Lost your iPhone? That “we found it” text could actually steal your Apple ID

A new scam is targeting iPhone users with fake texts claiming to have found their lost devices. Here’s how to stop them from stealing your data.

Losing a phone is stressful enough, but receiving a text claiming it has been found might make things worse, especially if that message comes from scammers. Cybersecurity experts are warning iPhone users about a new phishing scam that tricks victims into sharing their Apple ID details under the pretext of recovering a lost device.

What stands out is the attention to build quality. Magnets are strong, edges are well-machined, and the accessories don’t feel like generic MagSafe clones.(HT)

According to the Swiss National Cyber Security Centre (NCSC), attackers are exploiting Apple’s Find My feature to target users who have reported their devices lost or stolen. When an iPhone is marked as lost, users can display a custom message on the lock screen with their contact details, hoping that someone will reach out if the device is found. Scammers have turned this helpful feature into an opportunity to deceive users.

How the scam works

Fraudsters send text messages through iMessage or SMS, pretending to be from Apple’s Find My team. These messages often include accurate details about the lost phone - such as the model, colour, or storage capacity, which may have been gathered from the device’s lock screen. The messages inform the owner that their device has been located and include a link to “view its location.”

A sample message reads:

“We are pleased to inform you that your lost iPhone 14 128GB Midnight has been successfully located. To view the current location of your device, please click the link below…”

Once users click the link, they are redirected to a fake Apple login page that looks identical to the real Find My website. Unsuspecting users who enter their Apple ID credentials hand them directly to scammers. The attackers then use the information to disable Apple’s Activation Lock, a security feature that prevents unauthorised use or resale of stolen devices.

How to stay safe

The NCSC advises users never to click on links in unsolicited messages or share Apple ID credentials through external websites. Apple does not send text messages to notify users about recovered devices. Instead, users should rely only on official notifications through the Find My app or iCloud.com.

Users are also encouraged to use a separate email address on the lost-device lock screen and enable a SIM card PIN to prevent misuse. Keeping antivirus software updated and activating features such as identity monitoring or VPN protection can further reduce risk.

Anyone who believes they’ve been targeted, then you should first file a complaint with their local police station and then block the device using the government's CEIR portal. You can also register a complaint on the National Cyber Crime Reporting Portal at https://ceir.gov.in/.