel. When you lose an iPhone, you may put a message on the lock screen with a phone number to call. That feature can help a good person return your device. A scammer can use that same number to contact you.

A locked iPhone has limited resale value. An unlocked iPhone can be wiped, removed from an Apple account and sold for much more. The researchers found Telegram groups selling phone unlocking services. Some tools target older phones. Others help criminals collect information about newer devices so they can build a more convincing phishing attack. These services can include "Find My iPhone Off" kits, fake Apple login pages, AI voice call tools and prerecorded messages that impersonate Apple.

The pricing also makes this underground business easy to enter. Some unlocking attempts cost only a few dollars. According to the research, unlocking a recent iPhone can cost anywhere from $5 to $50, depending on the seller, with an average price below $10.

The scam does not stop with one generic text. Criminals can customize phishing pages with details pulled from the phone or from linked accounts. That can include the victim's name, email address, device details and even whether the passcode has four or six digits. The fake page may also show a chosen location on a "lost iPhone" map. Then the scammer sends the link by text, WhatsApp or email.

Once the victim enters credentials or a passcode, the information can go straight back to the attacker through Telegram. From there, criminals can remove linked devices from the Apple Account and prepare the phone for resale. That is why the message can feel oddly personal. The scammer may know enough to make the alert feel urgent and official.

Researchers identified more than 10,000 domains tied to these phone unlocking tools and smishing campaigns. Many used Apple lookalike names or generic customer-support wording, such as fake location and phone-finding themes. They also found that traffic to verified smishing domains rose 350% in 2025 compared with the previous year.

If your phone gets stolen, the most dangerous message may arrive after the theft. You may be worried, angry and desperate to track your device. That is exactly the moment scammers want. A message claiming to be from Apple, Find My or customer support can feel helpful.

However, Apple will not ask you to enter your iPhone passcode through a random link sent by text or WhatsApp. The passcode is the prize. Once you give it up, you may help the thief turn your locked phone into a sellable device.

If your iPhone goes missing, a few calm steps can help you avoid handing thieves the one thing they need most: your passcode.

Your iPhone passcode should stay on your iPhone. Do not type it into a website that arrives by text, email or WhatsApp, even if the page looks like Apple.

If your iPhone is missing, use the Find My app on another Apple device or go directly to iCloud through your browser. Do not use a link from a message.

Scammers love pressure. A message may say your phone has been found, moved or scheduled for removal. Pause before you click. Open Apple's tools yourself instead.

Make sure Find My is enabled before anything happens. On iPhone, go to Settings > your name > Find My > Find My iPhone and confirm that Find My iPhone is turned on.

Report the stolen phone to local police and your wireless carrier. Your carrier may be able to suspend service or block the device from the network.

The message may claim your phone was found, moved or ready to be recovered. Then it may send you to a fake page that asks for your Google account password, Samsung account password or screen lock PIN, password or pattern.

That information can help a thief get around protections that make a stolen Android phone harder to reset and resell. Google's Factory Reset Protection can require the previous Google account or screen lock after an unauthorized reset. Samsung says Google Device Protection works on Galaxy phones when a Google account and lock screen are set up.

The advice is the same: do not use a link from a text, email or WhatsApp message to recover a stolen Android phone. Go directly to Google's Find Hub, Samsung Find or your carrier's official website yourself. Never type your phone's screen lock or account password into a recovery page that arrived by message.

A stolen iPhone used to be a headache for thieves because Activation Lock made resale harder. Now, criminals are trying to make you part of the unlocking process. They do it with fake Apple pages, carefully timed texts and slick-looking maps that play on panic. The safest move is to slow down. If your phone disappears, use Apple's official Find My tools and ignore any message that asks for your passcode. That very code may be the one thing standing between a locked brick and a payday for a thief.

Sign up for my FREE CyberGuy Report

Copyright 2026 CyberGuy.com. All rights reserved.