Risks, Realities & Protection of Phone Theft - Part 2: How Phone Security Can Be Compromised

Aug 4
2 min read

This week, LSDS is continuing our series on phone theft and the risks associated with a stolen device.

There can be serious implications, especially for individuals who don't quickly realize their phone is missing or don't report it and take action.

Account Lockout:

If the victim doesn’t take quick action, the thieves can often quickly change Apple/Google passwords and backup verification methods. This immediately removes the ability to track, lock, and wipe your phone.

Wallet Fraud:

At this point, if the thieves have full access, they most likely have access to your mobile wallet, which can be used for purchases. There have been multiple reported cases of thieves getting access to the phone and wallet but using the wallet and staying under the $10,000 daily limit to not raise any red flags.

When a wallet is 'properly used' with full access, it can be VERY hard to dispute charges and chargebacks against the bank/financial institution.

MFA Issues:

Like many people, some people have all their MFA options (SMS, WhatsApp, email, authenticator app, etc.) on their device. If this is the case, people can lose the entire recovery process to their devices.

Corporate/Enterprise/Work exposure:

Depending on. how the devices are used, there could be active sessions on the device (SSO sessions, VPN certs, session tokens, etc.) to access corporate resources.

These can stay active until they are specifically revoked (ex. corporate IT goes into the mobile device management and manually revokes all access to John Doe's phone BYOD).

Crypto:

A big one today, people keep their wallets connected to a phone app (Gemini, Coinbase, etc.). Crypto exchanges are irreversible and usually can't be tracked.

Long Term:

This can get really bad quick. License photos, passport photos, Social Security Numbers, tax info, etc. Many people have these items somewhere in their phone (cloud drive, photos, messages, emails, etc.).

It is possible that when a thief gets full access, they can use social engineering of your contacts, which could also lead to extortion/romance scams. This is especially dangerous when traveling internationally.