The Thief Who Stole Your iPhone Would Also Like Your Passcode, Please

A sprawling criminal service that helps thieves unlock stolen Apple devices by targeting their owners with emails, texts, WhatsApp messages, prerecorded calls, and conversational AI agents has been uncovered.

The platform, called AnonyMousKIT, can feed an AI caller details about the real stolen device. The caller then impersonates Apple Support, claims the phone has been recovered, and asks the owner to confirm a passcode or two-factor authentication code.^[1]

Researchers at SOCRadar connected the operation to 506 domains and 168 storefront brands selling access to the same underlying phishing tools. The platform was still recording activity in August 2026.

Thanks for subscribing!

Please check your email for your first message.

Never miss the privacy news that affects you.

Join thousands who get the latest security news, scams, and policy changes every week, right to their inbox.

Sign me up

By submitting this form you agree to receive emails from All About Cookies and to the privacy policy and terms.

How thieves turn a locked iPhone into a payday

Apple’s Activation Lock ties an iPhone to its owner’s Apple Account when Find My is enabled. Even after a factory reset, the phone generally cannot be set up under a new account without the owner’s credentials.

That protection makes a stolen iPhone much harder to resell. Thieves can strip it for parts, but an unlocked, working phone is worth considerably more.

AnonyMousKIT helps them go after the missing piece: you.

Thieves create a profile using information from your stolen phone, including its model, contact details displayed through Lost Mode, and its current Find My status. The platform then sends messages claiming the device has been located.

Because the message mentions the correct iPhone model and other real details, it can feel far more credible than a generic phishing attempt. The victim is often sent to a convincing imitation of Apple’s Find My website, where the page requests the device passcode, Apple Account credentials, and a live two-factor authentication code.

With those details, the thief may be able to remove Activation Lock, erase the phone, and prepare it for resale. Compromised Apple Account credentials could also expose iCloud backups, Keychain credentials, work email, and other data connected to the account.

Meet “Alice,” the fake Apple employee of the month

The most unsettling part of the operation is an AI support agent named “Alice.”

In one call recovered by researchers, Alice tells the victim that somebody brought their stolen iPhone 16 Pro Max into an Apple Store and tried to remove its Activation Lock. She claims store employees retained the phone after discovering it was in Lost Mode.

Alice then asks the victim to prove ownership by reading out the phone’s four- or six-digit passcode. After confirming the numbers, she directs the victim to a phishing link sent by text.

The agent can address victims by name, reference the correct device, respond during the conversation, and patiently walk them through the scam. One recovered call even opens with a familiar customer-service line about being recorded for quality assurance and security purposes.

SOCRadar recovered records from 200 AI calls, including 55 transcripts and five configured AI personas. About 90% of those calls targeted numbers in Brazil, although the wider phishing infrastructure reached victims in several countries.

Those 200 calls cost the criminals a combined $19.24, or roughly 10 cents per attempt. At that price, thieves can afford to keep calling until somebody cooperates.

The rest of the operation looks surprisingly polished. Its dashboard tracks account balances, orders, completed attempts, blocked attempts, and customer activity. Criminals purchase credits, enter information about a stolen device once, and target its owner across several communication channels.

Apple will not call to reunite you with your phone

Apple’s guidance leaves little room for interpretation: “Apple will never contact you to say that your iPhone or iPad has been found.”

If anyone calls, texts, emails, or messages you with that claim, assume the person contacting you is trying to unlock the stolen device.

Apple also says its support representatives will never request your device passcode, Apple Account password, recovery key, or two-factor authentication code. Caller ID is no guarantee, either, because scammers can make a call appear to come from a legitimate company.

If your iPhone is stolen:

• Visit iCloud.com/find directly and mark the device as lost as quickly as possible.
• Keep the phone connected to Find My. Removing it also removes Activation Lock, making the device easier to erase and resell.
• Never share your passcode, password, recovery key, or verification codes over the phone, through a message, or on a website someone sends you.
• Avoid clicking links claiming to show the phone’s location. Open Find My yourself or type the official iCloud address into your browser.
• If you know the phone was stolen, consider leaving your contact information off the Lost Mode screen. Apple warns that thieves may use it for social engineering. Contact details can still be useful when a phone was simply misplaced and may be found by an honest person.
• Enable Stolen Device Protection before anything happens. When it is active, Apple says Face ID or Touch ID is required to turn off Lost Mode, even if a thief knows your passcode.
• Report the theft to local law enforcement, and ask your wireless carrier to suspend the affected line.

If you already provided information to a suspicious caller or website, change your Apple Account password immediately. Review the phone numbers, email addresses, trusted devices, and recovery methods connected to your account, and remove anything you do not recognize.

Bottom line

The thief already has your iPhone. Do not help them defeat the lock protecting everything inside it.

Any unexpected “Apple Support” call claiming your stolen phone has been found should end with you hanging up. Check Find My yourself, contact Apple through its official support channels, and keep the missing device attached to your account.

Author Details

Thomas Kent

About the Author

Thomas Kent is a multi-disciplined reporter with over a decade of experience covering online platforms, digital trends, and consumer-facing tech. Tom focuses on digital privacy, data tracking, and user behavior, with a particular interest in how cookies, online surveillance, and platform design shape the modern internet experience. His reporting takes a research-driven, news-focused approach, translating complex technical topics into clear, accessible insights.