- Is this crazy story.
The "Wall Street Journal" looked at this and-
- [Joanna] Previously, we reported that thieves
are stealing people's iPhones and passcodes.
- New warning about iPhone thefts
connected to your passcode.
- And then taking over these victims'
financial and digital lives.
That was chapter one, this is chapter two.
- I went to visit my buddy in Chicago.
(upbeat music)
And my phone was stolen.
(patrons talking indistinctly)
And the thieves were able to generate a recovery key,
which would lock me out of my iCloud account.
I'm willing to do anything possible
just to get my photos and videos back.
(phone ringing)
- [Support] Thank you for contacting Apple Support.
- Can't access iCloud account.
- My inbox has been flooded with notes from people like Greg
who can't get back into their Apple accounts
to access years of photos, videos, and more.
It's the collateral damage
caused by a hidden iPhone setting enabled by the thieves.
- The killer has been the recovery key.
- So, I dug into the secret setting
and found out that it's flawed, big time.
Thieves committing crimes like this across the country
use the passcode to turn on the recovery key
before they steal money from apps on the phone.
This way, the owners can't remotely get back in
to wipe the device and use Find my iPhone.
To understand how thieves exploit these vulnerabilities,
think of your Apple account like a house.
The thieves get in and then keep you out
by changing the main lock on the front door,
your Apple account password.
Yes, with the passcode to your iPhone
they can change the Apple account password.
It's a major vulnerability in itself,
which I talked about a lot in that first video.
Now, if a victim wants to get back in,
they go through account recovery, aka,
the old forgot your password reset process.
Apple will ask for your trusted phone number,
provide that and a texted code, and you should be able
to create a new password to unlock the front door.
But many of these thieves put up more barriers.
They change the trusted phone number
and or create a recovery key.
Under Settings, Apple ID,
Password & Security, Account Recovery,
you can turn on a recovery key,
which creates a unique 28 character code.
It is now needed to get to the step
of changing your account password.
If you don't have that code,
Apple says you could be
locked out of your account permanently, aka,
the door can never be opened.
When you call Apple and you tell them
you don't have the recovery key, what do they tell you?
- To an extent, they told me, you know, too bad, so sad.
There was no possible way to regenerate the recovery key
or to get access to my data
without that specific recovery key.
I contacted Apple support,
many levels tried to escalate that.
I went through Apple Legal
who pushed me back to Apple Support.
I've spoken to many attorneys
trying to figure out a course of action to get my data back.
- When I reached out to Apple about all this,
a spokesman said, "We sympathize with people
who have had this experience and we take all attacks
on our users very seriously, no matter how rare.
We work tirelessly every day
to protect our users' accounts and data,
and we are always investigating additional
protections against emerging threats like this one."
The recovery key was supposed to add extra protection
to your Apple account from online hackers.
But there's a big flaw.
Even if someone like Greg already had the setting turned on,
a thief with the iPhone's passcode
could create a new key right on the device,
which would replace the old one.
Apple designed this as a convenience measure
for people who misplaced a previously generated key.
Fundamentally, account recovery
is about proving that this account is yours.
Greg, and many others I've spoken to have offered
Apple other forms of identification to prove that.
- I've been willing to give Apple
any piece of identification or verifiable information
that I am me and this is my account.
Whether or not that be my ID, my passport,
my social security number.
- Of course, there's a reason Apple
doesn't keep your social security number on file, privacy.
There is one thing you can do right now
to prevent this from happening
if your iPhone were ever stolen
Go to Settings, Screen Time, Use Screen Time Passcode,
and create a passcode that's different
from your main phone passcode.
Now, go to Screen Time, Content & Privacy Restrictions,
then turn on this switch.
Scroll down to the Allowed Changes section,
where it says Account Changes and select Don't Allow.
Now, a thief wouldn't be able
to get into this area to change your account password
or turn on that recovery key,
they would need that screen time passcode.
But clearly, there is far more for Apple to do here
to protect us from crimes like this.
The recovery key policies should be changed
so that it's not the only way
to get back into an account once it's activated.
And Apple should certainly restrict the recovery key
from being so easily deleted or regenerated
by someone who has your phone and passcode.
And Apple should provide another way
to confirm people are who they are,
possibly by accepting government IDs.
Ultimately, this entire crime is based
around Apple loopholes.
A stolen phone, passcode, and tap of a button
shouldn't mean fighting one of the world's largest companies
to get our memories back.
- At this point I'm willing to offer Apple
whatever it takes to get my pictures and videos back,
whether it's tens of thousands of dollars,
a retina scan, a DNA test, whatever it takes.