A cybersecurity consultant watched a friend unlock her iPhone at a crowded bar, then leaned over and said:
"If I wanted to, I could have her bank account, her email and her Apple account before she finished that drink. All I needed was what she just showed the whole room."
He told me:
"Thieves figured this out years ago. Watch someone type their passcode. Steal the phone. With that passcode, they could change the Apple account password, turn off Find My, open the saved passwords and get into banking apps."
"The Wall Street Journal documented it in 2023. One woman watched about $10,000 disappear from her bank account within 24 hours. Another victim had more than $10,000 transferred out. Minnesota prosecutors said a single theft ring took nearly $300,000 from at least 40 victims."
"Some never got back into their Apple accounts. The thieves turned on a recovery key and locked them out. One father lost access to eight years of photos of his daughters."
"Apple's answer is Stolen Device Protection. Away from home or work, it demands Face ID to see your passwords or erase the phone. No passcode fallback. For the big moves, like changing your Apple account password, a thief has to wait an hour and scan your face again."
"In iOS 26.4, Apple turned it on for everyone by default. But only if you've updated. And the default only protects you away from familiar locations. I switch every client to 'Always.'"
"Your phone is a safe. Your passcode is the combination. Most people are still typing a 6-digit combination in front of strangers."
Here are the 10 iPhone security settings he changes on every client's phone. 🧵