A convicted iPhone thief explains how a vulnerability in Apple’s software got him fast cash—and then a stint in a high-security prison
5 min
RUSH CITY, Minn.—Before the guards let you through the barbed-wire fences and steel doors at this Minnesota Correctional Facility, you have to leave your phone in a locker. Not a total inconvenience when you’re there to visit a prolific iPhone thief.
I wasn’t worried that Aaron Johnson would steal my iPhone, though. I came to find out how he’d steal it.
“I’m already serving time. I just feel like I should try to be on the other end of things and try to help people,” Johnson, 26 years old, told me in an interview we filmed inside the high-security prison where he’s expected to spend the next several years.
For the past year, my colleague Nicole Nguyen and I have investigated a nationwide spate of thefts, where thieves watch iPhone owners tap their passcodes, then steal their targets’ phones—and upend their financial and digital lives.
Johnson, along with a crew of others, operated in Minneapolis for at least a year during 2021 and 2022. In and around bars at night, he would befriend young people, slyly learn their passcodes and take their phones. Using that code, he’d lock victims out of their Apple accounts and loot thousands of dollars from their bank apps. Finally, he’d sell the phones themselves.
It was an elaborate, opportunistic scheme that exploited the Apple ecosystem and targeted trusting iPhone owners who figured a stolen phone was just a stolen phone.
Last week, Apple announced Stolen Device Protection, a feature that likely will protect against these passcode-assisted crimes.
Yet even when you install the software, due in iOS 17.3, there will be loopholes. The biggest loophole? Us. By hearing how Johnson did what he did, we can learn how to better secure the devices that hold so much of our lives.
Johnson isn’t a sophisticated cybercriminal. He said he got his start pickpocketing on the streets of Minneapolis. “I was homeless,” he said. “Started having kids and needed money. I couldn’t really find a job. So that’s just what I did.”
Soon he realised the phones he was nabbing could be worth a lot more—if only he had a way to get inside them. Johnson said no one taught him the passcode trick, he just stayed up late one night fiddling with a phone and figured out how to use the passcode to unlock a bounty of protected services.
“That passcode is the devil,” he said. “It could be God sometimes—or it could be the devil.”
According to the Minneapolis Police Department’s arrest warrant, Johnson and the other 11 members of the enterprise allegedly accumulated nearly $300,000. According to him, it was likely more.
“I had a rush for large amounts at a time,” he said. “I just got too carried away.”
In March, Johnson, who had prior robbery and theft convictions, pleaded guilty to racketeering and was sentenced to 94 months. He told the judge he was sorry for what he did.
Here’s how the nightly operation would go down, according to interviews with Johnson, law-enforcement officials and some of the victims:
Pinpoint the victim. Dimly lit and full of people, bars became his ideal location. College-age men became his ideal target. “They’re already drunk and don’t know what’s going on for real,” Johnson said. Women, he said, tended to be more guarded and alert to suspicious behaviour.
Get the passcode. Friendly and energetic, that’s how victims described Johnson. Some told me he approached them offering drugs. Others said Johnson would tell them he was a rapper and wanted to add them on Snapchat. After talking for a bit, they would hand over the phone to Johnson, thinking he’d just input his info and hand it right back.
“I say, ‘Hey, your phone is locked. What’s the passcode?’ They say, ‘2-3-4-5-6,’ or something. And then I just remember it,” Johnson described. Sometimes he would record people typing their passcodes.
Once the phone was in his hand, he’d leave with it or pass it to someone else in the crew.
Lock them out—fast. Within minutes of taking the iPhones, Johnson was in the Settings menu, changing the Apple ID password. He’d then use the new password to turn off Find My iPhone so victims couldn’t log in on some other phone or computer to remotely locate—and even erase—the stolen device.
Johnson was changing passwords fast—“faster than you could say supercalifragilisticexpialidocious,” he said. “You gotta beat the mice to the cheese.”
Take the money. Johnson said he would then enrol his face in Face ID because “when you got your face on there, you got the key to everything.” The biometric authentication gave Johnson quick access to passwords saved in iCloud Keychain.
Savings, checking, cryptocurrency apps—he was looking to transfer large sums of money out. And if he had trouble getting into those money apps, he’d look for extra information, such as Social Security numbers, in the Notes and Photos apps.
By the morning, he’d have the money transferred. That’s when he’d head to stores to buy stuff using Apple Pay. He’d also use the stolen Apple devices to buy more Apple devices, most often $1,200 iPad Pro models, to sell for cash.
Sell the phones. Finally, he’d erase the phone and sell it to Zhongshuang “Brandon” Su who, according to his arrest warrant, sold them overseas.
While Johnson did steal some Android phones, he went after iPhones because of their higher resale value. At bars, he’d scope out the scene—looking for iPhone Pro models with their telltale trio of cameras. He said Pro Max with a terabyte of storage could get him $900. Su also bought Johnson’s purchased iPads.
Su pleaded guilty to receiving stolen property and was sentenced to 120 days at an adult corrections facility in Hennepin County, Minn. Neither Su nor his lawyer responded to requests for comment.
On a good weekend, Johnson said, he was selling up to 30 iPhones and iPads to Su and making around $20,000—not including money he’d taken from victims’ bank apps, Apple Pay and more.
A week after my trip to Minnesota, Apple announced Stolen Device Protection. The security setting will likely foil most of Johnson’s tricks, but it won’t be turned on automatically.
If you don’t turn it on, you’re as vulnerable as ever. Switching it on adds a line of defence to your phone when away from familiar locations such as home or work.
To change the Apple ID password, a thief would need Face ID or Touch ID biometric scans—that is, your face or your finger. The passcode alone won’t work. And the process has a built-in hourlong delay, followed by another biometric scan. This same slow process is also required for adding a new Face ID and disabling Find my iPhone.
Some functions, such as accessing saved passwords in iCloud Keychain or erasing the iPhone, are available without the delay but still require Face ID or Touch ID.
A criminal might still be motivated to kidnap a person with lots of money, then slowly break through these layers of security. However, the protections will likely dissuade thieves who just want to grab phones and flee the scene.
So what loopholes remain? A thief who gets the passcode could still buy things with Apple Pay. And any app that isn’t protected by an additional password or PIN—like your email, Venmo, PayPal and more—is also vulnerable.
That’s why you should also:
The most obvious is Johnson’s advice: Watch your surroundings and don’t give your passcode out.
If this crime has taught us anything, it’s that a single device now contains access to our entire lives—our memories, our money and more. It’s on us to protect them.
—Nicole Nguyen contributed to this article.
Copyright 2020, Dow Jones & Company, Inc. All Rights Reserved Worldwide. LEARN MORE
What a quarter-million dollars gets you in the western capital.
Alexandre de Betak and his wife are focusing on their most personal project yet.
4 min
U.S. investors’ enthusiasm over Japanese stocks at this time last year turned out to be misplaced, but the market is again on the list of potential ways to diversify. Corporate shake-ups, hints of inflation after years of declining prices, and a trade battle could work in its favor.
Japanese stocks started 2024 off strong, but an unexpected interest-rate increase in August by the Bank of Japan triggered a sharp decline that the market has spent the rest of the year clawing back. Weakness in the yen has cut into returns in dollar terms. The iShares MSCI Japan ETF , which isn’t hedged, barely returned 7% last year, compared with 30% for the WisdomTree Japan Hedged Equity Fund .
The market is relatively cheap, trading at 15 times forward earnings, about where it was a decade ago, and events on the horizon could give it a boost. Masakazu Takeda, who runs the Hennessy Japan fund, expects earnings growth of mid-single digits—2% after inflation and an additional 2% to 3% as companies return more to shareholders through dividends and buybacks.
“We can easily get 10% plus returns if there’s no exogenous risks,” Takeda told Barron’s in December.
The first couple months of the year could be volatile as investors assess potential spoilers, such as whether the new Trump administration limits its tariff battle to China or goes wider, which would hurt Japan’s export-dependent market. The size of the wage increases labor unions secure in spring negotiations is another risk.
But beyond the headlines, fund managers and strategists see potential positive factors. First, 2024 will likely turn out to have been a record year for corporate earnings because some companies have benefited from rising prices and increasing demand, as well as better capital allocation.
In a note to clients, BofA strategist Masashi Akutsu said the market may again focus on a shift in corporate behavior that has begun to take place in recent years. For years, corporate culture has been resistant to change but recent developments—a battle over Seven & i Holdings that pits the founding family and investors against a bid from Canada’s Alimentation Couche-Tard , and Honda and Nissan ’s merger are examples—have been a wake-up call for Japanese companies to pursue overhauls. He expects a pickup in share buybacks as companies begin to think about shareholder returns more.
A record number of companies have also delisted, often through management buyouts, in another indication that corporate behavior is changing in favor of shareholders.
“Japan is attracting a lot of activist interest in a lot of different guises, says Donald Farquharson, head of the Japanese equities team for Baillie Gifford. “While shareholder proposals are usually unsuccessful, they do start in motion a process behind the scenes about the capital structure.”
For years, money-losing businesses were left alone in large corporations, but the recent spate of activism and focus on shareholder returns has pushed companies to jettison such divisions or take measures to improve them.
That isn‘t to say it is going to be an easy year. A more protectionist world could be problematic for sentiment.
But Japan’s approach could become a model for others in this new world. “Japan has spent the last 30 to 40 years investing in business overseas, with the automotive industry, for example, manufacturing a lot of the cars in the geographies it sells in,” Farquharson said. “That’s true of a lot of what Japan is selling overseas.”
Trade volatility that hits Japanese stocks broadly could offer opportunities. Concerns about tariffs could drag down companies such as Tokio Marine Holdings, which gets half its earnings by selling insurance in the U.S., but wouldn’t be affected by duties. Similarly, Shin-Etsu Chemicals , a silicon wafer behemoth that sells critical materials, including to the chip industry, is another potential winner, Takeda says.
If other companies follow the lead of Japanese exporters and set up shop in the markets they sell in, Japanese automation makers like Nidec and Keyence might benefit as a way to control costs in countries where wages are higher, Farquharson says.
And as Japanese workers get real wage growth and settle into living in an economy no longer in a deflationary rut, companies focused on domestic consumers such as Rakuten Group should benefit. The internet company offers retail and travel, both of which should benefit, but also is home to an online banking and investment platform.
Rakuten’s enterprise value—its market capitalization plus debt—is still less than its annual sales, in part because the company had been investing heavily in its mobile network. But that division is about to hit break even, Farquharson says.
A stock that stands to benefit from consumer spending and the waves or tourists the weak yen is attracting is Orix , a conglomerate whose businesses include an international airport serving Osaka. The company’s aircraft-leasing business also benefits from the production snags and supply-chain disruptions at Airbus and Boeing , Takeda says.
An added benefit: Its financial businesses stand to get a boost as the Bank of Japan slowly normalizes interest rates. The stock trades at about nine times earnings and about par for book value, while paying a 4% dividend yield.
Corrections & Amplifications: The past year is expected to turn out to have been a record one for corporate earnings in Japan. An earlier version of this article incorrectly gave the time frame as the 12 months through March. Separately, Masashi Akutsu is a strategist at BofA. An earlier version incorrectly identified his employer as UBS.
