Even if you have never had your smartphone stolen, you probably know someone who has. In London, last year alone. And as victims of phone theft know, while the loss of a pricey gadget can sting, the dreary administrative slog in replacing a device that runs your entire life can, in some ways, be worse. So why canāt we stop phone thieves ā and is there a better way to protect your personal data?
The answer is partly down to the numerous ways that criminals profit from stolen phones, but it is also about technology firms prioritising usability over security and international governments failing to arrive at a global solution. In short, itās complicated.
Some victims place the blame with the police for failing to catch phone thieves. When Nav Dugmore from Wolverhampton, UK, travelled to London for the first time, she had her iPhone snatched seconds after leaving Euston train station, a major transport hub. āIt traumatised me, if Iām honest,ā she says. āThere needs to be something else put in place to stop them being able to use your phone, and I think the police need to be doing more.ā
Advertisement
Londonās Metropolitan Police told her that several other thefts had happened at the same spot in the previous hour and admitted there was āno chanceā of recovery. Dugmore had the phoneās face-recognition security setting turned on, but the device was unlocked when it was grabbed and the thief quickly spent Ā£300 in various shops around London. By far the biggest blow was the loss of photos of her three children growing up, she says, which werenāt backed up.
When a phone like Dugmoreās is stolen, it enters a conveyor belt of crime, with multiple possible destinations. The simplest route is the thief simply selling the handset on, often to be resold in another country. Phones can be sold for parts to unscrupulous repair shops, too. Daniel Green, an inspector at the City of London Police, says phone snatchers have links to gangs that export the devices, essentially smuggling them out the same way as drugs are smuggled in. āWhat weāve found suggests boxes and boxes of phones going out [of the country],ā he says.
Then there are more involved scams, like removing the SIM card that identifies a phone to the network and placing it into another handset. This allows criminals to read text messages destined for the victim and can get them access to email and websites that use two-factor authentication. This can be combatted by setting up a PIN for your SIM card, but this must be done before the phone is stolen.
The most valuable phone for thieves to target is one with no security protections, but even setting a PIN on your handset wonāt necessarily protect you, says James OāSullivan, who runs an app called Nuke designed to help people in the aftermath of their phone being stolen. Thieves may simply look over your shoulder to see your PIN, or use more devious tricks. For instance, activating an iPhoneās Emergency SOS feature and then cancelling it will temporarily disable access via face or fingerprint recognition, forcing you to input your PIN the next time you unlock it. A clever thief can offer to take a photo for you, surreptitiously pull this trick, then snoop when you enter your PIN after they hand back the phone.
With unlocked access, criminal options become even more sophisticated. Thieves can steal money from online banking apps or cryptocurrency wallets, then message the victimās friends and family to scam them into sending emergency funds. They can even post nefarious links on social media accounts to phish others into providing their logins or private data.
So what can be done? The UK government at least recognises that there is a problem. It launched promising to pressurise smartphone manufacturers to permanently disable stolen phones. It also pledged to conduct an investigation to learn more about the people who steal phones, where the devices end up and how to stop the problem.
In theory, the technology already exists to disable stolen phones. Each device carries a unique IMEI code and those reported stolen can be blocked from cell phone networks, which already happens on a per-country basis in places including the UK, Canada and the US. But a phone blocked in this way can still access the internet through Wi-Fi connections. The Met Police has long urged technology firms to build on this and also Ā such as data backup and photo storage, which would reduce their functionality and make them less attractive to thieves. So far, Apple and Google have declined to do so.
Even this wouldnāt help if such restrictions continue to operate on a per-country basis, as is the case with IMEI blocks now, as criminals can simply send phones to a country where they arenāt blocked. Green says he would like to see manufacturers create a permanent kill switch for devices, to completely remove the incentive for criminals to take phones. āI donāt know whether itās just not a problem for them,ā he says. āMore pressure needs to be put on them. Weāre trying to pick up the pieces on our end and itās very, very difficult.ā
Jordan Hare, a former police digital forensics expert who now works at private security firm S-RM, says phones are already equipped with security features that should keep even the most determined crooks at bay. For example, some phones automatically lock if they detect a sudden jerking movement, like being snatched by a thief.
The problem is that many of these options are turned off by default ā something Hare suspects is done to make life as simple and seamless as possible for users. āAn opt-in for these features actually doesnāt help the general consumer because they donāt necessarily know theyāre there,ā he says. āWhereas an opt-out scheme, having them on by default, having better information provided when you first set up your phone about āthis setting is on, this is what it does, this is why you shouldnāt turn it offā, for example, actually puts measures in place ahead of a phone being stolen.ā
Meanwhile, other security features that sound promising, like the ability to track the current location of your phone from a web browser, simply fail to make a difference in the real world. If a phone is tracked to a large block of flats, there is little police officers can do without further information .
That was certainly Dugmoreās experience with her stolen iPhone. āThe last location was about 10 miles away from where my phone was stolen,ā she says. āThe police did say āthereās no chance of you getting that phone backā.ā When asked about the incident, the Metropolitan Police told Ā鶹“«Ć½: āUnfortunately the investigation couldnāt be progressed further due to a lack of CCTV in the area. We recognise the victimās frustration.ā
Most major smartphone venders didnāt respond to a request for comment by Ā鶹“«Ć½, with Samsung, Xiaomi and Google failing to reply. Apple did respond, however.
āWe have been working on this issue from a hardware, software and customer-support standpoint for more than the last decade,ā says an Apple spokesperson. āWe have made and continue to make significant investments to create industry-leading tools and features that put control in the hands of our users in the event of theft.ā The spokesperson declined to explain why some security options arenāt turned on by default.
Ultimately, the only way to prevent smartphone theft ā other than being careful whenever you use your device in public ā is for manufacturers to make it not worth criminalās while. They have control over the hardware and software, and could bring in unhackable features that completely lock down a phone, its apps and its spare parts from abuse or resale. But OāSullivan says it just doesnāt seem to be a priority. āIf Iām brutally honest, itās probably not their biggest thing, because stolen phones are reasonably good business for people that are selling new phones.ā
