A convicted iPhone thief explains how a vulnerability in Apple’s software got him fast cash—and then a stint in a high-security prison
5 min
RUSH CITY, Minn.—Before the guards let you through the barbed-wire fences and steel doors at this Minnesota Correctional Facility, you have to leave your phone in a locker. Not a total inconvenience when you’re there to visit a prolific iPhone thief.
I wasn’t worried that Aaron Johnson would steal my iPhone, though. I came to find out how he’d steal it.
“I’m already serving time. I just feel like I should try to be on the other end of things and try to help people,” Johnson, 26 years old, told me in an interview we filmed inside the high-security prison where he’s expected to spend the next several years.
For the past year, my colleague Nicole Nguyen and I have investigated a nationwide spate of thefts, where thieves watch iPhone owners tap their passcodes, then steal their targets’ phones—and upend their financial and digital lives.
Johnson, along with a crew of others, operated in Minneapolis for at least a year during 2021 and 2022. In and around bars at night, he would befriend young people, slyly learn their passcodes and take their phones. Using that code, he’d lock victims out of their Apple accounts and loot thousands of dollars from their bank apps. Finally, he’d sell the phones themselves.
It was an elaborate, opportunistic scheme that exploited the Apple ecosystem and targeted trusting iPhone owners who figured a stolen phone was just a stolen phone.
Last week, Apple announced Stolen Device Protection, a feature that likely will protect against these passcode-assisted crimes.
Yet even when you install the software, due in iOS 17.3, there will be loopholes. The biggest loophole? Us. By hearing how Johnson did what he did, we can learn how to better secure the devices that hold so much of our lives.
Johnson isn’t a sophisticated cybercriminal. He said he got his start pickpocketing on the streets of Minneapolis. “I was homeless,” he said. “Started having kids and needed money. I couldn’t really find a job. So that’s just what I did.”
Soon he realised the phones he was nabbing could be worth a lot more—if only he had a way to get inside them. Johnson said no one taught him the passcode trick, he just stayed up late one night fiddling with a phone and figured out how to use the passcode to unlock a bounty of protected services.
“That passcode is the devil,” he said. “It could be God sometimes—or it could be the devil.”
According to the Minneapolis Police Department’s arrest warrant, Johnson and the other 11 members of the enterprise allegedly accumulated nearly $300,000. According to him, it was likely more.
“I had a rush for large amounts at a time,” he said. “I just got too carried away.”
In March, Johnson, who had prior robbery and theft convictions, pleaded guilty to racketeering and was sentenced to 94 months. He told the judge he was sorry for what he did.
Here’s how the nightly operation would go down, according to interviews with Johnson, law-enforcement officials and some of the victims:
Pinpoint the victim. Dimly lit and full of people, bars became his ideal location. College-age men became his ideal target. “They’re already drunk and don’t know what’s going on for real,” Johnson said. Women, he said, tended to be more guarded and alert to suspicious behaviour.
Get the passcode. Friendly and energetic, that’s how victims described Johnson. Some told me he approached them offering drugs. Others said Johnson would tell them he was a rapper and wanted to add them on Snapchat. After talking for a bit, they would hand over the phone to Johnson, thinking he’d just input his info and hand it right back.
“I say, ‘Hey, your phone is locked. What’s the passcode?’ They say, ‘2-3-4-5-6,’ or something. And then I just remember it,” Johnson described. Sometimes he would record people typing their passcodes.
Once the phone was in his hand, he’d leave with it or pass it to someone else in the crew.
Lock them out—fast. Within minutes of taking the iPhones, Johnson was in the Settings menu, changing the Apple ID password. He’d then use the new password to turn off Find My iPhone so victims couldn’t log in on some other phone or computer to remotely locate—and even erase—the stolen device.
Johnson was changing passwords fast—“faster than you could say supercalifragilisticexpialidocious,” he said. “You gotta beat the mice to the cheese.”
Take the money. Johnson said he would then enrol his face in Face ID because “when you got your face on there, you got the key to everything.” The biometric authentication gave Johnson quick access to passwords saved in iCloud Keychain.
Savings, checking, cryptocurrency apps—he was looking to transfer large sums of money out. And if he had trouble getting into those money apps, he’d look for extra information, such as Social Security numbers, in the Notes and Photos apps.
By the morning, he’d have the money transferred. That’s when he’d head to stores to buy stuff using Apple Pay. He’d also use the stolen Apple devices to buy more Apple devices, most often $1,200 iPad Pro models, to sell for cash.
Sell the phones. Finally, he’d erase the phone and sell it to Zhongshuang “Brandon” Su who, according to his arrest warrant, sold them overseas.
While Johnson did steal some Android phones, he went after iPhones because of their higher resale value. At bars, he’d scope out the scene—looking for iPhone Pro models with their telltale trio of cameras. He said Pro Max with a terabyte of storage could get him $900. Su also bought Johnson’s purchased iPads.
Su pleaded guilty to receiving stolen property and was sentenced to 120 days at an adult corrections facility in Hennepin County, Minn. Neither Su nor his lawyer responded to requests for comment.
On a good weekend, Johnson said, he was selling up to 30 iPhones and iPads to Su and making around $20,000—not including money he’d taken from victims’ bank apps, Apple Pay and more.
A week after my trip to Minnesota, Apple announced Stolen Device Protection. The security setting will likely foil most of Johnson’s tricks, but it won’t be turned on automatically.
If you don’t turn it on, you’re as vulnerable as ever. Switching it on adds a line of defence to your phone when away from familiar locations such as home or work.
To change the Apple ID password, a thief would need Face ID or Touch ID biometric scans—that is, your face or your finger. The passcode alone won’t work. And the process has a built-in hourlong delay, followed by another biometric scan. This same slow process is also required for adding a new Face ID and disabling Find my iPhone.
Some functions, such as accessing saved passwords in iCloud Keychain or erasing the iPhone, are available without the delay but still require Face ID or Touch ID.
A criminal might still be motivated to kidnap a person with lots of money, then slowly break through these layers of security. However, the protections will likely dissuade thieves who just want to grab phones and flee the scene.
So what loopholes remain? A thief who gets the passcode could still buy things with Apple Pay. And any app that isn’t protected by an additional password or PIN—like your email, Venmo, PayPal and more—is also vulnerable.
That’s why you should also:
The most obvious is Johnson’s advice: Watch your surroundings and don’t give your passcode out.
If this crime has taught us anything, it’s that a single device now contains access to our entire lives—our memories, our money and more. It’s on us to protect them.
—Nicole Nguyen contributed to this article.
Copyright 2020, Dow Jones & Company, Inc. All Rights Reserved Worldwide. LEARN MORE
What a quarter-million dollars gets you in the western capital.
Alexandre de Betak and his wife are focusing on their most personal project yet.
Subsidised minivans, no income taxes: Countries have rolled out a range of benefits to encourage bigger families, with no luck
7 min
Imagine if having children came with more than $150,000 in cheap loans, a subsidised minivan and a lifetime exemption from income taxes.
Would people have more kids? The answer, it seems, is no.
These are among the benefits—along with cheap child care, extra vacation and free fertility treatments—that have been doled out to parents in different parts of Europe, a region at the forefront of the worldwide baby shortage. Europe’s overall population shrank during the pandemic and is on track to contract by about 40 million by 2050, according to United Nations statistics.
Birthrates have been falling across the developed world since the 1960s. But the decline hit Europe harder and faster than demographers expected—a foreshadowing of the sudden drop in the U.S. fertility rate in recent years.
Reversing the decline in birthrates has become a national priority among governments worldwide, including in China and Russia , where Vladimir Putin declared 2024 “the year of the family.” In the U.S., both Kamala Harris and Donald Trump have pledged to rethink the U.S.’s family policies . Harris wants to offer a $6,000 baby bonus. Trump has floated free in vitro fertilisation and tax deductions for parents.
Europe and other demographically challenged economies in Asia such as South Korea and Singapore have been pushing back against the demographic tide with lavish parental benefits for a generation. Yet falling fertility has persisted among nearly all age groups, incomes and education levels. Those who have many children often say they would have them even without the benefits. Those who don’t say the benefits don’t make enough of a difference.
Two European countries devote more resources to families than almost any other nation: Hungary and Norway. Despite their programs, they have fertility rates of 1.5 and 1.4 children for every woman, respectively—far below the replacement rate of 2.1, the level needed to keep the population steady. The U.S. fertility rate is 1.6.
Demographers suggest the reluctance to have kids is a fundamental cultural shift rather than a purely financial one.
“I used to say to myself, I’m too young. I have to finish my bachelor’s degree. I have to find a partner. Then suddenly I woke up and I was 28 years old, married, with a car and a house and a flexible job and there were no more excuses,” said Norwegian Nancy Lystad Herz. “Even though there are now no practical barriers, I realised that I don’t want children.”
Both Hungary and Norway spend more than 3% of GDP on their different approaches to promoting families—more than the amount they spend on their militaries, according to the Organization for Economic Cooperation and Development.
Hungary says in recent years its spending on policies for families has exceeded 5% of GDP. The U.S. spends around 1% of GDP on family support through child tax credits and programs aimed at low-income Americans.
Hungary’s subsidised housing loan program has helped almost 250,000 families buy or upgrade their homes, the government says. Orsolya Kocsis, a 28-year-old working in human resources, knows having kids would help her and her husband buy a larger house in Budapest, but it isn’t enough to change her mind about not wanting children.
“If we were to say we’ll have two kids, we could basically buy a new house tomorrow,” she said. “But morally, I would not feel right having brought a life into this world to buy a house.”
Promoting baby-making, known as pro natalism, is a key plank of Prime Minister Viktor Orbán ’s broader populist agenda . Hungary’s biennial Budapest Demographic Summit has become a meeting ground for prominent conservative politicians and thinkers. Former Fox News anchor Tucker Carlson and JD Vance, Trump’s vice president pick, have lauded Orbán’s family policies.
Orbán portrays having children inside what he has called a “traditional” family model as a national duty, as well as an alternative to immigration for growing the population. The benefits for child-rearing in Hungary are mostly reserved for married, heterosexual, middle-class couples. Couples who divorce lose subsidised interest rates and in some cases have to pay back the support.
Hungary’s population, now less than 10 million, has been shrinking since the 1980s. The country is about the size of Indiana.
“Because there are so few of us, there’s always this fear that we are disappearing,” said Zsuzsanna Szelényi, program director at the CEU Democracy Institute and author of a book on Orbán.
Hungary’s fertility rate collapsed after the fall of the Soviet Union and by 2010 was down to 1.25 children for every woman. Orbán, a father of five, and his Fidesz party swept back into power that year after being ousted in the early 2000s. He expanded the family support system over the next decade.
Hungary’s fertility rate rose to 1.6 children for every woman in 2021. Ivett Szalma, an associate professor at Corvinus University of Budapest, said that like in many other countries, women in Hungary who had delayed having children after the global financial crisis were finally catching up.
Then progress stalled. Hungary’s fertility rate has fallen for the past two years. Around 51,500 babies have been born there this year through August, a 10% drop compared with the same period last year. Many Hungarian women cite underfunded public health and education systems and difficulties balancing work and family as part of their hesitation to have more children.
Anna Nagy, a 35-year-old former lawyer, had her son in January 2021. She received a loan of about $27,300 that she didn’t have to start paying back until he turned 3. Nagy had left her job before getting pregnant but still received government-funded maternity payments, equal to 70% of her former salary, for the first two years and a smaller amount for a third year.
She used to think she wanted two or three kids, but now only wants one. She is frustrated at the implication that demographic challenges are her responsibility to solve. Economists point to increased immigration and a higher retirement age as other offsets to the financial strains on government budgets from a declining population.
“It’s not our duty as Hungarian women to keep the nation alive,” she said.
Hungary is especially generous to families who have several children, or who give birth at younger ages. Last year, the government announced it would restrict the loan program used by Nagy to women under 30. Families who pledge to have three or more children can get more than $150,000 in subsidised loans. Other benefits include a lifetime exemption from personal taxes for mothers with four or more kids, and up to seven extra annual vacation days for both parents.
Under another program that’s now expired, nearly 30,000 families used a subsidy to buy a minivan, the government said.
Critics of Hungary’s family policies say the money is wasted on people who would have had large families anyway. The government has also been criticised for excluding groups such as the minority Roma population and poorer Hungarians. Bank accounts, credit histories and a steady employment history are required for many of the incentives.
Orbán’s press office didn’t respond to requests for comment. Tünde Fűrész, head of a government-backed demographic research institute, disagreed that the policies are exclusionary and said the loans were used more heavily in economically depressed areas.
Government programs weren’t a determining factor for Eszter Gerencsér, 37, who said she and her husband always wanted a big family. They have four children, ages 3 to 10.
They received about $62,800 in low-interest loans through government programs and $35,500 in grants. They used the money to buy and renovate a house outside of Budapest. After she had her fourth child, the government forgave $11,000 of the debt. Her family receives a monthly payment of about $40 a month for each child.
Most Hungarian women stay home with their children until they turn 2, after which maternity payments are reduced. Publicly run nurseries are free for large families like hers. Gerencsér worked on and off between her pregnancies and returned full-time to work, in a civil-service job, earlier this year.
She still thinks Hungarian society is stacked against mothers and said she struggled to find a job because employers worried she would have to take lots of time off.
The country’s international reputation as family-friendly is “what you call good marketing,” she said.
Norway has been incentivising births for decades with generous parental leave and subsidised child care. New parents in Norway can share nearly a year of fully paid leave, or around 14 months at 80% pay. More than three months are reserved for fathers to encourage more equal caregiving. Mothers are entitled to take at least an hour at work to breast-feed or pump.
The government’s goal has never been explicitly to encourage people to have more children, but instead to make it easier for women to balance careers and children, said Trude Lappegard, a professor who researches demography at the University of Oslo. Norway doesn’t restrict benefits for unmarried parents or same-sex couples.
Its fertility rate of 1.4 children per woman has steadily fallen from nearly 2 in 2009. Unlike Hungary, Norway’s population is still growing for now, due mostly to immigration.
“It is difficult to say why the population is having fewer children,” Kjersti Toppe, the Norwegian Minister of Children and Families, said in an email. She said the government has increased monthly payments for parents and has formed a committee to investigate the baby bust and ways to reverse it.
More women in Norway are childless or have only one kid. The percentage of 45-year-old women with three or more children fell to 27.5% last year from 33% in 2010. Women are also waiting longer to have children—the average age at which women had their first child reached 30.3 last year. The global surge in housing costs and a longer timeline for getting established in careers likely plays a role, researchers say. Older first-time mothers can face obstacles: Women 35 and older are at higher risk of infertility and pregnancy complications.
Gina Ekholt, 39, said the government’s policies have helped offset much of the costs of having a child and allowed her to maintain her career as a senior adviser at the nonprofit Save the Children Norway. She had her daughter at age 34 after a round of state-subsidised IVF that cost about $1,600. She wanted to have more children but can’t because of fertility issues.
She receives a monthly stipend of about $160 a month, almost fully offsetting a $190 monthly nursery fee.
“On the economy side, it hasn’t made a bump. What’s been difficult for me is trying to have another kid,” she said. “The notion that we should have more kids, and you’re very selfish if you have only had one…those are the things that took a toll on me.”
Her friend Ewa Sapieżyńska, a 44-year-old Polish-Norwegian writer and social scientist with one son, has helped her see the upside of the one-child lifestyle. “For me, the decision is not about money. It’s about my life,” she said.
