Your iPhone gets stolen, then Apple Support rings. It's the thief.

A stolen iPhone is close to worthless to whoever took it. Activation Lock ties the handset to your Apple account, so without your passcode it's a paperweight. That leaves the thief one route to a working phone: ask you for the code. Politely, professionally, and by telephone.

SOCRadar published the inside of that operation this week. AnonyMousKIT is a paid service - other criminals buy credits and it does the work for them - running since early 2024 across 506 domains with 168 reseller shopfronts on top. Alongside email and SMS it runs an AI voice agent with five configured personas in English, Spanish and Portuguese, all of them a version of "Alice from Apple Support". The script is careful. Alice confirms she's speaking to the owner, says someone has just tried to remove the Activation Lock on the device at an Apple Store, asks for the four- or six-digit passcode and reads the digits back to check them, then asks whether a recovery link has arrived by text. That link opens a fake Find My page which collects the Apple ID password and the two-factor code too.

Each call costs the operator about ten cents. SOCRadar recovered logs for 200 of them placed between last August and May, 179 to Brazilian numbers, and found no record of a single captured passcode - a hundred people simply hung up. Encouraging, except the same operation logged more than six thousand phishing emails, and email doesn't hang up on anybody.

One rule defeats the whole thing: Apple does not ask for your device passcode, and neither does anyone else. Not on a call, not on a page you reached from a text. If a call about a lost device sounds genuine, end it and sign in to iCloud yourself to check. The same trick gets recycled for Microsoft and Google accounts by email, and Tendvane's Privacy and accounts check shows plainly how the accounts on your PC are signed in and what a stolen password would open.