iPhone Passcode Scam Exploits Stolen Devices, Researchers Warn

Cybercriminals have developed a new tactic to profit from stolen iPhones by tricking owners into revealing their passcodes through fake Apple-themed websites and smishing text messages, according to research from Infoblox Threat Intel. This scam aims to bypass Apple's Activation Lock, which normally renders stolen devices difficult to resell.

Researchers at Infoblox Threat Intel, a cybersecurity research team, monitor criminal activity by analyzing DNS traffic. They have observed a rise in scams where criminals use fake Apple pages, smishing texts, and tools distributed via Telegram to obtain passcodes from the owners of stolen iPhones. The goal is to remove device protections, wipe the phone, and enable its resale.

How the Scam Unfolds

The scam often begins shortly after a phone is stolen. A victim might receive a text message with a link to a convincing, fake Apple-style website. This page can mimic Apple's legitimate "Find My" service, potentially displaying a map showing the phone's location. The site then prompts the user to enter their passcode. If the victim complies, the passcode is sent directly to the attacker.

This method is particularly effective because it plays on the victim's urgency and panic after losing an expensive device. The appearance of a real-time location or a message that seems to originate from Apple can make the scam highly believable.

The Value of the Passcode

While a locked iPhone has limited resale value, an unlocked device can be wiped, removed from an Apple account, and sold for significantly more. The underground market, particularly on Telegram, offers tools and services for unlocking iPhones. These services range in price, with some unlocking attempts costing as little as a few dollars, making the scam accessible to individuals without advanced technical skills.

Criminals can personalize these phishing pages with details potentially gleaned from the stolen phone or linked accounts, such as the victim's name and device information. They can also create fake login pages, AI voice tools, and prerecorded messages impersonating Apple support.

Scale of the Operation

Infoblox Threat Intel identified over 10,000 domains associated with these iPhone unlocking tools and smishing campaigns. Many of these domains use names that resemble Apple's branding or employ generic customer support language. The research also indicated a 350% increase in traffic to verified smishing domains in 2025 compared to the previous year. Criminals are actively working to circumvent security blocks, including submitting fake explanations to get malicious domains removed from Google Safe Browsing warnings.

Protecting Against the Scam

To mitigate the risk of falling victim, security experts advise iPhone users to take several precautions:

• Never enter an iPhone passcode through a link received via text, email, or WhatsApp, even if the page appears legitimate.
• If an iPhone is lost or stolen, use the official Find My app on another Apple device or access iCloud directly through a web browser, rather than clicking on links from suspicious messages.
• Treat urgent recovery messages with suspicion. Scammers often create a sense of pressure. It is advisable to pause and open Apple's official tools independently.
• Use a strong, non-obvious iPhone passcode. Avoid simple sequences or personal information.
• Ensure Activation Lock is enabled by checking that "Find My iPhone" is turned on in the device's settings.
• Avoid removing a stolen iPhone from an Apple Account too quickly, as this can disable Activation Lock. Instead, use the "Mark As Lost" or "Erase This Device" options within Find My.
• Consider using reputable antivirus software to help block malicious links and phishing sites.
• Report stolen phones to local law enforcement and the wireless carrier.

The same scam tactics can also be applied to Android devices, where criminals may attempt to trick owners into revealing Google account passwords or screen lock credentials through fake recovery messages.

Ultimately, the passcode is the key to unlocking the resale value of a stolen iPhone. By understanding these scam tactics and adhering to security best practices, users can better protect their devices and personal information.