iPhone Security Alert—Why You Should Always Use Face ID In Public

One of the best things about iPhones is their security features, but a recent bout of thefts has led people to question some of Apple’s safeguards.

It’s all well and good protecting the software on iPhones, with updates such as the iOS 16.4.1 update fixing major holes that attackers can exploit. But recent reports have focused on a more basic iPhone attack—and it happens in public when you are out and about.

According to reports, a bunch of iPhone thefts have occurred after criminals “shoulder surfed” their victims, watching when they typed in their passcodes. The attackers then stole the devices and were able to log in, stealing all available information on the iPhone, sometimes including email and financial details via online banking. They can also reset your Apple ID password, erase your device and turn of Find My so you can’t track your lost iPhone.

Now a new report in the Wall Street Journal focuses on the shortcomings of Apple’s recovery keys, which are meant to protect people’s Apple IDs.

Recovery keys—the randomly generated codes you can use to regain access to an Apple ID— are the only option for recovering access once a device is stolen. But if an attacker has taken over your device via your passcode, they won’t help you.

Responding to the Wall Street Journal, Apple said it is “always investigating additional protections against emerging threats like this one.”

“We sympathize with people who have had this experience and we take all attacks on our users very seriously, no matter how rare,” Apple said. “We work tirelessly every day to protect our users’ accounts and data, and are always investigating additional protections against emerging threats like this one.”

Protecting your iPhone

Jake Moore, global cybersecurity advisor at ESET says it has “taken far too long for Apple to even respond to this problem.”

“Unfortunately, people still use simple or easy-to-find passcodes to unlock their iPhones—plus some may innocently never think about their surroundings when entering the code,” he warns.

If, despite recovery codes, thieves can easily go one step further and lock a victim out of their Apple ID, Moore says an extra security measure is needed.

In the meantime, Face ID and Touch ID are essential in public places and it is good practice to replace a four or six-digit numeric code with a long alphanumeric passcode which can be created in the settings, says Moore.

“As this code can access saved passwords on Apple devices, it is a good idea to save passwords in a third party password manager instead—which cannot be accessed via the phone’s passcode safety device,” says Moore. “Or use email that also has recovery access.”

You can change your passcode in the iPhone Settings app under Face ID & Passcode > Change Passcode.

The key step to avoiding these sorts of iPhone attacks is a simple change—make sure you set up Face ID and always use it to open your phone when you are out in public places.