How to proactively prevent data-theft if a stolen android phone is immediately taken offline?

Question

• Assume that it is an android 10+ and that it is encrypted.
• Assume that it is protected by a 6-digit pseudo-random pin code.
• Assume that the data can be erased remotely using google's "Find My Device" service.

If the thief shuts the phone down, they'll have to contend with the disk encryption (it will wipe itself after a certain number of incorrect tries)

If the thief doesn't shut down the phone, they'll have to bypass the lock screen before I am able to erase the data remotely.

If however, the thief simply places the phone in airplane mode (which doesn't require a pin to access), then they'll have unlimited time to bypass the lock screen.

1. How likely are they to bypass the lock screen assuming little to no resources, fairly skilled, but hellbent on data extraction?
2. Is there anything I can do proactively to not only make it harder for them to bypass the lock screen but also to prevent data-theft once/if they do.

The type of data I would be concerned about:

• Email inbox.
• Chat conversations (Skype; Whatsapp*; Slack).

I do have the option of removing said applications and data, but that would also make the phone largely useless to me.

Whatsapp Is especially tricky given that they'll also have access to the sim card, and I am unlikely to be able to have it blocked/replaced somehow. Can we please stop with this phone number based identity madness?

Answer 1

If the android device is on latest security patch, there's no way to bypass screen lock protection. Even if it's not fully updated, the thief has to search what known vulnerabilities can be exploited from locked screen for privilege escalation. He will also have to come up with an exploit. Many high severity and critical severity vulnerabilities that are fixed each month don't have publicly available exploits.

Screen unlock attempts timeout increases exponentially after every few incorrect attempts. If your unlock code is not in most predictable android lock patterns, it cannot be brute-forced. If the thief goes to recovery mode to factory reset the device, on first boot, device will ask for Google account credentials that were used to set up the device by the owner. This is called Factory Reset Protection.

By default, sensitive messages like OTP are displayed on lock screen. It can be disabled from settings. First, the thief will use your SIM to learn your phone number. Then he will reset Google account password using OTP showing up on your lock screen. After 72 hours, the new password can be used to unlock factory reset protection.

Your data is always safe but your accounts can be compromised with possession of SIM card alone. Use TOTP to protect your accounts and immediately request your network operator to block SIM. That will leave your device un-reusable for the thief.