Here are details about an iPhone exploit. If you use an iPhone please read and consider the solution.

25th February 2023

The Wall Street Journal recently covered a low-tech theft scheme for stealing money from iPhone users that’s quickly gaining popularity.

The basic premise of the theft works like this:

1. The victim’s iPhone passcode is observed, either by shoulder surfing or social engineering.
2. The iPhone is stolen.
3. The iPhone passcode is used to reset the Apple ID password.
4. The victim is then remotely logged out of their other devices to prevent remote wiping the device.
5. The credentials are then used to steal money via banking accounts logged in on the device, Apple Pay, etc. Since the passcode can be used as a fallback for Face ID and Touch ID, every app that doesn’t use a separate passcode or similar is susceptible.

Even though it can be hard to protect against steps 1 and 2, there is a simple way to prevent step 3, thus preventing further damage from taking place:

1. Go to Settings → Screen Time.
2. Turn on Screen Time if not yet enabled.
3. Turn on Use Screen Time Passcode and use a different code than your iPhone passcode.
4. Go to Content & Privacy Restrictions.
5. Set Passcode Changes and Account Changes to Don’t Allow.

This ensures that even if someone has access to your device and knows your iPhone passcode, they cannot access or change Apple ID settings and inflict further damage.