It depends on two main factors:
- The skill of the Phisher/Social Engineer
- The Gullibility of the victim (How much he/she is convinced by the Phisher)
It can range from basic information, such as your location, phone number and full name to your family's details and bank credentials.
Then you have to ask yourself, how much does Google know about you?
The main vulnerability in a human (apart from stupidity) is online presence...
Do you have a Facebook Account? Clearly this Phisher knows your Email account, is this linked to your Facebook, Twitter or LinkedIn account?
Does your password contain a date-of-birth, family/pet name or 13375P34K?
Then we reach your iPhone... Is it password protected? Number or Phrase?
If it's a number, is it 123, 1234, 12345, 15790, 78982, 1278?
If it's a phrase, is it P455W0RD, home, passwOrd, Password, QwErTy?
If the attacker does in-fact have your iPhone, and easily guesses your password, then everything you have ever connected to with that device is in danger...
Humans are creatures of habit, and always will be. Once an attacker is in your life, he will not stop!
This Phisher can Dox you right there and then! With the right amount of luck & skill...
- Full Name
- Phone Number
- Family names
- Family accounts
- Family details
- Bank details
Other website accounts
Many, many more...
Then we can think about what happens when they've acquired enough information about your bank, the man sat at his desk in his boring office will just be as gullible as the next, if he's given the correct information, he will let anyone into your account.
Remember that Social Engineering is a very powerful weapon, and due to current media control and educational failure, humans are easier to hack than computers!
Happy thoughts! <3