Activation Lock Removed, But Not Clean: The Phishing Scam Behind Stolen Phones
· TR Vertriebs GmbH
After a phone theft, a second wave often follows: phishing texts posing as a "finder" to bypass activation lock. What Deutsche Telekom's July 2026 warning means for buyers and sellers of used phones.
Losing a phone to theft often comes with a second wave days or weeks later. On 14 July 2026, Deutsche Telekom explicitly warned its customers: criminals get in touch by text message, posing as the person who supposedly found the device, to get hold of the Apple ID or Google account credentials. iPhones are hit especially often, according to Telekom, and the company names the beach, a bar and the open street as the typical scenes of the theft itself, exactly the moments when a quick grab succeeds.
The scam follows a fixed pattern: the text claims the lost or stolen device has turned up again and links to a page built to look just like the real Apple or Google sign-in. Anyone who enters their credentials there hands the attackers exactly what they need: the ability to remove the device from its previous owner's account. Only after that can the activation lock be lifted, known on Apple devices as Find My and handled on Android through the Google account device search, and only then does the stolen device become sellable on the resale market at all.
That is exactly the trap Telekom is warning about: the danger does not end with the theft itself. Many victims let their guard down after a few weeks and react to what looks like good news without thinking it through. Telekom therefore advises leaving a stolen device marked as lost in the Apple or Google account until it is physically back in hand, never entering credentials through a link from a text or email but always typing the manufacturer's site in directly, and forwarding suspicious messages via the short code 7726 or the spam-reporting feature built into iOS and Android.
That this is not the work of lone operators became clear in September 2024, when Europol, the analytics firm Group-IB and the Latin American police body Ameripol coordinated an international takedown: they dismantled iServer, a platform that offered exactly these phishing pages as a ready-made service to other criminals. Europol's tally: more than 1.2 million targeted mobile devices, roughly 483,000 victims worldwide, and 17 arrests across Argentina, Chile, Colombia, Ecuador, Peru and Spain, infrastructure that had been running for more than five years before it was taken down.
That phone theft and phishing increasingly go hand in hand also lines up with the Cybersicherheitsmonitor 2026, published in May 2026 by Germany's BSI and ProPK, the police crime-prevention programme of the federal and state governments: 11 percent of internet users in Germany were victims of cybercrime in 2025, up from 7 percent the year before, roughly a 50 percent jump within a single year. Reports drawing on that monitor specifically describe the pattern of a stolen smartphone followed by phishing disguised as a message from Apple Support or from the Find My service itself.
For anyone buying a used phone, that is more than a footnote. A device that no longer shows an account link at the point of sale is not automatically clean, it may have been unlocked by exactly this route, using a stranger's stolen credentials. A fresh factory reset with no account history at all, an unusually low price for a current model, or a seller who cannot produce a receipt or original packaging are warning signs, but none of them is proof on its own.
The only reliable step is checking it yourself before the handover: run the IMEI against the international blacklists, and separately check the activation lock status with Apple or Google. Only once both come back clean is it worth the next step, have the seller reset the device to the setup screen live, in front of you, so it is visible whether a stranger's account is still being requested. Payment comes only after that, never before.
For dealers buying in volume, checking one setup screen at a time was never going to scale anyway. Incoming stock can be checked in bulk through an IMEI API instead of looking up every device by hand, the only practical approach once purchasing runs into the hundreds of units a day, and precisely the resale channels that the unlocker infrastructure behind iServer was built to feed.
IMEI Safe clears both in seconds: blacklist status and activation lock, one IMEI at a time or in bulk via the dealer API, before money changes hands, not after.