0

My iPhone was recently stolen and since then I've been receiving messages and emails saying that 'a sound was played on your iPhone' or 'your iPhone was found. Visit here to confirm your location'. The numbers and email addresses are clearly fake.

I was wondering what can he/she obtain, except from my Apple ID, from me? How much can he/she do?

  • by logging into the fake site, they get both your AppleID and your password - therefore they get everything tied to your account. – schroeder Sep 5 '15 at 19:55
  • 2
    I see two ways of interpreting this question: How much information, at maximum, can a phisher/scammer obtain *if I fell for it*? and How much information about me can obtain the guy who "found" my iPhone? – Ángel Sep 5 '15 at 22:38
  • @Ángel sorry I meant stolen. And yes I fell for it. The guy has registered 3 or 4 domains just for this purpose. The email was so convincing... I did sign in there but with a fake ID and password. Right now, apparently, he is trying to get into the the phone as I had a a fingerprint lock and a ... uh ... complex pin. – Hamza Shezad Sep 6 '15 at 3:49
5

It depends on two main factors:

  • The skill of the Phisher/Social Engineer
  • The Gullibility of the victim (How much he/she is convinced by the Phisher)

It can range from basic information, such as your location, phone number and full name to your family's details and bank credentials.

Then you have to ask yourself, how much does Google know about you?

The main vulnerability in a human (apart from stupidity) is online presence... Do you have a Facebook Account? Clearly this Phisher knows your Email account, is this linked to your Facebook, Twitter or LinkedIn account?

Does your password contain a date-of-birth, family/pet name or 13375P34K?

Then we reach your iPhone... Is it password protected? Number or Phrase?

If it's a number, is it 123, 1234, 12345, 15790, 78982, 1278?

If it's a phrase, is it P455W0RD, home, passwOrd, Password, QwErTy?

If the attacker does in-fact have your iPhone, and easily guesses your password, then everything you have ever connected to with that device is in danger...

Humans are creatures of habit, and always will be. Once an attacker is in your life, he will not stop!

This Phisher can Dox you right there and then! With the right amount of luck & skill...

  • Full Name
  • Address
  • Phone Number
  • Family names
  • Family accounts
  • Family details
  • Bank details
  • Other website accounts

  • Many, many more...

Then we can think about what happens when they've acquired enough information about your bank, the man sat at his desk in his boring office will just be as gullible as the next, if he's given the correct information, he will let anyone into your account.

Remember that Social Engineering is a very powerful weapon, and due to current media control and educational failure, humans are easier to hack than computers!

Happy thoughts! <3

  • By the way, what are some of the email addresses that Apple uses (e.g. for Find My iPhone alerts, password reset instructions, etc.)? – Hamza Shezad Sep 6 '15 at 3:56
  • @HamzaShezad I'm not too sure of that, frankly I despise Apple... However if you were to visit their website or just Google it, then I'm sure you'll find your answer. :) – mull3t Sep 6 '15 at 20:39

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.