"We Found Your iPhone": The Phishing Scam That Follows a Theft
Thieves can't get past Activation Lock without your Apple Account password, so they try to get you to hand it over. Here's how the messages work and how to respond.
Quick answer: If your iPhone was lost or stolen and you get a text, iMessage, email or call saying it has been "found", treat it as a phishing attempt. Thieves send these messages to trick you into entering your Apple Account details so they can unlock and resell the phone. Apple says it will never contact you to say your device has been found. Don't click the link, and don't remove the phone from Find My or your Apple Account.
Why thieves need you
A stolen iPhone that is still linked to its owner's Apple Account is protected by Activation Lock. Apple says the owner's Apple Account password is needed before anyone can turn off Find My, erase the device, or reactivate and use it. That makes it worth far less to a thief than an unlocked phone.
The Swiss National Cyber Security Centre (NCSC) warned in November 2025 that criminals are getting around this by tricking the owner, because there is no technical way past the lock. If you type your Apple Account email and password into a fake page, they can sign in as you, remove the phone from your account, and sell it as a clean device.
How the scam usually works
- The phone is taken. You mark it as lost in Find My, which is the right thing to do.
- They get your contact details. The NCSC says scammers probably use the number or email shown in your Lost Mode lock-screen message, or the SIM left in the phone.
- They wait. The messages can arrive months later. The NCSC describes reports of texts saying the phone had been found abroad.
- The message looks convincing. It appears to come from Apple or "Find My" and includes real details such as the model, colour and storage, which can be read from the phone itself.
- The link leads to a fake sign-in page made to look like Apple's. Anything you enter goes straight to the thief.
Be just as wary of phone calls. Apple's guidance warns about phony support calls as well as phishing messages. Anyone who asks for a verification code, or asks you to remove the phone from your account, is not helping you get it back.
Red flags
- A message says your lost iPhone has been found, located or "is online".
- It includes a link to view the location or "confirm ownership".
- It pressures you to act fast, with a deadline or a warning that the phone will be lost for good.
- It asks for your Apple Account password, passcode, or a six-digit verification code.
- It asks you to remove the phone from Find My or your account.
- The sender is an ordinary mobile number, or the link's web address isn't apple.com, even if the page looks right.
Apple's lost-device guidance is direct: Apple will never contact you to tell you that your iPhone or iPad has been found. Any message that says otherwise isn't from Apple.
What Apple advises
From Apple's support pages on lost devices and on avoiding scams:
- Mark the device as lost in Find My as soon as you can.
- Keep it in your account. Don't remove the iPhone from Find My or your Apple Account. If you have theft insurance, Apple says to wait until the claim has been fully approved.
- Never share your device passcode, password or verification codes with anyone who asks. Apple says it will never ask you to log in to a website or to tap Accept on a two-factor authentication prompt.
- Report the phishing. Forward suspicious emails to reportphishing@apple.com. For an SMS, take a screenshot and email it to the same address.
- Report the loss to local police and your mobile carrier.
If you already clicked or entered your details
Act quickly. The thief needs time to use what you entered.
- Change your Apple Account password from a device you trust, going directly to Apple rather than through any link.
- Check which devices are signed in to your Apple Account and remove any you don't recognise.
- Contact Apple Support through Apple's own website or app and explain what happened.
- Check whether the stolen phone is still in Find My. If it's gone from your devices list, tell the police and your insurer that the account may have been accessed.
- If you reused that password for email or banking, change it there too.
- If money is involved, for example saved cards or UPI, call your bank and the national cybercrime helpline 1930, or report at cybercrime.gov.in.
Make yourself a harder target
- Use a separate contact in Lost Mode. The NCSC suggests showing as little as possible on the lock screen, for example an email address used only for this, not the one you sign in with.
- Set a SIM PIN. This stops someone putting your SIM in another phone to receive your texts. The NCSC recommends it too.
- Replace the SIM through your operator as soon as the phone goes missing. Keep your number, and cut off the one inside the stolen phone.
- Block the handset on Sanchar Saathi (CEIR) after filing a police complaint. What to do first when your phone is stolen walks through the steps.
- Ignore the "found" message. If you really think the phone has turned up, check Find My yourself by typing icloud.com/find into your browser.
Reporting in India
You can report a suspicious message on the Sanchar Saathi portal or app through Chakshu, its option for reporting suspected fraud communication. If money has been lost, use 1930 or cybercrime.gov.in, which also lets you report suspect phone numbers and website links. Keep screenshots of the message, the sender and the link. Add them to your police complaint if you have one. Our guide to FIR vs lost report explains which complaint to file.
Does this happen with Android phones?
The published warnings cited here are about iPhones and Apple Accounts. The same rule applies to any phone that's locked to your account, though. Google's factory reset protection means a reset Android phone asks for a Google Account that was previously synced to it, so thieves have the same reason to want your password. Don't enter your Google password on a page opened from a message about your lost phone, and don't share verification codes.
Where OwnVouch fits
OwnVouch can't unlock, locate or recover a phone. It also can't stop someone sending you a phishing message. What it can do is make a stolen device harder to pass off as clean. If your phone is registered and you switch on Lost mode, its serial shows as flagged lost or stolen to anyone who checks it with the free public lookup, and your identity is never shown. A buyer who checks before paying gets a warning. Keeping your phone in Find My keeps Activation Lock in place, and OwnVouch doesn't change that. The app is in closed beta. You can request a place.
Sources
- Swiss National Cyber Security Centre: Week 44, Lost iPhone and the phishing trap that follows
- Apple Support: If your iPhone or iPad is lost or stolen
- Apple Support: Recognise and avoid social engineering schemes
- Malwarebytes: Stolen iPhones are locked tight, until scammers phish your Apple ID credentials
- BleepingComputer: Lost iPhone? Don't fall for phishing texts saying it was found
- Apple Support: Activation Lock for iPhone and iPad
- Google: Help prevent others from using your device without permission
- C-DOT / DoT: CEIR User Manual for Mobile User (Sanchar Saathi services, including Chakshu)
- National Cyber Crime Reporting Portal