iPhone Thefts and Phishing Scams Target Cloud Data in Israel
Following the theft of an iPhone in Tel Aviv, a teen faced sophisticated phishing scams from suspects in the Jenin area. Cyber experts warn that cloud data theft poses greater risks than physical loss.
The theft of smartphones on beaches is a well-known and regrettable phenomenon, but even after a device is stolen, thieves often attempt to access personal data stored in the cloud using sophisticated phishing techniques.
Noa, a 16-year-old resident of Ramat Gan, visited Charles Clore Beach in Tel Aviv alongside her partner a couple of weeks ago. Roughly half an hour later, she noticed that her iPhone 17 Pro was missing from the spot where she had placed it.
Family members attempted to locate the device using Apple's Find My service and observed that it was on the move across Tel Aviv. They attempted to call it, but shortly afterward, the device was turned off. Beyond its monetary value, the phone contained a wealth of personal data: photos, conversations, access to social media accounts, and other private details.
The day following the theft, a new update appeared on the tracking system: the device was detected in the area of Al-Yamoun, a locality near Jenin. Shortly afterward, inquiries began arriving from individuals impersonating official representatives of Apple.
Noa began receiving SMS messages and follow-up calls requesting that she provide details about the device. During a phone call in which the speaker impersonated an Apple representative, Noa provided personal details, as it never crossed her mind that it was inauthentic. Fortunately, she could not recall her iCloud password, so the imposters failed to log into the account.
From that moment onward, attempts to make contact and send messages continued. The messages were worded as official Apple communications and directed recipients to fraudulent websites that appeared nearly identical to the company's official pages. On these pages, she was asked to enter personal details, the phone's lock code, and iCloud account information, purportedly as part of the tracking and recovery process.
Noa showed the links to her sister, who found them suspicious. After seeking assistance from a professional and realizing it was a scam, the family contacted Apple support and wiped the device via the Find My application. Simultaneously, the family blocked the credit card linked to the digital wallet on the phone. According to the family, after filing a police report, the file was closed, and they remain unaware of the device's ultimate fate.
The Theft Is Only the First Step: The Attempt to Reach Personal Data
Ofir Cohen, a cyber expert and founder of Yo Secure, explains that the theft of the physical device is not necessarily the sole objective of the criminals. People think that once their iPhone is stolen, the damage is limited to a few thousand shekels. In practice, our phone contains our entire digital life: photos, bank accounts, emails, social media, and sensitive personal information, he explains.
According to Cohen, the theft of the device does not necessarily indicate an ability to crack it, as modern smartphones include encryption and security mechanisms that complicate access to data when the device is locked. It is important to understand that stealing a device does not mean it was successfully hacked. Modern devices are protected by encryption and advanced security mechanisms, especially when locked with a strong passcode, Cohen emphasizes.
Instead of technological breaking, criminals attempt to make the victim hand over the information themselves. Following the theft, SMS messages, WhatsApp messages, or calls from individuals presenting themselves as company representatives may arrive. The attached links direct users to phishing sites requesting passwords or verification codes. The goal is to gain access to the Apple account or trick the victim into removing the device from their account—an action that cancels Activation Lock and allows the device to be resold. According to Cohen, the stress experienced by the device owner makes them an easy target for such fraud.
Cohen warns against thefts on Tel Aviv beaches, noting that phones are taken from bags, towels, or snatched directly. He states that in some cases, owners report that the device was subsequently located in the Judea and Samaria area. Nevertheless, the mere tracking of the device to the Jenin area does not in itself indicate the identity of the thief or the existence of an organized gang.
What to Do If Your iPhone Is Stolen?
According to Cohen, the first step is to log into Apple's Find My service and activate Lost Mode to limit device usage. Concurrently, one must contact the cellular provider to block the SIM or eSIM.
If there is any concern that the passcode or access details were compromised, passwords must be changed from a secure device, and a check should be run to see if unusual activity occurred in the accounts. Cohen emphasizes that one must not click on links in messages providing updates on device tracking, and under no circumstances should codes, passwords, or account details be handed over.
A central point is the distinction between remotely wiping the device and removing it from the Apple account. Removing the device from Find My cancels Activation Lock and allows criminals to use or trade it.
Additionally, one should document messages and screenshots of the device's location, file a police report, and refrain from attempting to independently reach the location where it was tracked, despite success stories occasionally published in the media. It is recommended to verify in advance that the Find My service is active, set a strong lock code, enable automatic backups, and utilize Apple's Stolen Device Protection mechanism.
The thief might have managed to take your phone, but do not hand over the keys to your digital life as well. Sometimes the message arriving after the theft is more dangerous than the theft itself, Cohen concludes.
