A working stolen iPhone is more valuable than one that’s locked down through software, which typically needs to be sold for parts. The attacker then steals the phone and uses the purloined passcode to turn off theft protections such as Apple’s Activation Lock feature or Lost Mode. The new feature comes after The Wall Street Journal identified a scam in which attackers befriend or spy on their victims, often at bars at night, and get them to reveal their passcode, sometimes by asking to see a photo or by looking over their shoulder. In addition, any attacker won’t be able to change the user’s Apple ID password or remove FaceID without a mandatory one-hour delay, and then have to pass a FaceID check again. For more information about Activation Lock as an iOS feature, read the Apple Support article Find My iPhone Activation Lock. Thieves won’t be able to make those changes or see those settings with only a passcode. When Activation Lock is enabled, an end user’s Apple ID and password are required to unlock a device even if the device is wiped or factory reset, including through DFU mode. If the phone is at a location that is not usually associated with its owner, and Stolen Device Protection is turned on, the device will require Apple’s FaceID facial recognition in addition to a passcode for users to perform sensitive actions, such as viewing stored passwords or wiping the phone.
