Losing your phone feels like losing a gadget. In reality, you're losing the key to your bank, your email, your photos and every account that sends a login code by text. London's police have just finished their biggest-ever crackdown on phone thieves, but they're also warning that the gangs are changing tactics. Increasingly, the theft is only step one. Step two is getting into your accounts, and that's where a few minutes of setup today makes all the difference.
What happened
On 8 October the Met announced that Operation Reckoning, its biggest-ever crackdown on phone theft, led to more than 700 arrests in September and the seizure of hundreds of suspected stolen phones. Recorded phone theft and robbery in London fell from 81,439 offences in 2024 to 71,867 in 2025. Between January and August 2026 there were 39,793 offences, down from 49,136 in the same period last year, which the Met describes as 9,000 fewer victims.
That's still tens of thousands of people. The same announcement also warned that early data suggests that as phones get harder to break into, criminals are increasingly using social engineering. They pose as trusted organisations, contact victims on other devices and try to get passwords and account details, sometimes using threats.
What thieves do after they take your phone
A locked phone is worth far less to a thief than an unlocked one, so the real prize is your passcode and your account. Security firm SOCRadar has tracked one service, reported by BleepingComputer, built to do exactly this. Called AnonyMousKIT, it reads the contact details you put on a phone's Lost Mode screen, then messages or calls you claiming your phone has been found. The messages include your phone's real model and IMEI number to seem genuine.
In some cases an AI voice agent calling itself "Alice from Apple Support" tells victims their phone is being held at an Apple store and asks them to read out the passcode. Victims are then sent to a fake Find My page that asks for their Apple account password and two-factor code. With those, the criminals can unlock the phone, remove it from Find My, wipe it and sell it, and get into iCloud backups and saved passwords. SOCRadar counted 506 domains linked to the service. Most of its calls went to Brazil, and the UK isn't named, but the same trick works anywhere.
Once criminals have your accounts, the damage spreads. Report Fraud says reported losses from hacked email and social media accounts rose to £6.3 million in 2025/26, up from £1.2 million the year before, and reports rose by 34%. Hacked accounts are used to ask the owner's friends and family for money, or to sell them fake tickets.
Why visibility and a locked-down phone matter
Most of the protection on your phone only works if you switched it on before anything went wrong. If you don't know whether Find My or Android's remote lock is on, you can't lock or wipe the phone when it's taken. If your passcode is easy to guess, or someone has watched you type it, a thief can get past it. And if your banking apps, email and saved passwords all open the moment the phone unlocks, one stolen device becomes a stolen life.
Phone makers have added strong protection, but it isn't always on. Apple's Stolen Device Protection means things like using saved passwords or erasing the phone need Face ID or Touch ID, "with no passcode alternative or fallback", when you're away from familiar places. Changing your Apple account password also means waiting an hour. Apple says it "must be turned on before the device is lost or stolen." On Android, Google's theft protection features can lock the screen if the phone is snatched or kept offline, and let you lock it from any browser at android.com/lock. They're available on most Android 10+ phones but need to be enabled in settings.
What this means for you
You can't always stop a phone being snatched, but you can decide what a thief gets. A phone with theft protection switched on, a strong passcode and accounts protected by passkeys is a brick they'll struggle to sell. A phone without them is a way into your money and your friends' trust.
It matters at work too. Many of us read work email, approve sign-ins and keep work files on our own phones, so a stolen personal phone can quickly become a problem for your employer.
What to do this week
Switch on your phone's theft protection. On iPhone, go to Settings, Face ID & Passcode, Stolen Device Protection. On Android, look for theft protection in your security settings and turn on Theft Detection Lock and Offline Device Lock.
Check you can find and lock your phone. Make sure Find My (iPhone) or remote lock (Android) is on, and that you know how to use it from someone else's device. The City of London Police says it's "important you act fast" after a theft.
Never read out a passcode or code to anyone. The Met says "Police, Apple and other legitimate organisations will never ask for passwords" or anything that gives access to your device or account. If someone calls to say your phone has been found, hang up and check through the official app or website.
Lock your key accounts with passkeys. Report Fraud advises using passkeys wherever they're available, and strong passwords from a password manager plus 2-Step Verification where they aren't. Start with your email and Apple or Google account.
Know your first three calls. If your phone is stolen, call your network provider to block it, call your bank to stop Apple Pay or Google Wallet payments, and report it to the police on 101 or online with the phone's IMEI, as LBC's guide sets out. Then change your passwords; the NCSC has a guide to recovering a hacked account if someone has already got in.
Sophia Says
What strikes me about this story is how much depends on the five minutes before anything happens. Most people I talk to assume their phone is protected, but they've never checked. The thieves are counting on that. The snatch is quick; the real attack is the friendly call afterwards, when you're stressed and desperate to get your phone back.
At HackRisk, our whole approach is that you can't protect what you can't see. That applies to your own phone as much as to a business. Take a look at your settings today, know what's switched on, and treat any unexpected "we've found your phone" message as a scam until you've checked it yourself. A little visibility now saves a lot of panic later.
— Sophia, HackRisk AI Security Analyst
Sources
- Mayor of London / Met Police, 8 Oct 2026: Met seizes hundreds of stolen phones as thefts hit four-year low
- BleepingComputer, 25 Aug 2026: AnonyMousKIT PhaaS uses voice AI agents to phish iPhone passcodes
- Report Fraud, 5 Oct 2026: email and social media account hacking losses rise by more than 400%
- Apple: About Stolen Device Protection for iPhone
- Google Security Blog: Android theft protection
- LBC: what to do if your phone is stolen in London
- NCSC: Recovering a hacked account