iPhone theft: Unlocked devices are the main target Apfelpatient

A new report reveals why iPhone thieves in major European cities are specifically targeting unlocked devices: The black market price for an unlocked iPhone is up to $800 higher than for a locked one. The difference isn't so much due to the device itself, but rather to access to bank accounts, Apple Pay, and personal data.

The figures come from a recent Wired analysis, which evaluates data from law enforcement and security researchers. The central finding is that professional cybercriminal networks are no longer just stealing devices, but systematically attempting to take over the associated Apple accounts. They use phishing kits, AI-powered voice calls, and an entire black market infrastructure. The fact that phishing is the primary tool in this process fits a pattern that was also evident in the recent attack on iCloud backups via fake Apple websites.

Why unlocked iPhones are worth so much more

On the internal black market, a locked iPhone fetches between $50 and $200 – a value primarily derived from the cost of spare parts. Once the device can be unlocked and sold, the price skyrockets to between $500 and $1,000. This premium of up to $800 explains why thieves take the risk of attacking their victims while the device is actively being used.

The same logic underlies the British phenomenon that London police now describe as "industrial": thieves on e-scooters or e-bikes snatch phones from passersby. A single operation by the Met Police recently led to 230 arrests and over 1,000 recovered devices in just one week. Only after British authorities changed their strategy and permitted "tactical contact" - that is, deliberately ramming the bikes - was it possible to noticeably increase enforcement pressure.

What the thieves try next

With an unlocked iPhone in hand, perpetrators, according to Will Lyne, head of the Economic and Cyber Crime Unit at the Metropolitan Police, are not primarily aiming to sell the devices, but rather to access the associated bank accounts. While banking apps require Face ID or a passcode, access can often be gained through phishing. Lyne cites a single case in which four men were apprehended with over 5,000 stolen devices – and were spending money directly from linked accounts.

Dan Guido from the security company Trail of Bits describes the valuation logic of the fences: A locked device fetches a low price, an unlocked one a much higher one. This difference alone justifies the existence of an entire phishing industry.

Phishing kits as a business model

The tools thieves use to steal Apple account data are now being sold as a service. "Find My iPhone Off" kits are available on relevant platforms on a pay-per-use basis and mimic the official Apple pages for device location and activation lock reset. These are complemented by scripts that specifically target Apple Pay functions and AI-powered voice call software that calls the victim pretending to be from Apple or a bank.

One example cited in the report is the software "iRealm." Research shows how it generates phishing links and pages within seconds that are virtually indistinguishable from genuine Apple websites. Among other things, it advertises a "seamless experience" when unlocking Apple devices. Most of these services are distributed via Telegram channels - several of which were removed after inquiries from Wired, but the majority likely continue operating under new names.

The typical course of a theft

In many cases, the attack follows a stereotypical pattern. First, the victim is approached on the street, and the unlocked device is snatched away in seconds. The victim then receives a phishing message - via SMS, iMessage, or email on another device - that imitates the genuine Apple Find My page and asks for the iPhone passcode, supposedly to locate the missing device. Once the victim enters the passcode, the perpetrators have everything they need to remove the activation lock, and the stolen iPhone can then be sold as a "clean" device.

One incident mentioned in the report involved a law enforcement officer who received precisely this phishing message after his iPhone was stolen. The fact that even trained police officers are susceptible to this scam in the seconds following the shock demonstrates how professional the perpetrators have become.

This is how Apple takes away the thieves' leverage

Apple itself has implemented several layers of protection in recent iOS generations. The "Stolen Device Protection" mode delays critical changes to the Apple account if the iPhone is unlocked in an unusual location. Activation Lock links each iPhone to its Apple account. And Find My allows the device to be marked as lost or erased remotely.

Nevertheless, the weakest point remains not the hardware, but the vulnerability to phishing after theft. This is precisely where classic phishing warning signs come into play: Genuine Apple messages never ask for the device passcode, Find My doesn't require a password via an external link, and SMS or iMessage requests with Apple branding are inherently suspicious.

Anyone needing to act in an emergency should immediately mark the device as lost at icloud.com, check their Apple account on another device, and directly inform their bank and Apple Pay. If you suspect account misuse has already occurred, our steps for identity theft can help narrow down the extent of the damage.

Further protection guides on phishing, identity theft, Apple account security and stolen devices appear regularly in our cybersecurity series, which categorizes Apple-specific threats step by step.

Theft is only the first step

What the report makes clear is that the real economic value of a stolen iPhone today lies less in the device itself than in the bank account behind it. As long as phishing kits allow the transition from stolen device to compromised identity so seamlessly, Apple's hardware safeguards remain only part of the equation. The other half – awareness in the seconds following the theft – lies with the users themselves. (Image: Shutterstock / May_Chanikran)