Iphone 6s stolen?

ForeverYoung90

Hi my iphone was stolen sat night.Think I was pickpocked.:mad:
The following morning I got an email saying someone had signed into icloud using my apple id at 04.50am.
I was hoping they wouldnt get to my home screen but they must have watched me enter my 4 digt passcode.
I just dont understand how they would know my password to enter icloud though?
The thing is they didnt change the password and I could still enter and change the password myself.Also my email and facebook would have been logged in but no change of password thankfully.
Any thoughts?

PucaMama

ForeverYoung90 wrote: »

Hi my iphone was stolen sat night.Think I was pickpocked.:mad:
The following morning I got an email saying someone had signed into icloud using my apple id at 04.50am.
I was hoping they wouldnt get to my home screen but they must have watched me enter my 4 digt passcode.
I just dont understand how they would know my password to enter icloud though?
The thing is they didnt change the password and I could still enter and change the password myself.Also my email and facebook would have been logged in but no change of password thankfully.
Any thoughts?

Do you have the find my iPhone app installed? Even when a phone is turned off it can find it. I can see my old iPhone from logging into the app on my new one.

guil

PucaMama wrote: »

Do you have the find my iPhone app installed? Even when a phone is turned off it can find it. I can see my old iPhone from logging into the app on my new one.

The app is only needed to locate another iPhone or iOS device, You need to have find my iPhone enabled in settings under iCloud or it won't work.

drunkmonkey

Have you checked

Find my iPhone?
Facebook location tracker?
Google Location tracker?

One of them might pinpoint the phone for you! Also did you cut off your sim as they could be racking up a bill for you.
Also you can ring your network and they'll give you the last usage on the sim, hopefully they were stupid enough to call a cab or something.

You can also report to Garda and they can put in a request to see is there's a registered sim being used in it, and if so they should be able to get it back for you. Make sure you report as stolen.

ForeverYoung90

drunkmonkey wrote: »

Have you checked

Find my iPhone?
Facebook location tracker?
Google Location tracker?

One of them might pinpoint the phone for you! Also did you cut off your sim as they could be racking up a bill for you.
Also you can ring your network and they'll give you the last usage on the sim, hopefully they were stupid enough to call a cab or something.

You can also report to Garda and they can put in a request to see is there's a registered sim being used in it, and if so they should be able to get it back for you. Make sure you report as stolen.

Yes Im trying that but says phone is offline.I cut off sim yes.But how did they enter my icloud I wonder?If they typed in my apple id(my email address) would my password have entered automatically?

drunkmonkey

ForeverYoung90 wrote: »

Yes Im trying that but says phone is offline.I cut off sim yes.But how did they enter my icloud I wonder?If they typed in my apple id(my email address) would my password have entered automatically?

I don't know, I had my phone stolen and they got around icloud lock/activation as well and apple say it can't be bypassed but it can.

Try the google and facebook location history if you had either on it'll show you where the phone was last online.

guil

ForeverYoung90 wrote: »

Yes Im trying that but says phone is offline.I cut off sim yes.But how did they enter my icloud I wonder?If they typed in my apple id(my email address) would my password have entered automatically?

The phone will never show online again unless they connect it to wifi. Doubt they will do that without signing out of your iCloud account.

the_syco

Change every password that you have, check for any purchases with your iTunes account, and delete any payment method from your iTunes. An old scam is buying a poker app, and using your account to lose against the scammer multiple times.

Also, did your iPhone have a password remembering app that you stored all your passwords in?

ForeverYoung90

guil wrote: »

The phone will never show online again unless they connect it to wifi. Doubt they will do that without signing out of your iCloud account.

But how did they get in is whats annoying me?

guil

ForeverYoung90 wrote: »

But how did they get in is whats annoying me?

Did you have login details in notes or anything like that?

ForeverYoung90

guil wrote: »

Did you have login details in notes or anything like that?

No I didnt but Im sure they have it wiped now and ready to sell on.Scumbags:mad:

drunkmonkey

ForeverYoung90 wrote: »

No I didnt but Im sure they have it wiped now and ready to sell on.Scumbags:mad:

Blacklist it, only good for parts then.

the_syco

If you ever had the "Find my iPhone" enabled, have a look at https://support.apple.com/kb/PH2701

And then as said, have the IMIE blacklisted by your carrier.

Sad Professor

You generally only get an iCloud log-in email when logging in to a device for the first time or from a desktop browser. It would have said in the email.

If they succeeded in disabling Activation Lock you would have received an email about that as well. Check your deleted emails.

ForeverYoung90

Sad Professor wrote: »

You generally only get an iCloud log-in email when logging in to a device for the first time or from a desktop browser. It would have said in the email.

If they succeeded in disabling Activation Lock you would have received an email about that as well. Check your deleted emails.

Ya from a desktop.Checked my gmail trash nothing there.Cant get my head around how they logged in and didn't even change my password?

drunkmonkey

Sad Professor wrote: »

If they succeeded in disabling Activation Lock you would have received an email about that as well. Check your deleted emails.

I never got any notification when it was disabled on mine and it never appeared as activation lock off when checked on the apple website.

I don't know how there getting past it, I thought there was no way around it.

guil

drunkmonkey wrote: »

I never got any notification when it was disabled on mine and it never appeared as activation lock off when checked on the apple website.

I don't know how there getting past it, I thought there was no way around it.

Are you sure? Anytime I have disabled find my iPhone I get an email straight away to my iCloud email.

Sad Professor

Were you running an old version of iOS? Did you use the same password for multiple accounts including iCloud?

Sad Professor

drunkmonkey wrote: »

I never got any notification when it was disabled on mine and it never appeared as activation lock off when checked on the apple website.

I don't know how there getting past it, I thought there was no way around it.

How do you know they disabled it on yours?

Seems there are holes, though. Either in Apple's security or in the iPhone itself which allows them to find out your password through other means.

ForeverYoung90

Whatever they did they were into my account at 4.50am giving me no chance.I changed my passwords for email Facebook ect. I hope they didn't get anything else from me.Goodbye phone I guess.

smash

drunkmonkey wrote: »

Blacklist it, only good for parts then.

Not true. The phone is only blacklisted in the country it has been stolen from. It will be sold on eBay to a UK customer and will work once it is not connected to the Irish mobile network.

Regarding iCloud, I can open my settings and go to iCloud without needing to log in. I'm assuming they did the same. Probably to turn off find my phone app.

Lesson learned to always use your thumb print scanner or an advanced password instead of the basic 4 digit one.

Sad Professor

smash wrote: »

Regarding iCloud, I can open my settings and go to iCloud without needing to log in. I'm assuming they did the same. Probably to turn off find my phone app.

From the Settings app, you still need a password to disable Find My iPhone. iOS is pretty secure that way.

No, the weak point is the iCloud web interface. Especially if you have your iCloud.com password saved to your keychain.

However, I'm not convinced the thief succeeded in disabling Activation Lock. If the phone is still showing as offline in the OP's account that would suggest Activation Lock is still enabled. If you have the serial number, OP, you can check for sure here:

https://www.icloud.com/activationlock/

By the way, OP, the time given in the iCloud log-in email might be wrong. Go by the time the email was received.

smash

Wouldn't it be great if find my phone gave you the last known location, like it's supposed to do...

the_syco

Sad Professor wrote: »

However, I'm not convinced the thief succeeded in disabling Activation Lock. If the phone is still showing as offline in the OP's account that would suggest Activation Lock is still enabled. If you have the serial number, OP, you can check for sure here

There was a way to bypass it by using the emergency phone number dial pad. This way was around last year, and I think Apple patched it away last year, but I'd say there are new ways to do so.

There was rumoured to be a shop on Talbot street that would take in electronic goods, no questions asked. Think it's gone now, but I'd say someone still takes electronic items, no questions asked, from the junkies.

AFAIK, blacklisting works in the EU, and possibly America. But find someone from India/Pakistan/China/etc, who is going home for the holidays, and they'll take the phone, as the blacklisting have little to no effect outside the EU.

In saying that, it's not meant to be that hard to change the IMEI. Get an old phone that you don't use, that isn't attached to any one network, and swap the number. You won't be able to sell the phone easily, but I've come across people who don't care if the clone is a substandard piece of crap; once it looks nice, they'll take it (someone tried to sell me a Samsung, but the IMEI came back as a Nokia). I found out that most of the people who bought the clones knew they were clones, but it was more so that they could whip out the shiny toy when getting a ladies number in a club.

smash wrote: »

Wouldn't it be great if find my phone gave you the last known location, like it's supposed to do...

Unless the person who stole it lives in a one story house, it won't be of any use, as GPS co-ordinates aren't helpful if there are several floors of apartments on that one spot.

ForeverYoung90

Sad Professor wrote: »

From the Settings app, you still need a password to disable Find My iPhone. iOS is pretty secure that way.

No, the weak point is the iCloud web interface. Especially if you have your iCloud.com password saved to your keychain.

However, I'm not convinced the thief succeeded in disabling Activation Lock. If the phone is still showing as offline in the OP's account that would suggest Activation Lock is still enabled. If you have the serial number, OP, you can check for sure here:

https://www.icloud.com/activationlock/

By the way, OP, the time given in the iCloud log-in email might be wrong. Go by the time the email was received.

I just checked there and it says lock is on?Phone still appearing offline.

ForeverYoung90

I just looked through my emails there and realised a major f>@k up on my behalf.
I disabled "find my iphone" a few days after I got my new phone.I now recall reading somewhere at the time that it drains battery and so I turned it off.I now feel like a right fool tbh.
This is how they accessed my icloud, they didnt need a password.I basicly gave someone a brand new iphone 6s on a plate.:mad:

symbolic

ForeverYoung90 wrote: »

.
This is how they accessed my icloud, they didnt need a password.

how did they?

ForeverYoung90

symbolic wrote: »

how did they?

From my email "With Find My iPhone disabled, this device can no longer be located, placed in Lost Mode, or remotely erased using icloud.com/find or the Find My iPhone iOS app.
In addition, your Apple ID and password will no longer be required for someone to erase, reactivate, and use your iPhone".

Sad Professor

Re: the iCloud log-in email you received saying someone had logged in to your account during the night, are you sure that wasn’t you the following morning? Because the time given in those emails isn’t necessarily Irish time. As i said above, you need to go on the time the email was received.

ForeverYoung90

Sad Professor wrote: »

Re: the iCloud log-in email you received saying someone had logged in to your account during the night, are you sure that wasn’t you the following morning? Because the time given in those emails isn’t necessarily Irish time. As i said above, you need to go on the time the email was received.

Received email at 12.30pm. Ok then probably was me in that case

Sad Professor

That’s because the region on iCloud.com isn’t set to Ireland. I have the same problem. I’ve changed it several times but it keeps resetting to the US. Annoying.

Okay... so they didn’t log into your iCloud account. Which means they probably didn’t defeat your passcode either. And Find My iPhone/Activation Lock was disabled already, which means they just brought it home, erased it and set it up with their own Apple ID (or quickly sold it to someone else who did) which is why Apple is now saying Activation Lock is enabled.

Phone is gone and you aren’t getting it back. But on the bright side, your data and personal information is safe. All you can do now is get the phone blacklisted.

In future, always keep Find My iPhone enabled. It has no effect on battery life. And it will make selling the phone on very difficult if not impossible for a thief.

ForeverYoung90

Sad Professor wrote: »

That’s because the region on iCloud.com isn’t set to Ireland. I have the same problem. I’ve changed it several times but it keeps resetting to the US. Annoying.

Okay... so they didn’t log into your iCloud account. Which means they probably didn’t defeat your passcode either. And Find My iPhone/Activation Lock was disabled already, which means they just brought it home, erased it and set it up with their own Apple ID (or quickly sold it to someone else who did) which is why Apple is now saying Activation Lock is enabled.

Phone is gone and you aren’t getting it back. But on the bright side, your data and personal information is safe. All you can do now is get the phone blacklisted.

In future, always keep Find My iPhone enabled. It has no effect on battery life. And it will make selling the phone on very difficult if not impossible for a thief.

Its been a rough (and costly 850e)few days,losing a phone makes you feel such anger and distress. Especially nowadays when it contains so much personal info.
Ive learned alot about iphones the last few days mainly due to the posters here.Thanks to everyone who contributed to the thread and hopefully it might help other people in the future.

smash

the_syco wrote: »

Unless the person who stole it lives in a one story house, it won't be of any use, as GPS co-ordinates aren't helpful if there are several floors of apartments on that one spot.

Most people in Ireland live in houses...

Sad Professor wrote: »

In future, always keep Find My iPhone enabled. It has no effect on battery life. And it will make selling the phone on very difficult if not impossible for a thief.

That's not true. Pop the sim card or enable flight mode and find my phone wont work. It also takes approx 5 minutes to factory reset even a locked iPhone.

Sad Professor

smash wrote: »

That's not true. Pop the sim card or enable flight mode and find my phone wont work. It also takes approx 5 minutes to factory reset even a locked iPhone.

https://support.apple.com/kb/PH13695?locale=en_GB

smash

Sad Professor wrote: »

https://support.apple.com/kb/PH13695?locale=en_GB

A factory reset will restore a phone completely and remove the activation lock and like I said, it takes just a few minutes.

Turn off phone > Open iTunes on your computer > Press and hold the Home button on the phone while you connect the USB cable to your iPhone > iPhone will turn on but continue to hold the Home button > iTunes will alert you that an iPhone in recovery mode has been detected and you can factory reset the device.

Even your link states:

"When you erase your content, Find My iPhone and Activation Lock are also turned off." Because they are linked to your iCloud account.

Sad Professor

smash wrote: »

A factory reset will restore a phone completely and remove the activation lock and like I said, it takes just a few minutes.

No it won't.

the_syco

smash wrote: »

Most people in Ireland live in houses...



That's not true. Pop the sim card or enable flight mode and find my phone wont work. It also takes approx 5 minutes to factory reset even a locked iPhone.

Inner city thieves often live in flat complexes.

Regarding resetting the account with iTunes, it (usually) won't allow you to do so without going through the current users iTunes account.

Sad Professor

Tbh I think the location part of Find My iPhone is kind of useless in the case of theft. I can't imagine the Guards will care too much and most people aren't going to go kicking down doors and risk getting stabbed for a phone. Plus the chances of a thief not immediately removing your SIM are pretty low.

Activation Lock doesn't stop someone erasing the phone, but it does stop them activating it again without the original user's password, hence "activation lock". The lock isn't on the phone, it's on Apple's servers. So in theory it renders the phone useless except as spare parts. Most of the bypasses I've seen only involve getting into the previous owners contacts list so you can call them. There were some brute force methods that used to defeat it entirely, but I assume Apple are actively patching these.

smash

the_syco wrote: »

Inner city thieves often live in flat complexes.

Regarding resetting the account with iTunes, it (usually) won't allow you to do so without going through the current users iTunes account.

It's not always inner city thieves that steal phones. And yes, you can reset a phone through itunes without going through any account using the steps I mentioned earlier.

Sad Professor wrote: »

Tbh I think the location part of Find My iPhone is kind of useless in the case of theft. I can't imagine the Guards will care too much and most people aren't going to go kicking down doors and risk getting stabbed for a phone. Plus the chances of a thief not immediately removing your SIM are pretty low.

Activation Lock doesn't stop someone erasing the phone, but it does stop them activating it again without the original user's password, hence "activation lock". The lock isn't on the phone, it's on Apple's servers. So in theory it renders the phone useless except as spare parts. Most of the bypasses I've seen only involve getting into the previous owners contacts list so you can call them. There were some brute force methods that used to defeat it entirely, but I assume Apple are actively patching these.

You can reset a phone without the old account, but appologies for earlier, you were correct about activation lock being tied to the phone and not the itunes account. You can however bypass the activation lock if you jalibreak the phone.

As for how useful Find My iPhone is, I always thought it was utterly crap. There is an option in settings to always send a location report to Apple if battery is critically low. I'm not sure if this is tied to activation lock(the phone) or to find my phone(iCloud account). If it's tied to the phone, it would be great. If not, then it's still useless.

Sad Professor

smash wrote: »

You can reset a phone without the old account, but appologies for earlier, you were correct about activation lock being tied to the phone and not the itunes account. You can however bypass the activation lock if you jalibreak the phone.

How can you jailbreak an iPhone without activating it first?

I'm only aware of one exploit in Activation Lock which involved tricking the iPhone into thinking it was communicating with Apple's servers, which has since been patched. There are, however, plenty of scam apps and services still out there taking donations while making false promises.

smash

Sad Professor wrote: »

How can you jailbreak an iPhone without activating it first?

I'm only aware of one exploit in Activation Lock which involved tricking the iPhone into thinking it was communicating with Apple's servers, which has since been patched. There are, however, plenty of scam apps and services still out there taking donations while making false promises.

Didn't know this had been fixed. Then again it was an obvious exploit.

I guess when your phone is stolen it's a matter of who gets to a computer first

PucaMama

smash wrote: »

I guess when your phone is stolen it's a matter of who gets to a computer first

It's really not funny to have a phone worth 100s stolen from you

FourFourRED

smash wrote: »

I guess when your phone is stolen it's a matter of who gets to a computer first

Not really. Activation lock is either on or it's off.

Once the phone is gone from you, there is no rush to get to a computer because you can't turn activation lock on remotely. You've either had it on, or not.

The person who has stolen the phone isn't in a rush to get to a computer either because once activation lock is on, it's not coming off without the Apple ID password.

(You've posted a lot of incorrect info in this thread so far about activation lock.)

smash

PucaMama wrote: »

It's really not funny to have a phone worth 100s stolen from you

I know, I've had 4 of them stolen. And find my phone has never been any help.

FourFourFM wrote: »

You've posted a lot of incorrect info in this thread so far about activation lock.

Well it's only relatively new (around a year) and there's been hacks around it.

I have an iPhone 5 here that I'll be factory resetting over the weekend. I'll see what activation lock does for it before removing it from iCloud.

FourFourRED

smash wrote: »

I know, I've had 4 of them stolen. And find my phone has never been any help.


Well it's only relatively new (around a year) and there's been hacks around it.

I have an iPhone 5 here that I'll be factory resetting over the weekend. I'll see what activation lock does for it before removing it from iCloud.

When you factory restore the device, it's going to partially show you the email address of the Apple ID it's locked to and ask you for the full email address and the password to be put in before you can get past the set up screen. I am 100% confident of this.