If you get an unexpected iPhone shipped to you using it is just giving hackers your bank accounts and passwords. Here's what to look for, who to tell about it, and how to deal with it.
Well, maybe you do have a secret admirer, we're not judging and you are looking very good today. But a surprise gift of an iPhone will seem to be too good to be true because it is.
It will have been sent to you, or someone in your life who has a big job, in the hope, and possibly the fair expectation, that you won't question your luck and instead will enjoy the phone. Then every single thing you do on that phone is harvested and sent to fraudsters.
Passwords are the obvious first issue. If you log into this device, and use it, you are giving them those plus account details and verification codes.
But then through that, you're giving them enough to impersonate you.
What to look for couldn't be easier. If it's an iPhone you didn't order and which your spouse or IT department looks blank about when you thank them for it, that's enough.
As for how it happens, a Reddit user has recounted what just happened to them. Showing a photo of a sealed iPhone 15 Pro Max, they say it "showed up at our house even though we never ordered it."
"Things got weirder when I checked it," they continue. "The serial number on the iPhone box is recognized by Apple as an iPhone 15 Pro Max. Apple says that the serial number was purchased/activated in December 2023 and its coverage expired in 2024."
Remember, the box was sealed. It also came with a FedEx shipping label, but the Reddit user says its number wasn't found when they searched FedEx's online tracker.
We have some questions about the authenticity of the account, but the lesson to be taught here is a good one.
If you ever doubt that it's financially worth it to cyber attack someone, examine what happened here. True, it's unlikely that the hacker bought the iPhone, although if they did, that model retailed from $1,200 back in 2023.
What's much more likely is that the phone was stolen, but then the thief would be bound to get some cash from simply selling it, even if just for parts. Sending it to you unsolicited and for free sounds like throwing money away.
It is in this case. That Reddit user is not going to turn on that iPhone so this was a waste of the hacker's time and money.
But just as you know that ridiculously obvious spam emails keep coming because enough people are fooled, these bad actors are playing the percentages. Enough people will turn on and use these free iPhones that it is worth sending them out.
It's a decent chance that just one person using one of these iPhones is enough, too. Just one person could be enough because these bad actors could gain everything they need to totally clear out someone's life savings.
As this kind of cyberattack is targeted at one individual at a time. It's about getting access to their accounts, and its become known as another form of Whale Phishing.
That used to be solely the name for a really targeted cyberattack against one individual in a corporation. It would be against someone like the CEO, whom no one would question if they ordered millions of dollars to be transferred around.
You may not handle millions of dollars, but every dollar is yours and it wouldn't just be at risk, it would be gone. So the absolutely mandatory way to protect yourself is to never use an iPhone whose provenance you don't know.
And, if you're associated with a big company, you should probably tell your IT department about it. They may want to see it, and they may not. Do not let them just shrug about it, though.
After that, you could take it to an Apple Store to be recycled or you could throw it in any other ewaste recycling bin. Presumably, it still has a lithium ion battery so don't just toss it in the trash.
Either disposal option is better than turning the thing on and using it.
