How iPhone Thieves Bypass Security—and What You Can Do About It
The Dark Art of Phone Theft
In the age of the smartphone, our most valuable information travels in our pockets: contacts, photos, social media, bank accounts, and even the digital keys to our identities. While Apple has long touted the iPhone’s robust security, recent investigations by The Wall Street Journal reveal that clever thieves are finding ways to defeat even these modern safeguards. Through a blend of social engineering, observation, and technical manipulation, criminals can seize not only your phone—but your digital life.
Inside the Mind of an iPhone Thief
Aaron Johnson, a convicted iPhone thief, stole hundreds of devices before being caught. In a rare interview, Johnson sat down with WSJ’s Joanna Stern to reveal, step-by-step, exactly how he targeted victims, bypassed their security, and ultimately looted their financial accounts. His story is a chilling warning to iPhone users everywhere.
The Setup: Targeting the Victim
Johnson rarely relied on brute force or hacking skills. Instead, his strategy was all about observation and timing. Bars and nightclubs were his hunting grounds, places where people were relaxed, distracted, and often using their phones. Johnson would scan the crowd for someone entering their iPhone passcode. Once he spotted a target, he’d make sure to memorize the code—sometimes by watching from over a shoulder, other times by glancing in a mirror or window reflection.
“Most people are careless,” Johnson explained. “They think no one’s watching when they unlock their phones. But if you’re in a public place, someone always is.”
The Heist: Stealing the Phone
With the passcode in mind, Johnson’s next move was swift and calculated. He’d wait for the right moment—when the victim was distracted, set their phone down, or turned away—to snatch the device. Because he already knew the passcode, there was no need for violence or confrontation; it was a silent crime, often unnoticed until much later.
The Exploit: Breaking Through Security
Once in possession of the phone, the real exploitation began. Knowing the passcode unlocked a terrifying range of possibilities:
- Changing the Apple ID Password: The first step was to lock the rightful owner out. Johnson used the passcode to change the Apple ID password, then turned off the “Find My iPhone” feature to prevent remote tracking or wiping.
- Adding His Face to Face ID: If Face ID was enabled, Johnson would enroll his own face, gaining biometric access to the device.
- Accessing Financial Apps: With the phone unlocked, Johnson had direct access to banking apps, PayPal, Venmo, and more—often with autofill passwords already stored in the phone’s keychain.
- Resetting Recovery Information: By updating recovery emails and phone numbers, Johnson could make it nearly impossible for the original owner to regain access.
According to Johnson, a skilled thief could drain a victim’s bank accounts and resell the phone within hours.
The Impact: Lives Turned Upside Down
For victims, the consequences are severe. Many find themselves locked out of not only their iPhones but also their iCloud accounts, emails, and banking services. Some lose years of photos and messages; others, their life savings.
Law enforcement officials acknowledge that such crimes are difficult to investigate, let alone prosecute. By the time most victims report the theft, the digital trail has gone cold.
Apple’s Response and Limitations
Apple regularly updates its security protocols, but experts say the company can only do so much. The Achilles’ heel remains the passcode—a four- or six-digit number that, once compromised, renders much of the iPhone’s famed security moot.
WSJ’s investigation led Apple to introduce or expedite features such as “Stolen Device Protection,” which makes it harder to change sensitive settings without Face ID or Touch ID. But these protections often require proactive setup by users, and not all owners are aware of them.
How to Protect Yourself
Johnson’s confessions offer valuable lessons for anyone who uses an iPhone:
- Use a Strong Passcode: Ditch the simple 4- or 6-digit code for an alphanumeric passcode that’s harder to observe and remember.
- Shield Your Screen: Always cover your phone’s screen with your hand or body when entering your passcode in public.
- Enable Biometric Security: Use Face ID or Touch ID wherever possible, and enable additional protections such as two-factor authentication.
- Turn on “Stolen Device Protection”: This new feature requires biometric confirmation for critical security changes.
- Monitor Your Accounts: Set up alerts for suspicious account activity, and act immediately if your device is stolen—log in to your Apple account from another device to trigger “Lost Mode” and contact your banks.
- Be Cautious in Public Spaces: Assume someone may be watching when you unlock your phone. Stay vigilant in crowded or dimly lit environments.
The Bottom Line
The iPhone is a marvel of engineering, but its weakest point is human behavior. Thieves like Aaron Johnson don’t need to break codes or hack systems—they simply exploit inattention and routine. As criminals become ever more sophisticated, it’s up to each user to adapt, staying a step ahead by using stronger security practices and staying alert to their surroundings.
As Johnson himself warns, “If I can do it, someone else can. Protect yourself, because your whole life is in that phone.”
About The Author
