Author here. I just want to clarify some of the points I've seen repeatedly mentioned in the comments:
AFAIK my brother didn't hand over his iCloud password. That's what the phishing messages were for. Had he not fallen for that (as the article in Spanish explains) the thieves could have only sold the phone for parts. As for how they changed the recovery number, lstamour [1] has what I consider a good guess.
My brother did have a screen lock, but it was a 4-digit numeric code. My guess is that the smudges on the screen revealed quite easily what the code was as AFAIK the thieves didn't ask for it. He chose that code because he often shares the phone with his wife and having to show his face every time was annoying. He didn't know you can have two registered faces, and I don't have the heart to tell him now.
And finally, many of you correctly pointed out that there are steps that could have mitigated this attack. I wanted to share this story mostly [2] because I think it's an interesting example of what iPhone security is like for the type of user who would never set foot in HN. I could have easily followed the steps delineated in this comment [3] from the other thread, but my brother is not that type of user.
[1] https://news.ycombinator.com/item?id=34407683
[2] Okay, the main reason I published this story was to find someone who can help (wink wink). But the other reason was definitely in the top 3.
[3] https://news.ycombinator.com/item?id=33602627
AFAIK my brother didn't hand over his iCloud password. That's what the phishing messages were for. Had he not fallen for that (as the article in Spanish explains) the thieves could have only sold the phone for parts. As for how they changed the recovery number, lstamour [1] has what I consider a good guess.
My brother did have a screen lock, but it was a 4-digit numeric code. My guess is that the smudges on the screen revealed quite easily what the code was as AFAIK the thieves didn't ask for it. He chose that code because he often shares the phone with his wife and having to show his face every time was annoying. He didn't know you can have two registered faces, and I don't have the heart to tell him now.
And finally, many of you correctly pointed out that there are steps that could have mitigated this attack. I wanted to share this story mostly [2] because I think it's an interesting example of what iPhone security is like for the type of user who would never set foot in HN. I could have easily followed the steps delineated in this comment [3] from the other thread, but my brother is not that type of user.
[1] https://news.ycombinator.com/item?id=34407683
[2] Okay, the main reason I published this story was to find someone who can help (wink wink). But the other reason was definitely in the top 3.
[3] https://news.ycombinator.com/item?id=33602627